Fallos del tipo CWE-346

589 resultados

Validação incorreta de origem (Origin Validation Error)

A aplicação falha em validar corretamente a origem (origem HTTP, domínio, referência) de requisições ou recursos, permitindo que um atacante simule estar vindo de uma origem confiável. Isso quebra mecanismos de segurança como CORS, CSRF e validações de referência, abrindo porta para ataques cross-site.

Ejemplo

Um banco implementa proteção CSRF verificando se o header `Origin` é igual a `banco.com.br`, mas não valida subdomínios. Um atacante consegue fazer requisições de `falso.banco.com.br` que passam na validação e transferem dinheiro da vítima.

Cómo mitigar

Valide a origem de forma rigorosa usando whitelist explícita (não apenas prefixos ou sufixos), implemente tokens CSRF anti-previsíveis, configure CORS corretamente evitando `Access-Control-Allow-Origin: *`, e use SameSite cookies quando possível.

CVE-2023-44190MEDIUMJunos OS Evolved: PTX10001, PTX10004, PTX10008, PTX10016: MAC address validation bypass vulnerabilityEPSS 0.2%CVE-2026-59883MEDIUMGuzzle: Cookie Disclosure and Injection via IP-Address DomainsEPSS 0.2%CVE-2022-32144HIGHThere is an insufficient input verification vulnerability in Huawei product. Successful exploitation of this vulnerability may lead to serviEPSS 0.2%CVE-2026-17916HIGHInsufficient policy enforcement in Settings in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderEPSS 0.2%CVE-2025-46737HIGHOrigin Validation ErrorEPSS 0.2%CVE-2023-28191—This issue was addressed with improved redaction of sensitive information. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4EPSS 0.2%CVE-2026-46611MEDIUMGlances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding AttackEPSS 0.2%CVE-2024-22062MEDIUMPermissions and Access Control Vulnerability in ZTE ZXCLOUD IRAIEPSS 0.2%CVE-2026-66420HIGHMeshCentral Cross-Site WebSocket Hijacking via Origin Validation Bypass on Self-Signed Certificate DeploymentsEPSS 0.2%CVE-2026-11036MEDIUMInappropriate implementation in DOM in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a craEPSS 0.2%CVE-2026-81092HIGHmcp-go before 0.56.0 Missing Host Header Validation Enables DNS RebindingEPSS 0.2%CVE-2026-11081MEDIUMInappropriate implementation in Canvas in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a EPSS 0.2%CVE-2026-17905MEDIUMInappropriate implementation in SurfaceCapture in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data vEPSS 0.2%CVE-2026-17963MEDIUMInappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafteEPSS 0.2%CVE-2026-11161MEDIUMInappropriate implementation in DataTransfer in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data viaEPSS 0.2%CVE-2026-17959MEDIUMInappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crEPSS 0.2%CVE-2026-87563MEDIUMOrigin validation error in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a craftedEPSS 0.2%CVE-2026-85152HIGHundici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptorsEPSS 0.2%CVE-2026-17911MEDIUMInsufficient policy enforcement in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a craEPSS 0.2%CVE-2026-74960HIGHSite isolation issue in the WebExtensions componentEPSS 0.2%