Weaknesses of type CWE-354

121 results

Validação inadequada de valor de verificação de integridade

Ocorre quando o software recebe um valor de checksum, hash ou assinatura para verificar a integridade de dados, mas não valida esse valor corretamente antes de confiar nos dados. Um atacante pode modificar tanto os dados quanto o mecanismo de verificação, ou fornecer um valor falso, e o software aceita sem questionar.

Example

Um servidor recebe um arquivo com um MD5 anexado. Em vez de recalcular o hash e comparar, o código apenas verifica se o campo 'checksum' existe. Um atacante modifica o arquivo, recalcula o MD5 falsificado, envia ambos, e o servidor aceita o arquivo corrompido como válido.

How to mitigate

Sempre recalcule o hash/checksum do dado recebido e compare com o valor fornecido usando comparação de tempo constante. Para dados críticos, use HMAC com chave secreta ou assinatura criptográfica (RSA, ECDSA) em vez de apenas hash simples. Documente qual algoritmo e qual chave devem ser usados, e rejeite qualquer discrepância.

CVE-2023-24063MEDIUMDiebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR10 fails to validate /etc/mtab during the Pre-Boot Authorization (PBA) process. EPSS 0.3%CVE-2023-4929MEDIUMNPort 5000 Series Firmware Improper Validation of Integrity Check VulnerabilityEPSS 0.3%CVE-2025-54887CRITICALjwe: Missing AES-GCM authentication tag validation in encrypted JWEsEPSS 0.3%CVE-2026-54580HIGHmport index decompression can leave partial or corrupt index data after zstd failuresEPSS 0.3%CVE-2025-3247MEDIUMContact Form 7 <= 6.0.5 - Order Replay VulnerabilityEPSS 0.2%CVE-2026-34181HIGHPKCS#12 Files with PBMAC1 Are Accepted with Short HMAC KeysEPSS 0.2%CVE-2026-9653HIGH1756-EN2, 1756-EN3, and 1756-ENBT - Denial of Service via CIP Connection IDEPSS 0.2%CVE-2026-76852HIGHNetcore NR268 1.7.121109 Forgeable Firmware Authenticity Check in mtd_writeEPSS 0.2%CVE-2023-28802MEDIUMDisable Zscaler using machine tunnel restartEPSS 0.2%CVE-2024-47089HIGHUnauthorized Transaction Manipulation VulnerabilityEPSS 0.2%CVE-2026-28498HIGHAuthlib: Fail-Open Cryptographic Verification in OIDC Hash BindingEPSS 0.2%CVE-2025-39203HIGHA vulnerability exists in the IEC 61850 of the MicroSCADA X SYS600 product. An IEC 61850-8 crafted message content from IED or remote systemEPSS 0.2%CVE-2026-92701CRITICALCocos AI: Intra-handshake attested TLS implementation is vulnerable to session-misbinding attacks for Intel TDX verifier pathEPSS 0.2%CVE-2026-75803CRITICALAEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()EPSS 0.2%CVE-2026-72929HIGHWindows Installer Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2024-45789MEDIUMParameter Tampering VulnerabilityEPSS 0.2%CVE-2024-47573MEDIUMAn improper validation of integrity check value vulnerability [CWE-354] in FortiNDR version 7.4.2 and below, version 7.2.1 and below, versioEPSS 0.2%CVE-2026-26928HIGHLack of Dynamic Library Validation in SzafirHostEPSS 0.2%CVE-2025-3479MEDIUMForminator <= 1.42.0 - Order Replay VulnerabilityEPSS 0.2%CVE-2026-28402HIGHnimiq/core-rs-albatross's nimiq-blockchain missing proposal body root verificationEPSS 0.2%