Fallos del tipo CWE-346

518 resultados

Validação incorreta de origem (Origin Validation Error)

A aplicação falha em validar corretamente a origem (origem HTTP, domínio, referência) de requisições ou recursos, permitindo que um atacante simule estar vindo de uma origem confiável. Isso quebra mecanismos de segurança como CORS, CSRF e validações de referência, abrindo porta para ataques cross-site.

Ejemplo

Um banco implementa proteção CSRF verificando se o header `Origin` é igual a `banco.com.br`, mas não valida subdomínios. Um atacante consegue fazer requisições de `falso.banco.com.br` que passam na validação e transferem dinheiro da vítima.

Cómo mitigar

Valide a origem de forma rigorosa usando whitelist explícita (não apenas prefixos ou sufixos), implemente tokens CSRF anti-previsíveis, configure CORS corretamente evitando `Access-Control-Allow-Origin: *`, e use SameSite cookies quando possível.

CVE-2024-36472MEDIUMIn GNOME Shell through 45.7, a portal helper can be launched automatically (without user confirmation) based on network responses provided bEPSS 0.3%CVE-2024-41475CRITICALGnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration.EPSS 0.3%CVE-2025-71217HIGHAn origin validation error vulnerability in the Trend Micro Apex One (mac) agent self-protection mechanism could allow a local attacker to eEPSS 0.3%CVE-2024-8024HIGHCORS Misconfiguration in netease-youdao/qanythingEPSS 0.3%CVE-2024-5549HIGHData leak through CORS misconfiguration in stitionai/devikaEPSS 0.3%CVE-2022-29915MEDIUMThe Performance API did not properly hide the fact whether a request cross-origin resource has observed redirects. This vulnerability affectEPSS 0.3%CVE-2025-24010MEDIUMVite allows any websites to send any requests to the development server and read the responseEPSS 0.3%CVE-2026-58169HIGHVibe-Trading < 0.1.10 - Loopback Trust and Missing Host Validation Enable DNS-Rebinding Authentication Bypass and Remote Code ExecutionEPSS 0.3%CVE-2023-37210—A website could prevent a user from exiting full-screen mode via alert and prompt calls. This could lead to user confusion and possible spoEPSS 0.3%CVE-2024-11602HIGHCORS Vulnerability in feast-dev/feastEPSS 0.3%CVE-2026-32634HIGHGlances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed ServersEPSS 0.3%CVE-2024-6844MEDIUMInconsistent CORS Matching Due to Handling of '+' in URL Path in corydolphin/flask-corsEPSS 0.3%CVE-2022-41961MEDIUMBigBlueButton subject to Ineffective user bansEPSS 0.3%CVE-2023-49803HIGH@koa/cors has overly permissive origin policyEPSS 0.3%CVE-2020-26234MEDIUMDisabled Hostname Verification in OpenCastEPSS 0.3%CVE-2024-8487HIGHCORS Vulnerability in modelscope/agentscopeEPSS 0.3%CVE-2026-10937HIGHInappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy viaEPSS 0.3%CVE-2024-51037MEDIUMAn issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information via the captcha feature in the password resEPSS 0.3%CVE-2026-54665MEDIUMApache NiFi: Missing Validation for Proxy Host HeadersEPSS 0.3%CVE-2022-1520MEDIUMWhen viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may shoEPSS 0.3%