Weaknesses of type CWE-354

151 results

Validação inadequada de valor de verificação de integridade

Ocorre quando o software recebe um valor de checksum, hash ou assinatura para verificar a integridade de dados, mas não valida esse valor corretamente antes de confiar nos dados. Um atacante pode modificar tanto os dados quanto o mecanismo de verificação, ou fornecer um valor falso, e o software aceita sem questionar.

Example

Um servidor recebe um arquivo com um MD5 anexado. Em vez de recalcular o hash e comparar, o código apenas verifica se o campo 'checksum' existe. Um atacante modifica o arquivo, recalcula o MD5 falsificado, envia ambos, e o servidor aceita o arquivo corrompido como válido.

How to mitigate

Sempre recalcule o hash/checksum do dado recebido e compare com o valor fornecido usando comparação de tempo constante. Para dados críticos, use HMAC com chave secreta ou assinatura criptográfica (RSA, ECDSA) em vez de apenas hash simples. Documente qual algoritmo e qual chave devem ser usados, e rejeite qualquer discrepância.

CVE-2026-12817HIGHOpenPGP AEAD decryption skips final tag on chunk-aligned dataEPSS 0.2%CVE-2026-93318HIGHCache poisoning via unvalidated image layer DiffIDsEPSS 0.2%CVE-2025-55155MEDIUMMantisBT: Authentication bypass for some passwords due to PHP type jugglingEPSS 0.2%CVE-2026-93317MEDIUMContainer blob cache can accept unverified contentEPSS 0.2%CVE-2026-8720MEDIUMHMAC-BLAKE2 final discards message when key length exceeds block sizeEPSS 0.2%CVE-2026-85515HIGHOpenPGP message truncation not reported, bypassing the SEIPDv1 integrity checkEPSS 0.2%CVE-2026-109366MEDIUMZebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig HeightEPSS 0.2%CVE-2026-32600HIGHxml-security is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized DecryptionEPSS 0.2%CVE-2022-39844MEDIUMImproper validation of integrity check vulnerability in Smart Switch PC prior to version 4.3.22083 allows local attackers to delete arbitrarEPSS 0.2%CVE-2026-102759MEDIUMNetX Secure TLS accepts an empty application-data record without verifying its message authentication code. In `_nx_secure_verify_mac`, a deEPSS 0.2%CVE-2026-25934MEDIUMgo-git improperly verifies data integrity values for .idx and .pack filesEPSS 0.2%CVE-2026-95625MEDIUMTauri framework v2 missing updater signature version number validation can be exploited into forced downgradeEPSS 0.2%CVE-2023-42143MEDIUMMissing Integrity Check in Shelly TRV 20220811-152343/v2.1.8@5afc928c allows malicious users to create a backdoor by redirecting the device EPSS 0.2%CVE-2026-54174HIGHmelange: Incomplete package integrity verification allows data section substitutionEPSS 0.2%CVE-2020-9210MEDIUMThere is an insufficient integrity vulnerability in Huawei products. A module does not perform sufficient integrity check in a specific scenEPSS 0.2%CVE-2026-16001HIGHIesEngine stream-mode MAC forgery via length-dependent KDF splitEPSS 0.2%CVE-2026-115906MEDIUMzip: AES Entry HMAC Authentication Bypass on Premature EOFEPSS 0.2%CVE-2026-116608MEDIUMDAMO Academy VideoLLaMA2 Model Loading __init__.py load_pretrained_model integrity checkEPSS 0.1%CVE-2022-33711—Improper validation of integrity check vulnerability in Samsung USB Driver Windows Installer for Mobile Phones prior to version 1.7.56.0 allEPSS 0.1%CVE-2026-13385CRITICALAn Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-theEPSS 0.1%