Weaknesses of type CWE-354

121 results

Validação inadequada de valor de verificação de integridade

Ocorre quando o software recebe um valor de checksum, hash ou assinatura para verificar a integridade de dados, mas não valida esse valor corretamente antes de confiar nos dados. Um atacante pode modificar tanto os dados quanto o mecanismo de verificação, ou fornecer um valor falso, e o software aceita sem questionar.

Example

Um servidor recebe um arquivo com um MD5 anexado. Em vez de recalcular o hash e comparar, o código apenas verifica se o campo 'checksum' existe. Um atacante modifica o arquivo, recalcula o MD5 falsificado, envia ambos, e o servidor aceita o arquivo corrompido como válido.

How to mitigate

Sempre recalcule o hash/checksum do dado recebido e compare com o valor fornecido usando comparação de tempo constante. Para dados críticos, use HMAC com chave secreta ou assinatura criptográfica (RSA, ECDSA) em vez de apenas hash simples. Documente qual algoritmo e qual chave devem ser usados, e rejeite qualquer discrepância.

CVE-2022-45191MEDIUMAn issue was discovered on Microchip RN4870 1.43 devices. An attacker within BLE radio range can cause a denial of service by sending a pairEPSS 0.2%CVE-2025-11543CRITICALImproper Validation of Integrity Check Value vulnerability in Sharp Display Solutions projectors allows a attacker may create and run unauthEPSS 0.2%CVE-2026-75625CRITICALKraken Agents Peer-to-Peer Download Cache Poisoning via Digest Verification BypassEPSS 0.2%CVE-2026-40323HIGHSP1 V6 Recursion Circuit Row-Count Binding GapEPSS 0.2%CVE-2025-25183LOWvLLM using built-in hash() from Python 3.12 leads to predictable hash collisions in vLLM prefix cacheEPSS 0.2%CVE-2026-32148HIGHLockfile checksums not verified in Hex allows dependency integrity bypassEPSS 0.2%CVE-2024-23462LOWZCC Mac validinstaller file integrity check missingEPSS 0.2%CVE-2026-82549MEDIUMLinux Foundation Magma SecurityModeComplete integrity checkEPSS 0.2%CVE-2026-16317HIGHSilent Drop of TLS 1.3 Encrypted Records in s2n-tlsEPSS 0.2%CVE-2024-51141HIGHAn issue in TOTOLINK Bluetooth Wireless Adapter A600UB allows a local attacker to execute arbitrary code via the WifiAutoInstallDriver.exe aEPSS 0.2%CVE-2026-50128MEDIUMMastodon: Spoofing of attribution domainsEPSS 0.2%CVE-2026-50021MEDIUMpnpm: Integrity Check Bypass via Missing Lockfile Integrity FieldEPSS 0.2%CVE-2021-41206HIGHIncomplete validation of shapes in multiple TF opsEPSS 0.2%CVE-2024-56169MEDIUMA validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI Relying Parties (such as Fort) are supposed to maintainEPSS 0.2%CVE-2026-48028MEDIUMMastodon: Removal of integrity-protected JSON entries from signed activitiesEPSS 0.2%CVE-2026-32105CRITICALxrdp: RDP MAC signature (dataSignature) never verified on receive — integrity bypass in non-TLS modeEPSS 0.2%CVE-2025-24148MEDIUMThis issue was addressed with improved handling of executable types. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS VEPSS 0.2%CVE-2023-28002MEDIUMAn improper validation of integrity check value vulnerability [CWE-354] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.12, 6.4 all versioEPSS 0.2%CVE-2025-11694HIGHRockwell Automation CompactLogix 5370 Controllers – Multiple VulnerabilitiesEPSS 0.2%CVE-2026-26275HIGHhttpsig-hyper has Improper Digest Verification that May Allow Message Integrity BypassEPSS 0.2%