Falhas do tipo CWE-346

588 resultados

Validação inadequada de origem (CORS/mesma origem)

A aplicação falha em validar corretamente a origem (domain/protocolo/porta) das requisições, permitindo que código malicioso de outros domínios acesse recursos protegidos. Isso quebra a política de mesma origem do navegador e pode expor dados sensíveis ou permitir ações não autorizadas.

Exemplo

Um servidor aceita qualquer valor no header Origin sem validação, ou valida de forma fraca (ex: substring matching). Um atacante hospeda um site malicioso que, ao ser visitado, faz requisições CORS para a aplicação vulnerável e consegue ler dados da vítima autenticada.

Como mitigar

Implemente validação rigorosa de origem: compare o header Origin contra uma whitelist explícita de domínios confiáveis (nunca use wildcards), valide protocolo e porta também, e desative CORS se não for necessário. Use credenciais com cautela em requisições cross-origin (credenciais + Access-Control-Allow-Origin: * é inseguro).

CVE-2024-0814MEDIUMIncorrect security UI in Payments in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially spoof security UI via a cEPSS 0.3%CVE-2025-1083LOWMindskip xzs-mysql 学之思开源考试系统 CORS cross-domain policyEPSS 0.3%CVE-2022-4917MEDIUMIncorrect security UI in Notifications in Google Chrome on Android prior to 103.0.5060.53 allowed a remote attacker to obscure the full screEPSS 0.3%CVE-2026-54665MEDIUMApache NiFi: Missing Validation for Proxy Host HeadersEPSS 0.3%CVE-2024-10460MEDIUMThe origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`. This vulnerability affects EPSS 0.3%CVE-2026-69559MEDIUMMicrosoft Teams for Android Information Disclosure VulnerabilityEPSS 0.3%CVE-2025-21511HIGHVulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are EPSS 0.3%CVE-2024-6844MEDIUMInconsistent CORS Matching Due to Handling of '+' in URL Path in corydolphin/flask-corsEPSS 0.3%CVE-2023-49899CRITICALOrigin Validation Error in X-Rite MA-T6EPSS 0.3%CVE-2024-8024HIGHCORS Misconfiguration in netease-youdao/qanythingEPSS 0.3%CVE-2026-28861MEDIUMA logic issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iEPSS 0.3%CVE-2024-11602HIGHCORS Vulnerability in feast-dev/feastEPSS 0.3%CVE-2023-3654CRITICALOrigin Check BypassEPSS 0.3%CVE-2025-30466CRITICALThis issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4EPSS 0.3%CVE-2026-45674HIGHNetty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME RecordsEPSS 0.3%CVE-2026-42901CRITICALMicrosoft Entra ID Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-12245MEDIUMchatwoot Widget IFrameHelper.js initPostMessageCommunication origin validationEPSS 0.3%CVE-2026-17715LOWInappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage iEPSS 0.3%CVE-2026-17702LOWInappropriate implementation in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer procEPSS 0.3%CVE-2024-41475CRITICALGnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration.EPSS 0.3%