Weaknesses of type CWE-345

676 results

Verificação Insuficiente da Autenticidade de Dados

O software recebe dados de uma fonte externa (requisição HTTP, arquivo, API, mensagem) mas não valida adequadamente se eles realmente vêm de quem diz vir, ou se não foram alterados no caminho. Isso permite que um atacante falsifique ou modifique dados e o sistema os processe como legítimos, causando desde injeção de código até manipulação de lógica de negócio.

Example

Uma API de pagamento que recebe um JSON com status='pagamento confirmado' mas não verifica assinatura HMAC ou JWT. Um atacante intercepta a resposta, altera o status para 'aprovado' e envia de volta; o servidor processa como válido. Outro caso: um formulário que aceita um 'user_id' do cliente sem validar se aquele usuário é quem está fazendo a requisição.

How to mitigate

Use assinaturas criptográficas (HMAC-SHA256, RSA, ECDSA) ou tokens assinados (JWT) para dados críticos; valide origem com CORS e referer headers; nunca confie em dados do cliente sem verificação no servidor; implemente rate limiting e detecção de anomalias para detectar tentativas de manipulação em tempo real.

CVE-2025-12999CRITICALUrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-ForwardEPSS 0.3%CVE-2022-37928HIGHInsufficient Verification of Data Authenticity vulnerability in Hewlett Packard Enterprise HPE Nimble Storage Hybrid Flash Arrays and NimbleEPSS 0.3%CVE-2023-6236HIGHEap: oidc app attempting to access the second tenant, the user should be prompted to logEPSS 0.3%CVE-2023-6323MEDIUMThroughTek Kalay SDK insufficient verification of message authenticityEPSS 0.3%CVE-2025-49199HIGHBackup files can be modified and uploadedEPSS 0.3%CVE-2025-12245MEDIUMchatwoot Widget IFrameHelper.js initPostMessageCommunication origin validationEPSS 0.3%CVE-2026-62874CRITICALAzure Billing Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2023-4589CRITICALInsufficient verification of data authenticity vulnerability in Delinea Secret ServerEPSS 0.3%CVE-2022-3703HIGHETIC Telecom Remote Access Server Insufficient Verification of Data AuthenticityEPSS 0.3%CVE-2026-54239HIGHFaustWP — Authentication Bypass via Initialization Vector Modification in Token EnvelopeEPSS 0.3%CVE-2021-4122—It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attEPSS 0.3%CVE-2026-114612CRITICALLiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt KeyEPSS 0.3%CVE-2025-27680CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.750 Application 20.0.1442 allows Insecure Firmware Image with InsuffiEPSS 0.3%CVE-2023-41896HIGHFake websocket server installation permits full takeover in Home Assistant CoreEPSS 0.3%CVE-2026-54496CRITICALMissing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundnessEPSS 0.3%CVE-2025-27558CRITICALIEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or EPSS 0.3%CVE-2023-48238HIGHJWT Algorithm Confusion in json-web-token libraryEPSS 0.3%CVE-2024-30250HIGHIn Astro-Shield, setting a correct `integrity` attribute to injected code allows to bypass the allow-listsEPSS 0.3%CVE-2022-37008HIGHThe recovery module has a vulnerability of bypassing the verification of an update package before use. Successful exploitation of this vulneEPSS 0.3%CVE-2022-30267HIGHEmerson Ovation Insufficient Verification of Data AuthenticityEPSS 0.3%