Falhas do tipo CWE-346

698 resultados

Validação inadequada de origem (CORS/mesma origem)

A aplicação falha em validar corretamente a origem (domain/protocolo/porta) das requisições, permitindo que código malicioso de outros domínios acesse recursos protegidos. Isso quebra a política de mesma origem do navegador e pode expor dados sensíveis ou permitir ações não autorizadas.

Exemplo

Um servidor aceita qualquer valor no header Origin sem validação, ou valida de forma fraca (ex: substring matching). Um atacante hospeda um site malicioso que, ao ser visitado, faz requisições CORS para a aplicação vulnerável e consegue ler dados da vítima autenticada.

Como mitigar

Implemente validação rigorosa de origem: compare o header Origin contra uma whitelist explícita de domínios confiáveis (nunca use wildcards), valide protocolo e porta também, e desative CORS se não for necessário. Use credenciais com cautela em requisições cross-origin (credenciais + Access-Control-Allow-Origin: * é inseguro).

CVE-2026-6102HIGHMSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation VulnerabilityEPSS 0.1%CVE-2026-116194HIGHRclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth CallbackEPSS 0.1%CVE-2026-53656MEDIUMFiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server dataEPSS 0.1%CVE-2026-27004MEDIUMOpenClaw session tool visibility hardening and Telegram webhook secret fallbackEPSS 0.1%CVE-2023-47196HIGHAn origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecteEPSS 0.1%CVE-2026-108265CRITICALenclave-os-mini: RA-TLS challenge certificates were not bound to the TLS sessionEPSS 0.1%CVE-2023-47197HIGHAn origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecteEPSS 0.1%CVE-2023-47194HIGHAn origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecteEPSS 0.1%CVE-2023-47195HIGHAn origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecteEPSS 0.1%CVE-2024-41143HIGHOrigin validation error vulnerability exists in SKYSEA Client View Ver.3.013.00 to Ver.19.210.04e. If this vulnerability is exploited, an arEPSS 0.1%CVE-2023-47199HIGHAn origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecteEPSS 0.1%CVE-2023-47200HIGHA plug-in manager origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privilEPSS 0.1%CVE-2026-108266CRITICALPrivasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS sessionEPSS 0.1%CVE-2026-41393MEDIUMOpenClaw < 2026.3.31 - Arbitrary DNS Authority Acceptance and Credential Exfiltration via Wide-Area DiscoveryEPSS 0.1%CVE-2026-108267CRITICALPrivasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS sessionEPSS 0.1%CVE-2023-47198HIGHAn origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecteEPSS 0.1%CVE-2026-82332MEDIUMFireware OS Improper Authentication in AuthPoint MFA Verification Allows Session HijackingEPSS 0.1%CVE-2026-34083MEDIUMsignalk-server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC FlowEPSS 0.1%CVE-2026-32303HIGHCryptomator: Tampered vault configuration allows MITM attack on Hub APIEPSS 0.1%CVE-2026-55842MEDIUMScoold: CORS wildcard origin with credentials enabled allows cross-origin authenticated API access from any domainEPSS 0.1%