Weaknesses of type CWE-354

121 results

Validação inadequada de valor de verificação de integridade

Ocorre quando o software recebe um valor de checksum, hash ou assinatura para verificar a integridade de dados, mas não valida esse valor corretamente antes de confiar nos dados. Um atacante pode modificar tanto os dados quanto o mecanismo de verificação, ou fornecer um valor falso, e o software aceita sem questionar.

Example

Um servidor recebe um arquivo com um MD5 anexado. Em vez de recalcular o hash e comparar, o código apenas verifica se o campo 'checksum' existe. Um atacante modifica o arquivo, recalcula o MD5 falsificado, envia ambos, e o servidor aceita o arquivo corrompido como válido.

How to mitigate

Sempre recalcule o hash/checksum do dado recebido e compare com o valor fornecido usando comparação de tempo constante. Para dados críticos, use HMAC com chave secreta ou assinatura criptográfica (RSA, ECDSA) em vez de apenas hash simples. Documente qual algoritmo e qual chave devem ser usados, e rejeite qualquer discrepância.

CVE-2026-12803HIGHKCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery)EPSS 0.2%CVE-2026-73459HIGHSecurity Advisory 0160EPSS 0.2%CVE-2026-8720MEDIUMHMAC-BLAKE2 final discards message when key length exceeds block sizeEPSS 0.2%CVE-2022-39844MEDIUMImproper validation of integrity check vulnerability in Smart Switch PC prior to version 4.3.22083 allows local attackers to delete arbitrarEPSS 0.2%CVE-2023-42143MEDIUMMissing Integrity Check in Shelly TRV 20220811-152343/v2.1.8@5afc928c allows malicious users to create a backdoor by redirecting the device EPSS 0.2%CVE-2026-32313HIGHxmlseclibs is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized DecryptionEPSS 0.2%CVE-2025-55155MEDIUMMantisBT: Authentication bypass for some passwords due to PHP type jugglingEPSS 0.2%CVE-2026-5479HIGHwolfSSL EVP ChaCha20-Poly1305 AEAD authentication tagEPSS 0.2%CVE-2020-9210MEDIUMThere is an insufficient integrity vulnerability in Huawei products. A module does not perform sufficient integrity check in a specific scenEPSS 0.1%CVE-2026-20354MEDIUMCisco Secure Email S/MIME Ciphertext Decryption VulnerabiltyEPSS 0.1%CVE-2026-32600HIGHxml-security is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized DecryptionEPSS 0.1%CVE-2026-12802HIGHCMS AuthEnvelopedData fails to enforce tag-length on decryptionEPSS 0.1%CVE-2026-59642HIGHCMS AuthenticatedData content not bound to MAC when authAttrs presentEPSS 0.1%CVE-2026-12816HIGHIESEngine stream-mode MAC forgery via length-dependent KDF splitEPSS 0.1%CVE-2022-33711—Improper validation of integrity check vulnerability in Samsung USB Driver Windows Installer for Mobile Phones prior to version 1.7.56.0 allEPSS 0.1%CVE-2026-13385CRITICALAn Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-theEPSS 0.1%CVE-2026-25934MEDIUMgo-git improperly verifies data integrity values for .idx and .pack filesEPSS 0.1%CVE-2026-12817HIGHOpenPGP AEAD decryption skips final tag on chunk-aligned dataEPSS 0.1%CVE-2022-39845MEDIUMImproper validation of integrity check vulnerability in Samsung Kies prior to version 2.6.4.22074 allows local attackers to delete arbitraryEPSS 0.1%CVE-2023-36537HIGHImproper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow an authenticated user to enable an escalation of priEPSS 0.1%