Fallos del tipo CWE-346

589 resultados

Validação incorreta de origem (Origin Validation Error)

A aplicação falha em validar corretamente a origem (origem HTTP, domínio, referência) de requisições ou recursos, permitindo que um atacante simule estar vindo de uma origem confiável. Isso quebra mecanismos de segurança como CORS, CSRF e validações de referência, abrindo porta para ataques cross-site.

Ejemplo

Um banco implementa proteção CSRF verificando se o header `Origin` é igual a `banco.com.br`, mas não valida subdomínios. Um atacante consegue fazer requisições de `falso.banco.com.br` que passam na validação e transferem dinheiro da vítima.

Cómo mitigar

Valide a origem de forma rigorosa usando whitelist explícita (não apenas prefixos ou sufixos), implemente tokens CSRF anti-previsíveis, configure CORS corretamente evitando `Access-Control-Allow-Origin: *`, e use SameSite cookies quando possível.

CVE-2026-17857MEDIUMInappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crEPSS 0.2%CVE-2025-62250MEDIUMImproper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 throEPSS 0.2%CVE-2026-17876MEDIUMInappropriate implementation in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a cEPSS 0.2%CVE-2026-17871MEDIUMInappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage iEPSS 0.2%CVE-2026-17897MEDIUMInappropriate implementation in ORB in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafteEPSS 0.2%CVE-2026-17895MEDIUMInappropriate implementation in DataTransfer in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engagEPSS 0.2%CVE-2026-17885MEDIUMInappropriate implementation in Paint in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafEPSS 0.2%CVE-2026-16381CRITICALSame-origin policy bypass in the Networking: DNS componentEPSS 0.2%CVE-2025-5824MEDIUMAutel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass VulnerabilityEPSS 0.2%CVE-2026-92706LOWDark Reader: Ability to request icon-like bitmap data from certain local web serversEPSS 0.2%CVE-2025-42706MEDIUMCrowdStrike Falcon Sensor for Windows Logic ErrorEPSS 0.2%CVE-2025-47909HIGHImproper validation of TrustedOrigins allows CSRF attacks in github.com/gorilla/csrfEPSS 0.2%CVE-2026-40594MEDIUMpyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)EPSS 0.2%CVE-2026-66298HIGHJS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcutsEPSS 0.2%CVE-2026-7581MEDIUMalexta69 MeTube CORS Policy main.py on_prepare cross-domain policyEPSS 0.2%CVE-2026-35408HIGHDirectus is Missing Cross-Origin Opener PolicyEPSS 0.2%CVE-2026-66313MEDIUMMicrosoft Edge (Chromium-based) Tampering VulnerabilityEPSS 0.2%CVE-2026-43972MEDIUMgun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injectionEPSS 0.2%CVE-2024-6301MEDIUMOrigin Validation Error in ConduitEPSS 0.2%CVE-2026-54030HIGHLibreChat: Missing Resource Parameter Validation in MCP OAuth FlowEPSS 0.2%