Fallos del tipo CWE-644

65 resultados

Neutralização inadequada de cabeçalhos HTTP para sintaxe de script

Ocorre quando a aplicação falha em sanitizar ou validar cabeçalhos HTTP antes de usá-los em contextos onde código pode ser executado (como JavaScript, CSS ou templates). Um atacante injeta sintaxe maliciosa no cabeçalho (ex: User-Agent, Referer) e a aplicação a reflete sem proteção, permitindo execução de script no navegador da vítima (XSS).

Ejemplo

Uma página de erro que exibe 'Você veio de: [Referer]' sem escapar o valor. Um atacante envia Referer: javascript:alert('roubado'), e quando a página é renderizada, o script executa no contexto do site legítimo.

Cómo mitigar

Sempre escape ou sanitize cabeçalhos HTTP antes de inseri-los em HTML, atributos ou contextos de script — use funções nativas do framework (htmlspecialchars, textContent, etc.). Valide e rejeite cabeçalhos com padrões suspeitos em entrada, não apenas na saída.

CVE-2026-33805CRITICAL@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headersEPSS 0.4%CVE-2021-38997MEDIUMIBM API Connect HOST header injectionEPSS 0.4%CVE-2025-64425HIGHCoolify has host header injection in forgot passwordEPSS 0.4%CVE-2026-72574MEDIUMpicocms Pico - Host Header Injection Enables Script Source HijackingEPSS 0.4%CVE-2025-0154MEDIUMIBM TXSeries for Multiplatforms information disclosureEPSS 0.4%CVE-2025-70948CRITICALA host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and exeEPSS 0.4%CVE-2025-13803MEDIUMMediaCrush Header paths.py http headers for scripting syntaxEPSS 0.4%CVE-2026-48061MEDIUMLitestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host headerEPSS 0.4%CVE-2022-22399MEDIUMIBM Aspera Faspex HTTP header injectionEPSS 0.4%CVE-2024-39736MEDIUMIBM Datacap Navigator HTTP HOST header injectionEPSS 0.4%CVE-2024-47549HIGHSharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP reEPSS 0.4%CVE-2026-66778MEDIUMMultiple vulnerabilities in SAP Business AI Platform (Approuter)EPSS 0.4%CVE-2026-0516MEDIUMA improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the HostEPSS 0.3%CVE-2026-110723HIGHIn `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from tEPSS 0.3%CVE-2026-48126HIGHAlgernon: Host header path traversal in --domain mode reads files and runs Lua from parent dirEPSS 0.3%CVE-2025-52660LOWHCL AION is affected by an Host Header Injection vulnerabilityEPSS 0.3%CVE-2026-54477MEDIUMGardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting SyntaxEPSS 0.3%CVE-2025-2950MEDIUMIBM i improper HTTP header neutralizationEPSS 0.3%CVE-2026-33149HIGHTandoor Recipes Vulnerable to Host Header InjectionEPSS 0.3%CVE-2024-30129MEDIUMHCL Nomad server on Domino is affected by a host header injection vulnerabilityEPSS 0.3%