Weaknesses of type CWE-346

588 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2025-3651CRITICALCommand Injection in iManage Work Desktop for Mac's Agent ServiceEPSS 0.3%CVE-2026-42341CRITICALFOSSBilling has an unauthenticated payment bypass via IPN callback forgeryEPSS 0.3%CVE-2026-58649MEDIUM.NET Information Disclosure VulnerabilityEPSS 0.3%CVE-2025-3071MEDIUMInappropriate implementation in Navigations in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engageEPSS 0.3%CVE-2026-43700MEDIUMA cross-origin issue was addressed with improved tracking of security origins. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS EPSS 0.3%CVE-2026-27118MEDIUMCache poisoning in @sveltejs/adapter-vercelEPSS 0.3%CVE-2022-1520MEDIUMWhen viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may shoEPSS 0.3%CVE-2026-59153LOWAnki's local HTTP server does not sufficiently validate requestsEPSS 0.3%CVE-2023-28318MEDIUMA vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the Message_KeepHistory or Message_ShowDeleteEPSS 0.3%CVE-2026-10996MEDIUMInappropriate implementation in Workers in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via aEPSS 0.3%CVE-2023-3581MEDIUMWebSockets accept connections from HTTPS originEPSS 0.3%CVE-2024-44212MEDIUMA cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1, iOS 18.1 and iPadOS 18.1, macOS EPSS 0.3%CVE-2024-24557MEDIUMMoby classic builder cache poisoningEPSS 0.3%CVE-2024-55917HIGHAn origin validation error vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installatioEPSS 0.3%CVE-2025-4542LOWFreeebird Hotel 酒店管理系统 API SessionInterceptor.java cross-domain policyEPSS 0.3%CVE-2025-10201HIGHInappropriate implementation in Mojo in Google Chrome on Android, Linux, ChromeOS prior to 140.0.7339.127 allowed a remote attacker to bypasEPSS 0.3%CVE-2023-29745HIGHAn issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating thEPSS 0.3%CVE-2024-55948HIGHAnonymous cache poisoning via XHR requests in DiscourseEPSS 0.3%CVE-2025-23023HIGHAnonymous cache poisoning via request headers in DiscourseEPSS 0.3%CVE-2025-5320MEDIUMgradio-app gradio CORS is_valid_origin privilege escalationEPSS 0.3%