Weaknesses of type CWE-923

86 results

Restrição inadequada do canal de comunicação aos pontos finais pretendidos

A aplicação falha em validar ou restringir adequadamente para quem está enviando ou recebendo dados, permitindo que comunicações cheguem a endpoints não autorizados. Isso ocorre quando não há verificação suficiente de origem, destino ou identidade das partes na comunicação, criando brechas para interceptação, redirecionamento ou acesso por terceiros.

Example

Um serviço de microserviços que se comunica via gRPC sem validar certificados TLS, permitindo que um atacante na mesma rede se passe por outro serviço legítimo e intercepte requisições sensíveis. Ou uma API que não valida o referer/origin e permite requisições de domínios arbitrários, viabilizando CSRF ou roubo de dados.

How to mitigate

Implemente validação explícita de origem/identidade (certificados mTLS, tokens assinados, IP whitelisting conforme contexto); use canais criptografados e autenticados (TLS, HTTPS obrigatório); valide headers como Origin, Referer e implemente CORS restritivo; autentique ambos os lados da comunicação, nunca confiando implicitamente na rede.

CVE-2026-91166MEDIUMWarpgate: Web SSH stores a jump host's key against the target's address, so it validates as the targetEPSS 0.2%CVE-2026-22715MEDIUMVMware Workstation/Fusion NAT vulnerabilityEPSS 0.2%CVE-2026-22726MEDIUMRoute Services Firewall BypassEPSS 0.2%CVE-2026-81871MEDIUMOpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinningEPSS 0.2%CVE-2025-36180MEDIUMInadequate Pod Communication Restrictions, affects watsonx.dataEPSS 0.2%CVE-2025-58742HIGHInsufficient Configuration Protections Enable Database Credential Interception in Milner ImageDirector CaptureEPSS 0.2%CVE-2026-10756HIGHTRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to EPSS 0.2%CVE-2022-2835MEDIUMA flaw was found in coreDNS. This flaw allows a malicious user to reroute internal calls to some internal services that were accessed by theEPSS 0.2%CVE-2026-82932MEDIUMMissing Firewall Configuration in mH-DEVELOPEREPSS 0.2%CVE-2025-36145MEDIUMMultiple Vulnerabilities in watsonx.dataEPSS 0.2%CVE-2025-27769LOWA vulnerability has been identified in Heliox Flex 180 kW EV Charging Station (All versions < F4.11.1), Heliox Mobile DC 40 kW EV Charging SEPSS 0.2%CVE-2025-33176MEDIUMNVIDIA RunAI for all platforms contains a vulnerability where a user could cause an improper restriction of communications channels on an adEPSS 0.2%CVE-2022-38125LOWFTP Agent forwards traffic on inactive ports to LinkManagerEPSS 0.2%CVE-2025-32886MEDIUMAn issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. All packets sent over RF are also sent over UART with USB EPSS 0.1%CVE-2024-47125HIGHImproper Restriction of Communication Channel to Intended Endpoints in goTenna ProEPSS 0.1%CVE-2026-12539MEDIUMDocker Sandboxes ICMP egress restriction bypass after daemon restartEPSS 0.1%CVE-2026-110909MEDIUMWheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A proEPSS 0.1%CVE-2025-36438MEDIUMMultiple Vulnerabilities in IBM Concert SoftwareEPSS 0.1%CVE-2025-35978MEDIUMImproper restriction of communication channel to intended endpoints issue exists in UpdateNavi V1.4 L10 to L33 and UpdateNaviInstallService EPSS 0.1%CVE-2026-55655MEDIUMOpenssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versionsEPSS 0.1%