Weaknesses of type CWE-346

696 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2026-58169HIGHVibe-Trading < 0.1.10 - Loopback Trust and Missing Host Validation Enable DNS-Rebinding Authentication Bypass and Remote Code ExecutionEPSS 0.4%CVE-2023-20275MEDIUMA vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTEPSS 0.4%CVE-2021-47157CRITICALThe Kossy module before 0.60 for Perl allows JSON hijacking because of X-Requested-With mishandling.EPSS 0.4%CVE-2022-30228HIGHA vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected software does not apply cross-origin rEPSS 0.4%CVE-2023-25366CRITICALIn Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS, insecure SCPI interface discloses web password.EPSS 0.4%CVE-2022-23032—In all versions before 7.2.1.4, when proxy settings are configured in the network access resource of a BIG-IP APM system, connecting BIG-IP EPSS 0.4%CVE-2026-25604MEDIUMApache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication BypassEPSS 0.4%CVE-2022-50925HIGHProwise Reflect v1.0.9 - Remote Keystroke InjectionEPSS 0.4%CVE-2024-9393HIGHAn attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.js` origin. This coulEPSS 0.4%CVE-2024-25996MEDIUMPHOENIX CONTACT: Remote code execution due to an origin validation error in CHARX Series EPSS 0.4%CVE-2023-2589MEDIUMAn issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before EPSS 0.4%CVE-2022-38472MEDIUMAn attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the adEPSS 0.4%CVE-2026-70213HIGHMicrosoft Power Apps Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-22794CRITICALAccount Takeover Vulnerability in AppsmithEPSS 0.4%CVE-2026-114125HIGHStorybook: Missing origin validation in Storybook preview allows code injection from malicious websitesEPSS 0.4%CVE-2026-2611CRITICALImproper Origin Validation in mlflow/mlflowEPSS 0.4%CVE-2023-2639MEDIUMRockwell Automation FactoryTalk System Services Vulnerable to Sensitive Information DisclosureEPSS 0.4%CVE-2026-43870HIGHApache Thrift: Node.js web_server.js multi-vulnerabilityEPSS 0.4%CVE-2026-75156CRITICALApache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypassEPSS 0.4%CVE-2024-57965NONEIn axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted sEPSS 0.4%