Weaknesses of type CWE-345

683 results

Verificação Insuficiente da Autenticidade de Dados

O software recebe dados de uma fonte externa (requisição HTTP, arquivo, API, mensagem) mas não valida adequadamente se eles realmente vêm de quem diz vir, ou se não foram alterados no caminho. Isso permite que um atacante falsifique ou modifique dados e o sistema os processe como legítimos, causando desde injeção de código até manipulação de lógica de negócio.

Example

Uma API de pagamento que recebe um JSON com status='pagamento confirmado' mas não verifica assinatura HMAC ou JWT. Um atacante intercepta a resposta, altera o status para 'aprovado' e envia de volta; o servidor processa como válido. Outro caso: um formulário que aceita um 'user_id' do cliente sem validar se aquele usuário é quem está fazendo a requisição.

How to mitigate

Use assinaturas criptográficas (HMAC-SHA256, RSA, ECDSA) ou tokens assinados (JWT) para dados críticos; valide origem com CORS e referer headers; nunca confie em dados do cliente sem verificação no servidor; implemente rate limiting e detecção de anomalias para detectar tentativas de manipulação em tempo real.

CVE-2025-15598MEDIUMDataease SQLBot JWT Token auth.py validateEmbedded signature verificationEPSS 0.2%CVE-2026-48781CRITICALPostiz has cross-tenant SUPERADMIN takeover via Skool-provider JWT forgeryEPSS 0.2%CVE-2026-44434MEDIUMQuicly is vulnerable to stateless reset injectionEPSS 0.2%CVE-2026-19219HIGHDialogHandler UploadPaths Tampering Vulnerability in Telerik UI for ASP.NET AJAXEPSS 0.2%CVE-2026-63405MEDIUMAnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary BodyEPSS 0.2%CVE-2026-32231HIGHZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload dataEPSS 0.2%CVE-2022-36315MEDIUMWhen loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entrieEPSS 0.2%CVE-2026-55430MEDIUMCoder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data accessEPSS 0.2%CVE-2019-10157MEDIUMIt was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backEPSS 0.2%CVE-2022-46692MEDIUMA logic issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, iOS 15.7EPSS 0.2%CVE-2026-121545MEDIUMDreeve before 5.8.0 Missing Authentication in Strava Webhook POST HandlerEPSS 0.2%CVE-2026-92360MEDIUMag-ui-protocol ag-ui Event Application Layer agent.ts prepareRunAgentInput origin validationEPSS 0.2%CVE-2019-1880MEDIUMCisco Unified Computing System BIOS Signature Bypass VulnerabilityEPSS 0.2%CVE-2023-44402MEDIUMASAR Integrity bypass via filetype confusion in electronEPSS 0.2%CVE-2026-73437MEDIUMOn affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper/destinatEPSS 0.2%CVE-2026-114050HIGHvLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUIDEPSS 0.2%CVE-2026-66785HIGHSubmariner: submariner: missing validation of remote endpoint subnets and clusterid enables cross-cluster traffic hijackEPSS 0.2%CVE-2024-2382MEDIUMAuthorize.net Payment Gateway For WooCommerce <= 8.0 - Insufficient Verification of Data Authenticity to Unauthenticated Payment BypassEPSS 0.2%CVE-2026-111392MEDIUMSGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /generateEPSS 0.2%CVE-2026-47664HIGHPathling: $import-pnp operation enables authenticated SSRF, credential leakage, and warehouse data poisoningEPSS 0.2%