Falhas do tipo CWE-346

698 resultados

Validação inadequada de origem (CORS/mesma origem)

A aplicação falha em validar corretamente a origem (domain/protocolo/porta) das requisições, permitindo que código malicioso de outros domínios acesse recursos protegidos. Isso quebra a política de mesma origem do navegador e pode expor dados sensíveis ou permitir ações não autorizadas.

Exemplo

Um servidor aceita qualquer valor no header Origin sem validação, ou valida de forma fraca (ex: substring matching). Um atacante hospeda um site malicioso que, ao ser visitado, faz requisições CORS para a aplicação vulnerável e consegue ler dados da vítima autenticada.

Como mitigar

Implemente validação rigorosa de origem: compare o header Origin contra uma whitelist explícita de domínios confiáveis (nunca use wildcards), valide protocolo e porta também, e desative CORS se não for necessário. Use credenciais com cautela em requisições cross-origin (credenciais + Access-Control-Allow-Origin: * é inseguro).

CVE-2025-43929MEDIUMopen_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked fEPSS 0.2%CVE-2026-11195MEDIUMInappropriate implementation in MHTML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in spEPSS 0.2%CVE-2026-33314MEDIUMpyload-ng: Improper Authentication and Origin Validation ErrorEPSS 0.2%CVE-2023-29753MEDIUMAn issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Android allows a local attacker to cause a denial of service via the SharedPreferencEPSS 0.2%CVE-2026-35577MEDIUMMissing Host Header Validation in Apollo MCP Server for Localhost DeploymentsEPSS 0.2%CVE-2026-6143MEDIUMfarion1231 cc-switch ProxyServer server.rs cross-domain policyEPSS 0.2%CVE-2026-41700HIGHCross-Site WebSocket Hijacking in Spring for GraphQLEPSS 0.2%CVE-2026-12304CRITICALSame-origin policy bypass in the Networking: Cookies componentEPSS 0.2%CVE-2026-43700MEDIUMA cross-origin issue was addressed with improved tracking of security origins. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS EPSS 0.2%CVE-2026-54605HIGHOAuth: Cross-origin token-request redirects can expose signed request metadataEPSS 0.2%CVE-2026-107230HIGHAsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy loginsEPSS 0.2%CVE-2025-14331MEDIUMSame-origin policy bypass in the Request Handling componentEPSS 0.2%CVE-2023-44190MEDIUMJunos OS Evolved: PTX10001, PTX10004, PTX10008, PTX10016: MAC address validation bypass vulnerabilityEPSS 0.2%CVE-2026-22030MEDIUMReact Router has CSRF issue in Action/Server Action Request ProcessingEPSS 0.2%CVE-2025-23109MEDIUMAddress bar spoofing on iOS using long hostnamesEPSS 0.2%CVE-2026-84129CRITICALSite isolation issue in the DOM: Navigation componentEPSS 0.2%CVE-2026-84133CRITICALSite isolation issue in the DOM: Push Subscriptions componentEPSS 0.2%CVE-2026-17997LOWInappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendererEPSS 0.2%CVE-2026-17732LOWInappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafteEPSS 0.2%CVE-2026-18000LOWInsufficient policy enforcement in USB in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the EPSS 0.2%