Falhas do tipo CWE-346

588 resultados

Validação inadequada de origem (CORS/mesma origem)

A aplicação falha em validar corretamente a origem (domain/protocolo/porta) das requisições, permitindo que código malicioso de outros domínios acesse recursos protegidos. Isso quebra a política de mesma origem do navegador e pode expor dados sensíveis ou permitir ações não autorizadas.

Exemplo

Um servidor aceita qualquer valor no header Origin sem validação, ou valida de forma fraca (ex: substring matching). Um atacante hospeda um site malicioso que, ao ser visitado, faz requisições CORS para a aplicação vulnerável e consegue ler dados da vítima autenticada.

Como mitigar

Implemente validação rigorosa de origem: compare o header Origin contra uma whitelist explícita de domínios confiáveis (nunca use wildcards), valide protocolo e porta também, e desative CORS se não for necessário. Use credenciais com cautela em requisições cross-origin (credenciais + Access-Control-Allow-Origin: * é inseguro).

CVE-2026-17876MEDIUMInappropriate implementation in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a cEPSS 0.2%CVE-2026-17871MEDIUMInappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage iEPSS 0.2%CVE-2025-62250MEDIUMImproper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 throEPSS 0.2%CVE-2026-17895MEDIUMInappropriate implementation in DataTransfer in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engagEPSS 0.2%CVE-2026-17857MEDIUMInappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crEPSS 0.2%CVE-2026-17897MEDIUMInappropriate implementation in ORB in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafteEPSS 0.2%CVE-2026-17885MEDIUMInappropriate implementation in Paint in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafEPSS 0.2%CVE-2026-16381CRITICALSame-origin policy bypass in the Networking: DNS componentEPSS 0.2%CVE-2025-47909HIGHImproper validation of TrustedOrigins allows CSRF attacks in github.com/gorilla/csrfEPSS 0.2%CVE-2025-5824MEDIUMAutel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass VulnerabilityEPSS 0.2%CVE-2025-42706MEDIUMCrowdStrike Falcon Sensor for Windows Logic ErrorEPSS 0.2%CVE-2026-40594MEDIUMpyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)EPSS 0.2%CVE-2026-66298HIGHJS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcutsEPSS 0.2%CVE-2026-35408HIGHDirectus is Missing Cross-Origin Opener PolicyEPSS 0.2%CVE-2026-7581MEDIUMalexta69 MeTube CORS Policy main.py on_prepare cross-domain policyEPSS 0.2%CVE-2026-66313MEDIUMMicrosoft Edge (Chromium-based) Tampering VulnerabilityEPSS 0.2%CVE-2026-43972MEDIUMgun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injectionEPSS 0.2%CVE-2026-54030HIGHLibreChat: Missing Resource Parameter Validation in MCP OAuth FlowEPSS 0.2%CVE-2024-6301MEDIUMOrigin Validation Error in ConduitEPSS 0.2%CVE-2022-32144HIGHThere is an insufficient input verification vulnerability in Huawei product. Successful exploitation of this vulnerability may lead to serviEPSS 0.2%