Fallos del tipo CWE-346

518 resultados

Validação incorreta de origem (Origin Validation Error)

A aplicação falha em validar corretamente a origem (origem HTTP, domínio, referência) de requisições ou recursos, permitindo que um atacante simule estar vindo de uma origem confiável. Isso quebra mecanismos de segurança como CORS, CSRF e validações de referência, abrindo porta para ataques cross-site.

Ejemplo

Um banco implementa proteção CSRF verificando se o header `Origin` é igual a `banco.com.br`, mas não valida subdomínios. Um atacante consegue fazer requisições de `falso.banco.com.br` que passam na validação e transferem dinheiro da vítima.

Cómo mitigar

Valide a origem de forma rigorosa usando whitelist explícita (não apenas prefixos ou sufixos), implemente tokens CSRF anti-previsíveis, configure CORS corretamente evitando `Access-Control-Allow-Origin: *`, e use SameSite cookies quando possível.

CVE-2025-34291CRITICALLangflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCEEPSS 83.8%KEVCVE-2023-29711CRITICALAn incorrect access control issue was discovered in Interlink PSG-5124 version 1.0.4, allows attackers to execute arbitrary code via craftedEPSS 70.3%CVE-2015-4495HIGHThe PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypassEPSS 68.7%KEVCVE-2024-23898HIGHJenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests maEPSS 67.2%CVE-2021-33959HIGHPlex media server 1.21 and before is vulnerable to ddos reflection attack via plex service.EPSS 15.0%CVE-2024-36421HIGHGHSL-2023-234: Flowise Cors Misconfiguration in packages/server/src/index.tsEPSS 6.0%CVE-2025-53399MEDIUMIn Sipwise rtpengine before 13.4.1.1, an origin-validation error in the endpoint-learning logic of the media-relay core allows remote attackEPSS 4.9%CVE-2018-15723—The Logitech Harmony Hub before version 4.15.206 is vulnerable to application level command injection via crafted HTTP request. An unauthentEPSS 3.7%CVE-2025-69258CRITICALA LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL EPSS 3.5%CVE-2023-33443CRITICALIncorrect access control in the administrative functionalities of BES--6024PB-I50H1 VideoPlayTool v2.0.1.0 allow attackers to execute arbitrEPSS 3.5%CVE-2017-6519CRITICALavahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, whicEPSS 3.2%CVE-2021-37705CRITICALImproper Authorization and Origin Validation Error in OneFuzzEPSS 2.4%CVE-2019-9498—The implementations of EAP-PWD in hostapd EAP Server do not validate the scalar and element values in EAP-pwd-CommitEPSS 2.2%CVE-2019-9499—The implementations of EAP-PWD in wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-CommitEPSS 2.2%CVE-2020-11868HIGHntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode EPSS 2.1%CVE-2023-23578HIGHImproper access control vulnerability in SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier allows a remote unauthenticated attacker to coEPSS 2.0%CVE-2023-32223HIGHD-Link DSL-224 firmware version 3.0.10 post authentication command executionEPSS 1.8%CVE-2024-50654HIGHlilishop <=4.2.4 is vulnerable to Incorrect Access Control, which can allow attackers to obtain coupons beyond the quantity limit by capturiEPSS 1.6%CVE-2025-69260HIGHA message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service conditionEPSS 1.6%CVE-2025-69259HIGHA message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service EPSS 1.6%