Weaknesses of type CWE-345

683 results

Verificação Insuficiente da Autenticidade de Dados

O software recebe dados de uma fonte externa (requisição HTTP, arquivo, API, mensagem) mas não valida adequadamente se eles realmente vêm de quem diz vir, ou se não foram alterados no caminho. Isso permite que um atacante falsifique ou modifique dados e o sistema os processe como legítimos, causando desde injeção de código até manipulação de lógica de negócio.

Example

Uma API de pagamento que recebe um JSON com status='pagamento confirmado' mas não verifica assinatura HMAC ou JWT. Um atacante intercepta a resposta, altera o status para 'aprovado' e envia de volta; o servidor processa como válido. Outro caso: um formulário que aceita um 'user_id' do cliente sem validar se aquele usuário é quem está fazendo a requisição.

How to mitigate

Use assinaturas criptográficas (HMAC-SHA256, RSA, ECDSA) ou tokens assinados (JWT) para dados críticos; valide origem com CORS e referer headers; nunca confie em dados do cliente sem verificação no servidor; implemente rate limiting e detecção de anomalias para detectar tentativas de manipulação em tempo real.

CVE-2026-103311MEDIUMCoinbase Commerce Payment Gateway for WooCommerce <= 1.4.1 - Unauthenticated Webhook Signature Bypass via Empty-Default Webhook Shared SecretEPSS 0.1%CVE-2026-121636MEDIUMQuick Event Manager 9.9.5 - 9.18 - Unauthenticated PayPal IPN Verification Bypass via the 'debug' ParameterEPSS 0.1%CVE-2026-103359MEDIUMPayDunya WooCommerce Payment Gateway 1.1.6 - Unauthenticated Order Payment Completion via Webhook ForgeryEPSS 0.1%CVE-2024-54111MEDIUMRead/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.1%CVE-2026-14663MEDIUMPostgreSQL pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartextEPSS 0.1%CVE-2026-33243HIGHbarebox: FIT Signature Verification Bypass VulnerabilityEPSS 0.1%CVE-2026-103327MEDIUMCryptoCloud - Crypto Payment Gateway 3.0.0 - 3.0.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Webhook SecretEPSS 0.1%CVE-2026-86791MEDIUMiPOSpays Payment Gateway for WooCommerce < 1.4.7 - Unauthenticated Payment Confirmation ForgeryEPSS 0.1%CVE-2026-110510LOWEssential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and Post Timeline Title TagEPSS 0.1%CVE-2026-87414LOWVulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). The supported version that is affected EPSS 0.1%CVE-2026-26327HIGHOpenClaw allows unauthenticated discovery TXT records to steer routing and TLS pinningEPSS 0.1%CVE-2026-92138MEDIUMThe OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the `oauth_callback` URL from the suEPSS 0.1%CVE-2026-45792MEDIUMRTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLMEPSS 0.1%CVE-2026-109359HIGHContrast 1.8.0 before 1.24.1 Mesh CA Key Cross-Manifest Exposure via Peer RecoveryEPSS 0.1%CVE-2026-11836LOWProduction Debug-Unlock Token Verification Missing Device BindingEPSS 0.1%CVE-2026-46654HIGHPlonky3 MultiField32Challenger: transcript malleability and challenge entropy lossEPSS 0.1%CVE-2026-32323HIGHMullvad VPN for macOS: Local Privilege Escalation via unverified bundle path in installerEPSS 0.1%CVE-2026-22703MEDIUMCosign verification accepts any valid Rekor entry under certain conditionsEPSS 0.1%CVE-2022-48431MEDIUMIn JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be imported without the “Trust Project” confirmationEPSS 0.1%CVE-2023-20570LOWInsufficient verification of data authenticity in the configuration state machine may allow a local attacker to potentially load arbitrary bEPSS 0.1%