Fallos del tipo CWE-346

698 resultados

Validação incorreta de origem (Origin Validation Error)

A aplicação falha em validar corretamente a origem (origem HTTP, domínio, referência) de requisições ou recursos, permitindo que um atacante simule estar vindo de uma origem confiável. Isso quebra mecanismos de segurança como CORS, CSRF e validações de referência, abrindo porta para ataques cross-site.

Ejemplo

Um banco implementa proteção CSRF verificando se o header `Origin` é igual a `banco.com.br`, mas não valida subdomínios. Um atacante consegue fazer requisições de `falso.banco.com.br` que passam na validação e transferem dinheiro da vítima.

Cómo mitigar

Valide a origem de forma rigorosa usando whitelist explícita (não apenas prefixos ou sufixos), implemente tokens CSRF anti-previsíveis, configure CORS corretamente evitando `Access-Control-Allow-Origin: *`, e use SameSite cookies quando possível.

CVE-2025-1787MEDIUMLocal admin could to leak information from the Genetec Update Service configuration web page. An authenticated, admin privileged, Windows usEPSS 0.1%CVE-2025-8074MEDIUMOrigin validation error vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.3-13973 allows local users to write arbitrary EPSS 0.1%CVE-2026-105396MEDIUMHeym before v0.0.112 HITL Review Token Leak via Spoofable Origin HeaderEPSS 0.1%CVE-2026-115413HIGHAWS API MCP Server OAuth Token Audience Validation BypassEPSS 0.1%CVE-2025-67825MEDIUMAn issue was discovered in Nitro PDF Pro for Windows before 14.42.0.34. In certain cases, it displays signer information from a non-verifiedEPSS 0.1%CVE-2026-7439MEDIUMAgentFlow Local Web API Content-Type Validation BypassEPSS 0.1%CVE-2024-5905LOWCortex XDR Agent: Local Windows User Can Disrupt Functionality of the AgentEPSS 0.1%CVE-2026-115724LOWVLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment ProviderEPSS 0.1%CVE-2026-33697HIGHCoCoS attested TLS is vulnerable to relay attacks via extracted ephemeral TLS keysEPSS 0.1%CVE-2025-66592MEDIUMAn origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrarEPSS 0.1%CVE-2025-66593MEDIUMAn origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary files with restricteEPSS 0.1%CVE-2025-13593MEDIUMOrigin validation error vulnerability in Synology ActiveProtect Agent before 1.1.0-0439 allows local users to write arbitrary files with resEPSS 0.1%CVE-2026-78807HIGHAn issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA cEPSS 0.1%CVE-2026-32318HIGHCryptomator for IOS: Tampered vault configuration allows MITM attack on Hub APIEPSS 0.1%CVE-2026-2345LOWInsufficient Origin Validation in Proctorio Chrome Extension postMessage HandlersEPSS 0.1%CVE-2026-22077MEDIUMSensitive Information Disclosure Vulnerability Caused by Trusted Domain Bypass in OPPO WalletEPSS 0.1%CVE-2026-103417MEDIUMSaved credentials can be autofilled after cross-origin navigationEPSS 0.1%CVE-2026-32317HIGHCryptomator for Android: Tampered vault configuration allows MITM attack on Hub APIEPSS 0.1%