Fallos del tipo CWE-346

696 resultados

Validação incorreta de origem (Origin Validation Error)

A aplicação falha em validar corretamente a origem (origem HTTP, domínio, referência) de requisições ou recursos, permitindo que um atacante simule estar vindo de uma origem confiável. Isso quebra mecanismos de segurança como CORS, CSRF e validações de referência, abrindo porta para ataques cross-site.

Ejemplo

Um banco implementa proteção CSRF verificando se o header `Origin` é igual a `banco.com.br`, mas não valida subdomínios. Um atacante consegue fazer requisições de `falso.banco.com.br` que passam na validação e transferem dinheiro da vítima.

Cómo mitigar

Valide a origem de forma rigorosa usando whitelist explícita (não apenas prefixos ou sufixos), implemente tokens CSRF anti-previsíveis, configure CORS corretamente evitando `Access-Control-Allow-Origin: *`, e use SameSite cookies quando possível.

CVE-2026-47691HIGHNetty has Insufficient Bailiwick Validation for NS RecordsEPSS 0.4%CVE-2024-10534HIGHImproper Access Control in Dataprom Informatics' PACS-ACSSEPSS 0.4%CVE-2026-20643MEDIUMA cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed in Background Security ImprovemEPSS 0.4%CVE-2023-3654CRITICALOrigin Check BypassEPSS 0.4%CVE-2026-86466HIGHApache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validatedEPSS 0.4%CVE-2025-4515MEDIUMZylon PrivateGPT settings.yaml cross-domain policyEPSS 0.4%CVE-2026-109461MEDIUMMicrosoft Authentication Library (MSAL) for Node.js Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-66318HIGHMicrosoft Edge (Chromium-based) Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-58649MEDIUM.NET Information Disclosure VulnerabilityEPSS 0.4%CVE-2025-13947HIGHWebkit: webkitgtk: remote user-assisted information disclosure via file drag-and-dropEPSS 0.4%CVE-2025-30360MEDIUMwebpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browserEPSS 0.4%CVE-2024-44734HIGHIncorrect access control in Mirotalk before commit 9de226 allows attackers to arbitrarily change usernames via sending a crafted roomAction EPSS 0.4%CVE-2025-71214HIGHAn origin validation error vulnerability in the Trend Micro Apex One (mac) agent iCore service could allow a local attacker to escalate privEPSS 0.4%CVE-2024-36303HIGHAn origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecteEPSS 0.4%CVE-2024-28224MEDIUMOllama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthEPSS 0.4%CVE-2022-46718—A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.7.2 and iPadOS 15.7.2, macOS Ventura 13.1, macOS Big SEPSS 0.4%CVE-2026-101897MEDIUMAngular DevTools (Local DoS)EPSS 0.4%CVE-2024-10956HIGHCross-Site WebSocket Hijacking in binary-husky/gpt_academicEPSS 0.4%CVE-2023-30856HIGHeDEX-UI cross-site websocket hijacking vulnerability enables remote command executionEPSS 0.3%CVE-2023-28164MEDIUMDragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks. ThEPSS 0.3%