Fallos del tipo CWE-940

73 resultados

Verificação inadequada da origem de um canal de comunicação

A aplicação recebe dados por um canal de comunicação (rede, IPC, arquivo) sem validar corretamente se a origem é confiável. Um atacante se passa pela origem legítima, injetando dados maliciosos que o código processa como se fossem autênticos, comprometendo integridade e confidencialidade.

Ejemplo

Um servidor de aplicação aceita comandos administrativos via socket Unix sem verificar o UID do processo cliente. Um usuário comum se conecta ao socket e envia comandos como root, já que o servidor não valida quem está realmente do outro lado da conexão.

Cómo mitigar

Implemente verificação explícita da identidade do cliente antes de processar qualquer dado: valide certificados TLS, UIDs de processos, tokens assinados ou chaves pré-compartilhadas. Não assuma que apenas por estar em um canal 'privado' a origem é segura.

CVE-2026-85125MEDIUMThe Android application "YAMAP -Social Trekking GPS App" contains an improper access control vulnerability in its WebView implementation. ThEPSS 0.3%CVE-2026-45245MEDIUMSummarize < 0.15.1 Unauthorized Daemon Request via Untrusted EventsEPSS 0.3%CVE-2024-40516HIGHAn issue in H3C Technologies Co., Limited H3C Magic RC3000 RC3000V100R009 allows a remote attacker to execute arbitrary code via the RoutingEPSS 0.3%CVE-2026-48745CRITICALTraccar Client: silent configuration hijack via unverified deep link redirects all GPS telemetryEPSS 0.3%CVE-2026-43880MEDIUMWWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishing from Site's Legitimate From AddressEPSS 0.3%CVE-2024-37663MEDIUMRedmi router RB03 v1.0.57 is vulnerable to forged ICMP redirect message attacks. An attacker in the same WLAN as the victim can hijack the tEPSS 0.3%CVE-2026-55660HIGHTinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeoverEPSS 0.3%CVE-2026-102551CRITICALImproper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handlingEPSS 0.3%CVE-2026-89409MEDIUMUnvalidated ZWAVE_CMD_NODES_EXIST May Cause Deletion of End Nodes​EPSS 0.3%CVE-2026-33875CRITICALAuthenticator Vulnerable to Authentication Flow HijackEPSS 0.3%CVE-2025-59159CRITICALSillyTavern Web Interface Vulnerable to DNS RebindingEPSS 0.3%CVE-2025-25305HIGHSSL validation for outgoing requests in Home Assistant Core and used libs not correctEPSS 0.3%CVE-2026-73419MEDIUMNextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created themEPSS 0.2%CVE-2026-66279HIGHDis-connect vulnerability in Connect StackEPSS 0.2%CVE-2025-23222HIGHAn issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. Specifically, EPSS 0.2%CVE-2026-102552HIGHImproper verification of the source of a communication channel in FreeRTOS-Plus-TCP DNS resolverEPSS 0.2%CVE-2026-40434HIGHAnviz CrossChex Standard Improper Verification of Source of a Communication ChannelEPSS 0.2%CVE-2025-43280MEDIUMThe issue was resolved by not loading remote images. This issue is fixed in iOS 18.6 and iPadOS 18.6. Forwarding an email could display remoEPSS 0.2%CVE-2026-59786MEDIUMActive agent heartbeat missing TLS checkEPSS 0.2%CVE-2024-0009MEDIUMPAN-OS: Improper IP Address Verification in GlobalProtect GatewayEPSS 0.2%