Fallos del tipo CWE-346

588 resultados

Validação incorreta de origem (Origin Validation Error)

A aplicação falha em validar corretamente a origem (origem HTTP, domínio, referência) de requisições ou recursos, permitindo que um atacante simule estar vindo de uma origem confiável. Isso quebra mecanismos de segurança como CORS, CSRF e validações de referência, abrindo porta para ataques cross-site.

Ejemplo

Um banco implementa proteção CSRF verificando se o header `Origin` é igual a `banco.com.br`, mas não valida subdomínios. Um atacante consegue fazer requisições de `falso.banco.com.br` que passam na validação e transferem dinheiro da vítima.

Cómo mitigar

Valide a origem de forma rigorosa usando whitelist explícita (não apenas prefixos ou sufixos), implemente tokens CSRF anti-previsíveis, configure CORS corretamente evitando `Access-Control-Allow-Origin: *`, e use SameSite cookies quando possível.

CVE-2026-17733MEDIUMInappropriate implementation in QUIC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data EPSS 0.3%CVE-2026-17753MEDIUMInappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a cEPSS 0.3%CVE-2026-17731MEDIUMInappropriate implementation in Autofill in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin dEPSS 0.3%CVE-2026-17788MEDIUMInappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafEPSS 0.3%CVE-2026-32634HIGHGlances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed ServersEPSS 0.3%CVE-2026-17820MEDIUMInsufficient policy enforcement in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via EPSS 0.3%CVE-2026-17775MEDIUMInappropriate implementation in PresentationAPI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data EPSS 0.3%CVE-2026-17798MEDIUMInappropriate implementation in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a craftEPSS 0.3%CVE-2024-45352HIGHXiaomi smarthome application Webview has code execution vulnerabilityEPSS 0.3%CVE-2022-41961MEDIUMBigBlueButton subject to Ineffective user bansEPSS 0.3%CVE-2026-15768MEDIUMInsufficient policy enforcement in HTML-in-Canvas in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin pEPSS 0.3%CVE-2020-26234MEDIUMDisabled Hostname Verification in OpenCastEPSS 0.3%CVE-2026-15775MEDIUMInappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a craEPSS 0.3%CVE-2023-49803HIGH@koa/cors has overly permissive origin policyEPSS 0.3%CVE-2026-55660HIGHTinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeoverEPSS 0.3%CVE-2024-7819HIGHCORS Misconfiguration in danswer-ai/danswerEPSS 0.3%CVE-2024-51037MEDIUMAn issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information via the captcha feature in the password resEPSS 0.3%CVE-2026-56181HIGHWindows Network Address Translation (NAT) Spoofing VulnerabilityEPSS 0.3%CVE-2026-75156CRITICALApache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypassEPSS 0.3%CVE-2025-3651CRITICALCommand Injection in iManage Work Desktop for Mac's Agent ServiceEPSS 0.3%