Fallos del tipo CWE-346

589 resultados

Validação incorreta de origem (Origin Validation Error)

A aplicação falha em validar corretamente a origem (origem HTTP, domínio, referência) de requisições ou recursos, permitindo que um atacante simule estar vindo de uma origem confiável. Isso quebra mecanismos de segurança como CORS, CSRF e validações de referência, abrindo porta para ataques cross-site.

Ejemplo

Um banco implementa proteção CSRF verificando se o header `Origin` é igual a `banco.com.br`, mas não valida subdomínios. Um atacante consegue fazer requisições de `falso.banco.com.br` que passam na validação e transferem dinheiro da vítima.

Cómo mitigar

Valide a origem de forma rigorosa usando whitelist explícita (não apenas prefixos ou sufixos), implemente tokens CSRF anti-previsíveis, configure CORS corretamente evitando `Access-Control-Allow-Origin: *`, e use SameSite cookies quando possível.

CVE-2026-17911MEDIUMInsufficient policy enforcement in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a craEPSS 0.2%CVE-2026-85152HIGHundici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptorsEPSS 0.2%CVE-2026-17963MEDIUMInappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafteEPSS 0.2%CVE-2026-74960HIGHSite isolation issue in the WebExtensions componentEPSS 0.2%CVE-2026-17959MEDIUMInappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crEPSS 0.2%CVE-2026-9595MEDIUMwebpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxiesEPSS 0.2%CVE-2026-17977MEDIUMPolicy bypass in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (CEPSS 0.2%CVE-2026-5321MEDIUMvanna-ai vanna FastAPI/Flask Server cross-domain policyEPSS 0.2%CVE-2026-15587CRITICALPrivilege Escalation in Google SecOps (Chronicle SOAR) via Crafted Authentication HeaderEPSS 0.2%CVE-2024-24782MEDIUMHIMA: Origin Validation Error in multiple productsEPSS 0.2%CVE-2026-45173HIGHIdira Identity Browser Extension: Unauthorized Application Interaction via Origin Validation FailureEPSS 0.2%CVE-2026-11214MEDIUMInappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak cross-originEPSS 0.2%CVE-2022-1747MEDIUMThe authentication mechanism used by voters to activate a voting session on the tested version of Dominion Voting Systems ImageCast X is susEPSS 0.2%CVE-2025-53600HIGHWhale browser before 4.32.315.22 allow an attacker to bypass the Same-Origin Policy in a dual-tab environment.EPSS 0.2%CVE-2026-81100HIGHTimescale tiger-gh-mcp-server DNS Rebinding via Disabled Host Header Allow-ListEPSS 0.2%CVE-2026-81095HIGHTimescale pg-aiguide through 0.5.0 DNS Rebinding via Disabled Host Header Allow-ListEPSS 0.2%CVE-2026-81099HIGHTimescale tiger-slack DNS Rebinding via Disabled Host Header Allow-ListEPSS 0.2%CVE-2026-11298MEDIUMInappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass same origiEPSS 0.2%CVE-2023-27962MEDIUMA logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. AnEPSS 0.2%CVE-2025-12905MEDIUMInappropriate implementation in Downloads in Google Chrome on Windows prior to 140.0.7339.80 allowed a remote attacker to bypass Mark of theEPSS 0.2%