Falhas do tipo CWE-346

696 resultados

Validação inadequada de origem (CORS/mesma origem)

A aplicação falha em validar corretamente a origem (domain/protocolo/porta) das requisições, permitindo que código malicioso de outros domínios acesse recursos protegidos. Isso quebra a política de mesma origem do navegador e pode expor dados sensíveis ou permitir ações não autorizadas.

Exemplo

Um servidor aceita qualquer valor no header Origin sem validação, ou valida de forma fraca (ex: substring matching). Um atacante hospeda um site malicioso que, ao ser visitado, faz requisições CORS para a aplicação vulnerável e consegue ler dados da vítima autenticada.

Como mitigar

Implemente validação rigorosa de origem: compare o header Origin contra uma whitelist explícita de domínios confiáveis (nunca use wildcards), valide protocolo e porta também, e desative CORS se não for necessário. Use credenciais com cautela em requisições cross-origin (credenciais + Access-Control-Allow-Origin: * é inseguro).

CVE-2025-3651CRITICALCommand Injection in iManage Work Desktop for Mac's Agent ServiceEPSS 0.3%CVE-2022-1520MEDIUMWhen viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may shoEPSS 0.3%CVE-2026-9191CRITICALInsufficient isolation of user-supplied code in Progress MarkLogic ServerEPSS 0.3%CVE-2026-113075HIGHOrigin validation error in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypasEPSS 0.3%CVE-2024-51037MEDIUMAn issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information via the captcha feature in the password resEPSS 0.3%CVE-2026-45021MEDIUMKuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdminEPSS 0.3%CVE-2026-56179HIGHWindows Network Address Translation (NAT) Spoofing VulnerabilityEPSS 0.3%CVE-2026-56181HIGHWindows Network Address Translation (NAT) Spoofing VulnerabilityEPSS 0.3%CVE-2025-3071MEDIUMInappropriate implementation in Navigations in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engageEPSS 0.3%CVE-2026-27118MEDIUMCache poisoning in @sveltejs/adapter-vercelEPSS 0.3%CVE-2026-92359LOWag-ui-protocol ag-ui CORSMiddleware utils.py create_strands_app cross-domain policyEPSS 0.3%CVE-2025-7365HIGHKeycloak: phishing attack via email verification step in first login flowEPSS 0.3%CVE-2026-92034CRITICALSite isolation issue in the Graphics componentEPSS 0.3%CVE-2026-10937HIGHInappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy viaEPSS 0.3%CVE-2026-55837MEDIUMdbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform TokensEPSS 0.3%CVE-2026-42341CRITICALFOSSBilling has an unauthenticated payment bypass via IPN callback forgeryEPSS 0.3%CVE-2026-27579HIGHCollabPlatform : CORS Misconfiguration Allows Arbitrary Origin With Credentials Leading to Authenticated Account Data ExposureEPSS 0.3%CVE-2026-27192HIGHFeathers has an origin validation bypass via prefix matchingEPSS 0.3%CVE-2026-42559HIGHRMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transportEPSS 0.3%CVE-2025-5320MEDIUMgradio-app gradio CORS is_valid_origin privilege escalationEPSS 0.3%