Fallos del tipo CWE-644

64 resultados

Neutralização inadequada de cabeçalhos HTTP para sintaxe de script

Ocorre quando a aplicação falha em sanitizar ou validar cabeçalhos HTTP antes de usá-los em contextos onde código pode ser executado (como JavaScript, CSS ou templates). Um atacante injeta sintaxe maliciosa no cabeçalho (ex: User-Agent, Referer) e a aplicação a reflete sem proteção, permitindo execução de script no navegador da vítima (XSS).

Ejemplo

Uma página de erro que exibe 'Você veio de: [Referer]' sem escapar o valor. Um atacante envia Referer: javascript:alert('roubado'), e quando a página é renderizada, o script executa no contexto do site legítimo.

Cómo mitigar

Sempre escape ou sanitize cabeçalhos HTTP antes de inseri-los em HTML, atributos ou contextos de script — use funções nativas do framework (htmlspecialchars, textContent, etc.). Valide e rejeite cabeçalhos com padrões suspeitos em entrada, não apenas na saída.

CVE-2025-0154MEDIUMIBM TXSeries for Multiplatforms information disclosureEPSS 0.4%CVE-2026-26747CRITICALA Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProEPSS 0.4%CVE-2021-38997MEDIUMIBM API Connect HOST header injectionEPSS 0.4%CVE-2022-22399MEDIUMIBM Aspera Faspex HTTP header injectionEPSS 0.4%CVE-2024-39736MEDIUMIBM Datacap Navigator HTTP HOST header injectionEPSS 0.4%CVE-2025-70948CRITICALA host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and exeEPSS 0.4%CVE-2025-13803MEDIUMMediaCrush Header paths.py http headers for scripting syntaxEPSS 0.3%CVE-2026-48061MEDIUMLitestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host headerEPSS 0.3%CVE-2024-47549HIGHSharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP reEPSS 0.3%CVE-2026-48126HIGHAlgernon: Host header path traversal in --domain mode reads files and runs Lua from parent dirEPSS 0.3%CVE-2026-69183HIGHMonkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)EPSS 0.3%CVE-2026-54477MEDIUMGardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting SyntaxEPSS 0.3%CVE-2025-52660LOWHCL AION is affected by an Host Header Injection vulnerabilityEPSS 0.3%CVE-2025-2950MEDIUMIBM i improper HTTP header neutralizationEPSS 0.3%CVE-2024-30129MEDIUMHCL Nomad server on Domino is affected by a host header injection vulnerabilityEPSS 0.3%CVE-2026-10836MEDIUMImproper neutralization of HTTP headers in Password ManagerEPSS 0.3%CVE-2026-33149HIGHTandoor Recipes Vulnerable to Host Header InjectionEPSS 0.3%CVE-2025-23001MEDIUMA Host header injection vulnerability exists in CTFd 3.7.5, due to the application failing to properly validate or sanitize the Host header.EPSS 0.3%CVE-2023-26289MEDIUMIBM Aspera Orchestrator HTTP header injectionEPSS 0.3%CVE-2023-45190MEDIUMIBM Engineering Lifecycle Optimization HTTP header injectionEPSS 0.3%