Weaknesses of type CWE-345

683 results

Verificação Insuficiente da Autenticidade de Dados

O software recebe dados de uma fonte externa (requisição HTTP, arquivo, API, mensagem) mas não valida adequadamente se eles realmente vêm de quem diz vir, ou se não foram alterados no caminho. Isso permite que um atacante falsifique ou modifique dados e o sistema os processe como legítimos, causando desde injeção de código até manipulação de lógica de negócio.

Example

Uma API de pagamento que recebe um JSON com status='pagamento confirmado' mas não verifica assinatura HMAC ou JWT. Um atacante intercepta a resposta, altera o status para 'aprovado' e envia de volta; o servidor processa como válido. Outro caso: um formulário que aceita um 'user_id' do cliente sem validar se aquele usuário é quem está fazendo a requisição.

How to mitigate

Use assinaturas criptográficas (HMAC-SHA256, RSA, ECDSA) ou tokens assinados (JWT) para dados críticos; valide origem com CORS e referer headers; nunca confie em dados do cliente sem verificação no servidor; implemente rate limiting e detecção de anomalias para detectar tentativas de manipulação em tempo real.

CVE-2026-46538MEDIUMMicrosoft UFO accepts cross-device TASK_END messages by session_id only, allowing peer task-result injectionEPSS 0.2%CVE-2026-61591HIGHdjust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)EPSS 0.2%CVE-2026-40487HIGHPostiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSSEPSS 0.2%CVE-2026-50526HIGH.NET Tampering VulnerabilityEPSS 0.2%CVE-2026-48106HIGHArc Enterprise cluster replication accepts unauthenticated MsgReplicateSync messages, enabling cluster-wide data injection from any TLS-trusted peerEPSS 0.2%CVE-2026-48105HIGHArc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path-traversal worm primitiveEPSS 0.2%CVE-2024-31341MEDIUMWordPress User Profile Builder plugin <= 3.11.2 - Bypass Vulnerability vulnerabilityEPSS 0.2%CVE-2026-53425HIGHMissing InResponseTo validation in Samly allows acceptance of unsolicited SAML responsesEPSS 0.2%CVE-2026-48063CRITICALBaileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payloadEPSS 0.2%CVE-2024-7979HIGHInsufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege eEPSS 0.2%CVE-2026-49284HIGHSimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`EPSS 0.2%CVE-2026-112101MEDIUMBlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validationEPSS 0.2%CVE-2024-48916HIGHCeph is vulnerable to authentication bypass through RadosGWEPSS 0.2%CVE-2026-121620HIGHCoopCycle coopcycle-web 5.6.0 before 6.20.0 Missing Zelty Webhook Signature VerificationEPSS 0.2%CVE-2026-50575HIGHBetterDesk has a replay behavior vulnerability when devices are deletedEPSS 0.2%CVE-2026-69105HIGHPotential package cache integrity issue in JFrog ArtifactoryEPSS 0.2%CVE-2026-39155MEDIUMKnot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability in mod-onlinesign where the next NSEC owner name can be computed incoEPSS 0.2%CVE-2023-23940MEDIUMOpenZeppelin Contracts for Cairo is vulnerable to signature validation bypassEPSS 0.2%CVE-2023-43800HIGHInsufficient Verification of Data Authenticity in Arduino Create AgentEPSS 0.2%CVE-2026-100872HIGHSylius 2.x before 2.1.16 and 2.2.9 Payment Amount OverwriteEPSS 0.2%