Weaknesses of type CWE-345

557 results

Verificação Insuficiente da Autenticidade de Dados

O software recebe dados de uma fonte externa (requisição HTTP, arquivo, API, mensagem) mas não valida adequadamente se eles realmente vêm de quem diz vir, ou se não foram alterados no caminho. Isso permite que um atacante falsifique ou modifique dados e o sistema os processe como legítimos, causando desde injeção de código até manipulação de lógica de negócio.

Example

Uma API de pagamento que recebe um JSON com status='pagamento confirmado' mas não verifica assinatura HMAC ou JWT. Um atacante intercepta a resposta, altera o status para 'aprovado' e envia de volta; o servidor processa como válido. Outro caso: um formulário que aceita um 'user_id' do cliente sem validar se aquele usuário é quem está fazendo a requisição.

How to mitigate

Use assinaturas criptográficas (HMAC-SHA256, RSA, ECDSA) ou tokens assinados (JWT) para dados críticos; valide origem com CORS e referer headers; nunca confie em dados do cliente sem verificação no servidor; implemente rate limiting e detecção de anomalias para detectar tentativas de manipulação em tempo real.

CVE-2024-2382MEDIUMAuthorize.net Payment Gateway For WooCommerce <= 8.0 - Insufficient Verification of Data Authenticity to Unauthenticated Payment BypassEPSS 0.2%CVE-2022-41156HIGHOndiskPlayer Remote Code Execution VulnerabilityEPSS 0.2%CVE-2021-41106MEDIUMFile reference keys leads to incorrect hashes on HMAC algorithmsEPSS 0.2%CVE-2026-33731MEDIUMAVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment DataEPSS 0.2%CVE-2026-9189MEDIUMContact Form 7 – PayPal & Stripe Add-on <= 2.4.9 - Unauthenticated Payment Bypass via Insufficient Verification of Data Authenticity via PayPal IPN Handler ('invoice'/'mc_gross' Verification)EPSS 0.2%CVE-2026-72544HIGHOpenSignLabs OpenSign - Insufficient Verification of Data AuthenticityEPSS 0.2%CVE-2026-54774HIGHCoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificateEPSS 0.2%CVE-2026-52737MEDIUMZEBRA: Sync restart poisoning from single unauthenticated peer via above-lookahead blockEPSS 0.2%CVE-2025-24807MEDIUMFast DDS does not verify Permissions CAEPSS 0.2%CVE-2026-53514HIGHBetter Auth: Unauthorized invitation acceptance via unverified email match in organization pluginEPSS 0.2%CVE-2026-26950HIGHDell SmartFabric Manager, versions prior to 2.2.1, contains an Insufficient Verification of Data Authenticity vulnerability. A low privilegeEPSS 0.2%CVE-2024-1718MEDIUMClaudio Sanches – Checkout Cielo for WooCommerce <= 1.1.0 - Insufficient Verification of Data Authenticity to Order Payment Status UpdateEPSS 0.2%CVE-2026-73316HIGHXenForo < 2.3.13 Payment Replay via PayPal REST Payment ProviderEPSS 0.2%CVE-2022-46692MEDIUMA logic issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, iOS 15.7EPSS 0.2%CVE-2025-6426HIGHNo warning when opening executable terminal files on macOSEPSS 0.2%CVE-2026-67618HIGHmarimo < 0.23.15 API Key Exfiltration via Malicious Notebook PEP-723 MetadataEPSS 0.2%CVE-2026-19410CRITICALGoogle Cloud Build Comment Control Bypass via Webhook SuppressionEPSS 0.2%CVE-2026-28185CRITICALWordPress Log in with Google plugin <= 1.4.2 - Broken Authentication vulnerabilityEPSS 0.2%CVE-2022-36315MEDIUMWhen loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entrieEPSS 0.2%CVE-2026-73437MEDIUMOn affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper/destinatEPSS 0.2%