Weaknesses of type CWE-346

696 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2023-22899MEDIUMZip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive.EPSS 0.6%CVE-2020-14519—This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are affected, including VEPSS 0.6%CVE-2026-27148HIGHStorybook Dev Server Vulnerable to WebSocket HijackingEPSS 0.6%CVE-2023-5858MEDIUMInappropriate implementation in WebApp Provider in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI EPSS 0.6%CVE-2022-31024MEDIUMFederated editing allows iframing remote servers by default in richdocumentsEPSS 0.6%CVE-2018-10591—In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prioEPSS 0.6%CVE-2026-23552CRITICALApache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicyEPSS 0.6%CVE-2021-39175HIGHXSS vector in slide mode speaker-viewEPSS 0.6%CVE-2021-39185CRITICALDefault CORS config allows any origin with credentialsEPSS 0.6%CVE-2023-29728CRITICALThe Call Blocker application 6.6.3 for Android allows attackers to tamper with feature-related data, resulting in a severe elevation of privEPSS 0.6%CVE-2020-15733MEDIUMURL Spoofing Vulnerability in Bitdefender SafePay (VA-8958)EPSS 0.6%CVE-2020-26253MEDIUM.dev domains treated as local in KirbyEPSS 0.6%CVE-2020-9060—Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZENEPSS 0.6%CVE-2024-36302HIGHAn origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecteEPSS 0.6%CVE-2023-29743HIGHAn issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating thEPSS 0.5%CVE-2024-9392CRITICALA compromised content process could have allowed for the arbitrary loading of cross-origin pages. This vulnerability affects Firefox < 131, EPSS 0.5%CVE-2026-62316HIGHMicrosoft UFO: DNS Rebinding → Unauthenticated File Read / Command ExecutionEPSS 0.5%CVE-2023-0132MEDIUMInappropriate implementation in in Permission prompts in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to force EPSS 0.5%CVE-2021-32985HIGHAVEVA System Platform Origin Validation ErrorEPSS 0.5%CVE-2025-3462HIGH"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation in ASEPSS 0.5%