Weaknesses of type CWE-354

151 results

Validação inadequada de valor de verificação de integridade

Ocorre quando o software recebe um valor de checksum, hash ou assinatura para verificar a integridade de dados, mas não valida esse valor corretamente antes de confiar nos dados. Um atacante pode modificar tanto os dados quanto o mecanismo de verificação, ou fornecer um valor falso, e o software aceita sem questionar.

Example

Um servidor recebe um arquivo com um MD5 anexado. Em vez de recalcular o hash e comparar, o código apenas verifica se o campo 'checksum' existe. Um atacante modifica o arquivo, recalcula o MD5 falsificado, envia ambos, e o servidor aceita o arquivo corrompido como válido.

How to mitigate

Sempre recalcule o hash/checksum do dado recebido e compare com o valor fornecido usando comparação de tempo constante. Para dados críticos, use HMAC com chave secreta ou assinatura criptográfica (RSA, ECDSA) em vez de apenas hash simples. Documente qual algoritmo e qual chave devem ser usados, e rejeite qualquer discrepância.

CVE-2024-47089HIGHUnauthorized Transaction Manipulation VulnerabilityEPSS 0.2%CVE-2026-28402HIGHnimiq/core-rs-albatross's nimiq-blockchain missing proposal body root verificationEPSS 0.2%CVE-2024-45789MEDIUMParameter Tampering VulnerabilityEPSS 0.2%CVE-2026-15999HIGHAES-CCM decryption accepts zero or out-of-range tag length, bypassing authenticationEPSS 0.2%CVE-2026-92701CRITICALCocos AI: Intra-handshake attested TLS implementation is vulnerable to session-misbinding attacks for Intel TDX verifier pathEPSS 0.2%CVE-2026-85747MEDIUMDistribution: Client `manifests.Get()` does not verify returned content against requested digestEPSS 0.2%CVE-2024-47573MEDIUMAn improper validation of integrity check value vulnerability [CWE-354] in FortiNDR version 7.4.2 and below, version 7.2.1 and below, versioEPSS 0.2%CVE-2025-3479MEDIUMForminator <= 1.42.0 - Order Replay VulnerabilityEPSS 0.2%CVE-2026-105280MEDIUMHex writes unverified package tarballs to standard output in mix hex.package fetchEPSS 0.2%CVE-2026-119186MEDIUMForge: AES-GCM authentication bypass via unvalidated tagLength optionEPSS 0.2%CVE-2026-5479HIGHwolfSSL EVP ChaCha20-Poly1305 AEAD authentication tagEPSS 0.2%CVE-2026-123317HIGHIn JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookiesEPSS 0.2%CVE-2026-20354MEDIUMCisco Secure Email S/MIME Ciphertext Decryption VulnerabiltyEPSS 0.2%CVE-2026-26928HIGHLack of Dynamic Library Validation in SzafirHostEPSS 0.2%CVE-2022-45191MEDIUMAn issue was discovered on Microchip RN4870 1.43 devices. An attacker within BLE radio range can cause a denial of service by sending a pairEPSS 0.2%CVE-2025-11543CRITICALImproper Validation of Integrity Check Value vulnerability in Sharp Display Solutions projectors allows a attacker may create and run unauthEPSS 0.2%CVE-2026-40323HIGHSP1 V6 Recursion Circuit Row-Count Binding GapEPSS 0.2%CVE-2026-12802HIGHCMS AuthEnvelopedData fails to enforce tag-length on decryptionEPSS 0.2%CVE-2026-32148HIGHLockfile checksums not verified in Hex allows dependency integrity bypassEPSS 0.2%CVE-2024-23462LOWZCC Mac validinstaller file integrity check missingEPSS 0.2%