Falhas do tipo CWE-346

588 resultados

Validação inadequada de origem (CORS/mesma origem)

A aplicação falha em validar corretamente a origem (domain/protocolo/porta) das requisições, permitindo que código malicioso de outros domínios acesse recursos protegidos. Isso quebra a política de mesma origem do navegador e pode expor dados sensíveis ou permitir ações não autorizadas.

Exemplo

Um servidor aceita qualquer valor no header Origin sem validação, ou valida de forma fraca (ex: substring matching). Um atacante hospeda um site malicioso que, ao ser visitado, faz requisições CORS para a aplicação vulnerável e consegue ler dados da vítima autenticada.

Como mitigar

Implemente validação rigorosa de origem: compare o header Origin contra uma whitelist explícita de domínios confiáveis (nunca use wildcards), valide protocolo e porta também, e desative CORS se não for necessário. Use credenciais com cautela em requisições cross-origin (credenciais + Access-Control-Allow-Origin: * é inseguro).

CVE-2026-17763MEDIUMInappropriate implementation in GPU in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer proceEPSS 0.3%CVE-2026-17733MEDIUMInappropriate implementation in QUIC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data EPSS 0.3%CVE-2026-17788MEDIUMInappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafEPSS 0.3%CVE-2026-32634HIGHGlances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed ServersEPSS 0.3%CVE-2026-17820MEDIUMInsufficient policy enforcement in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via EPSS 0.3%CVE-2026-17775MEDIUMInappropriate implementation in PresentationAPI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data EPSS 0.3%CVE-2026-17798MEDIUMInappropriate implementation in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a craftEPSS 0.3%CVE-2026-17731MEDIUMInappropriate implementation in Autofill in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin dEPSS 0.3%CVE-2024-45352HIGHXiaomi smarthome application Webview has code execution vulnerabilityEPSS 0.3%CVE-2022-41961MEDIUMBigBlueButton subject to Ineffective user bansEPSS 0.3%CVE-2026-15768MEDIUMInsufficient policy enforcement in HTML-in-Canvas in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin pEPSS 0.3%CVE-2020-26234MEDIUMDisabled Hostname Verification in OpenCastEPSS 0.3%CVE-2026-15775MEDIUMInappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a craEPSS 0.3%CVE-2023-49803HIGH@koa/cors has overly permissive origin policyEPSS 0.3%CVE-2026-55660HIGHTinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeoverEPSS 0.3%CVE-2024-7819HIGHCORS Misconfiguration in danswer-ai/danswerEPSS 0.3%CVE-2024-51037MEDIUMAn issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information via the captcha feature in the password resEPSS 0.3%CVE-2026-56181HIGHWindows Network Address Translation (NAT) Spoofing VulnerabilityEPSS 0.3%CVE-2026-75156CRITICALApache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypassEPSS 0.3%CVE-2026-10937HIGHInappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy viaEPSS 0.3%