Falhas do tipo CWE-346

588 resultados

Validação inadequada de origem (CORS/mesma origem)

A aplicação falha em validar corretamente a origem (domain/protocolo/porta) das requisições, permitindo que código malicioso de outros domínios acesse recursos protegidos. Isso quebra a política de mesma origem do navegador e pode expor dados sensíveis ou permitir ações não autorizadas.

Exemplo

Um servidor aceita qualquer valor no header Origin sem validação, ou valida de forma fraca (ex: substring matching). Um atacante hospeda um site malicioso que, ao ser visitado, faz requisições CORS para a aplicação vulnerável e consegue ler dados da vítima autenticada.

Como mitigar

Implemente validação rigorosa de origem: compare o header Origin contra uma whitelist explícita de domínios confiáveis (nunca use wildcards), valide protocolo e porta também, e desative CORS se não for necessário. Use credenciais com cautela em requisições cross-origin (credenciais + Access-Control-Allow-Origin: * é inseguro).

CVE-2026-13034MEDIUMInappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the rendereEPSS 0.2%CVE-2026-45021MEDIUMKuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdminEPSS 0.2%CVE-2023-28794MEDIUMPAC Files Exposed to Internet WebsitesEPSS 0.2%CVE-2024-56170MEDIUMA validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI manifests are listings of relevant files that clients aEPSS 0.2%CVE-2023-27932MEDIUMThis issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, tEPSS 0.2%CVE-2026-34373MEDIUMParse Server: GraphQL API endpoint ignores CORS origin restrictionEPSS 0.2%CVE-2026-11133MEDIUMInsufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via EPSS 0.2%CVE-2026-11132MEDIUMInsufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via EPSS 0.2%CVE-2026-14039MEDIUMInsufficient policy enforcement in GetUserMedia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin poliEPSS 0.2%CVE-2026-16442HIGHKeycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restrictionEPSS 0.2%CVE-2024-45354MEDIUMxiaomi shop application Webview has code execution vulnerabilityEPSS 0.2%CVE-2026-47194HIGHFrappe: Host header poisoning can redirect magic login links to an attacker-controlled domainEPSS 0.2%CVE-2026-34198MEDIUMCoolify: Password reset link poisoning via X-Forwarded-Host header spoofingEPSS 0.2%CVE-2024-32642HIGHHost header poisoning allows account takeover via password reset emailEPSS 0.2%CVE-2022-21505MEDIUMIn the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine wheEPSS 0.2%CVE-2023-29751MEDIUMAn issue found in Yandex Navigator v.6.60 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SEPSS 0.2%CVE-2026-59152MEDIUMArbitrary server-side file read in LangSmith SDK TracingMiddlewareEPSS 0.2%CVE-2026-6657MEDIUMCORS Origin Validation Bypass in jupyter-serverEPSS 0.2%CVE-2026-15075HIGHIn Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates alEPSS 0.2%CVE-2026-30964MEDIUMWebauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validationEPSS 0.2%