Falhas do tipo CWE-346

588 resultados

Validação inadequada de origem (CORS/mesma origem)

A aplicação falha em validar corretamente a origem (domain/protocolo/porta) das requisições, permitindo que código malicioso de outros domínios acesse recursos protegidos. Isso quebra a política de mesma origem do navegador e pode expor dados sensíveis ou permitir ações não autorizadas.

Exemplo

Um servidor aceita qualquer valor no header Origin sem validação, ou valida de forma fraca (ex: substring matching). Um atacante hospeda um site malicioso que, ao ser visitado, faz requisições CORS para a aplicação vulnerável e consegue ler dados da vítima autenticada.

Como mitigar

Implemente validação rigorosa de origem: compare o header Origin contra uma whitelist explícita de domínios confiáveis (nunca use wildcards), valide protocolo e porta também, e desative CORS se não for necessário. Use credenciais com cautela em requisições cross-origin (credenciais + Access-Control-Allow-Origin: * é inseguro).

CVE-2026-74981HIGHSite isolation issue in the Audio/Video: Web Codecs componentEPSS 0.1%CVE-2026-11181MEDIUMInappropriate implementation in Media Session in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policyEPSS 0.1%CVE-2026-27824MEDIUMcalibre has IP Ban Bypass via X-Forwarded-For Header SpoofingEPSS 0.1%CVE-2026-10846HIGHInsufficient verification that responses belong to a queryEPSS 0.1%CVE-2023-23561MEDIUMStormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control: authenticated users can read sensitive information.EPSS 0.1%CVE-2023-28795HIGHClient IPC validation bypassEPSS 0.1%CVE-2026-35253MEDIUMVulnerability in the Oracle Macoron Tool product of Oracle Open Source Projects. The supported versions that is affected is v0.22.0. Easily EPSS 0.1%CVE-2026-17957LOWInappropriate implementation in CORS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer procEPSS 0.1%CVE-2026-75025MEDIUMMattermost Desktop local network access from server-rendered contentEPSS 0.1%CVE-2026-67448MEDIUMMailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)EPSS 0.1%CVE-2025-1102MEDIUMA CWE-346 "Origin Validation Error" in the CORS configuration in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticatEPSS 0.1%CVE-2024-54490MEDIUMThis issue was addressed by enabling hardened runtime. This issue is fixed in macOS Sequoia 15.2. A local attacker may gain access to user'sEPSS 0.1%CVE-2026-66316MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.1%CVE-2026-66317MEDIUMMicrosoft Edge (Chromium-based) Tampering VulnerabilityEPSS 0.1%CVE-2026-57978MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.1%CVE-2026-44894HIGHNetty's Default QUIC token handler accepts any client-supplied tokenEPSS 0.1%CVE-2026-74970MEDIUMSite isolation issue in the Graphics componentEPSS 0.1%CVE-2026-11278MEDIUMInappropriate implementation in CustomTabs in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to leak cross-origin EPSS 0.1%CVE-2023-47193HIGHAn origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecteEPSS 0.1%CVE-2026-91201MEDIUMDocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessageEPSS 0.1%