Weaknesses of type CWE-348

104 results

Uso de fonte menos confiável

A aplicação confia em dados ou instruções de uma fonte com menor nível de confiança (como entrada de usuário, rede não autenticada ou sistema terceiro) quando deveria usar uma fonte mais segura (como configuração local validada ou sistema interno autenticado). Isso permite que um atacante contamine decisões críticas do programa.

Example

Um sistema de pagamento que valida o valor da transação consultando um parâmetro enviado pelo cliente HTTP, em vez de recuperar o preço armazenado no banco de dados do servidor. Um atacante pode modificar o parâmetro e pagar menos do que deveria.

How to mitigate

Nunca confie em dados do cliente para decisões de segurança ou negócio críticas. Sempre valide e recupere informações sensíveis a partir de fontes internas (banco de dados, configuração do servidor) e use autenticação/autorização para qualquer dado externo que precise processar.

CVE-2026-44183CRITICALCleanuparr: X-Forwarded-For leftmost parsing allows remote unauthenticated admin takeover when reverse-proxy mode is enabledEPSS 0.2%CVE-2026-86041MEDIUMezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` headerEPSS 0.2%CVE-2026-119711MEDIUMPipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For HeaderEPSS 0.2%CVE-2026-77463MEDIUMRemark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deploymentEPSS 0.2%CVE-2022-4533MEDIUMLimit Login Attempts Plus <= 1.1.0 - IP Address Spoofing to Protection Mechanism BypassEPSS 0.2%CVE-2026-16272CRITICALClient IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API WHMCS ModuleEPSS 0.2%CVE-2022-4532MEDIUMLOGIN AND REGISTRATION ATTEMPTS LIMIT<= 2.1 - IP Address Spoofing to Protection Mechanism BypassEPSS 0.2%CVE-2026-108736MEDIUMSpeedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For SpoofingEPSS 0.2%CVE-2026-62987MEDIUMFabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection headerEPSS 0.2%CVE-2026-110726MEDIUMIn `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from tEPSS 0.2%CVE-2026-101277MEDIUMTrusted Domain Project OpenDKIM Tag Tokenizer dkim.c dkim_process_set less trusted sourceEPSS 0.2%CVE-2025-27913LOWPassbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), canEPSS 0.2%CVE-2020-37248MEDIUMOfflineIMAP before 8.0.3 trusts the server with their STARTTLS capability prior to authentication, which allows STRIPTLS/man-in-the-middle aEPSS 0.2%CVE-2026-108162MEDIUMPingvin Share X before 1.22.0 Rate Limit Bypass via Spoofed X-Forwarded-ForEPSS 0.2%CVE-2025-24856MEDIUMAn issue was discovered in the oidc (aka OpenID Connect Authentication) extension before 4.0.0 for TYPO3. The account linking logic allows aEPSS 0.2%CVE-2026-103592MEDIUMsimple-php-router through 5.4.1.7 IP restriction bypass via forwarding headersEPSS 0.2%CVE-2026-59897MEDIUMHono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplicationEPSS 0.2%CVE-2026-61589MEDIUMdjust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live pathEPSS 0.2%CVE-2026-33690MEDIUMAVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()EPSS 0.2%CVE-2026-54289MEDIUMHono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the restEPSS 0.2%