Weaknesses of type CWE-940

73 results

Verificação inadequada da origem de um canal de comunicação

A aplicação aceita dados ou comandos de um canal de comunicação sem verificar adequadamente se a origem é realmente confiável. Isso permite que um atacante se faça passar por um componente legítimo — servidor, cliente, módulo interno — e injete dados maliciosos ou comandos não autorizados.

Example

Um serviço backend recebe requisições em um socket ou fila de mensagens sem validar se o remetente é autenticado; um atacante se conecta à mesma fila e envia comandos administrativos forjados, conseguindo alterar configurações da aplicação.

How to mitigate

Implemente autenticação obrigatória (certificados, tokens, chaves) antes de aceitar qualquer dado do canal; valide a identidade da origem em cada mensagem e rejeite tudo que não puder ser verificado. Use criptografia e assinatura digital para garantir integridade e origem.

CVE-2024-36506LOWAn improper verification of source of a communication channel vulnerability [CWE-940] in FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, 7.0 all EPSS 0.5%CVE-2026-54106MEDIUMU.S. GAO EPDS and CBCA EDS network access control bypassEPSS 0.5%CVE-2025-40820HIGHAffected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This EPSS 0.5%CVE-2024-26131HIGHElement Android Intent RedirectionEPSS 0.5%CVE-2026-23866MEDIUMIncomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for AndroidEPSS 0.5%CVE-2024-49579HIGHIn JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requestsEPSS 0.4%CVE-2024-20390MEDIUMCisco IOS XR Software Dedicated XML Agent TCP Denial of Service VulnerabilityEPSS 0.4%CVE-2026-87705HIGHWindows Hyper-V Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2026-119568CRITICALvsftpd through 3.0.5 require_ssl_reuse Bypass via FTPS Data Channel HijackingEPSS 0.4%CVE-2024-40503MEDIUMAn issue in Tenda AX12 v.16.03.49.18_cn+ allows a remote attacker to cause a denial of service via the Routing functionality and ICMP packetEPSS 0.4%CVE-2026-85085CRITICALThe Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page lEPSS 0.4%CVE-2026-2611CRITICALImproper Origin Validation in mlflow/mlflowEPSS 0.4%CVE-2024-37662MEDIUMTP-LINK TL-7DR5130 v1.0.23 is vulnerable to TCP DoS or hijacking attacks. An attacker in the same WLAN as the victim can disconnect or hijacEPSS 0.4%CVE-2024-37664MEDIUMRedmi router RB03 v1.0.57 is vulnerable to TCP DoS or hijacking attacks. An attacker in the same WLAN as the victim can disconnect or hijackEPSS 0.4%CVE-2026-35643HIGHOpenClaw < 2026.3.22 - Arbitrary Code Execution via Unvalidated WebView JavascriptInterfaceEPSS 0.4%CVE-2024-1621HIGHuniFLOW Online device registration susceptible to compromiseEPSS 0.4%CVE-2026-89178HIGHHowyar｜WeenyGenius - Origin Validation ErrorEPSS 0.4%CVE-2026-101897MEDIUMAngular DevTools (Local DoS)EPSS 0.4%CVE-2026-6734HIGHundici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuseEPSS 0.3%CVE-2024-7322MEDIUMDos in ZigBee device due to unsolicited encrypted rejoin responseEPSS 0.3%