Weaknesses of type CWE-354

121 results

Validação inadequada de valor de verificação de integridade

Ocorre quando o software recebe um valor de checksum, hash ou assinatura para verificar a integridade de dados, mas não valida esse valor corretamente antes de confiar nos dados. Um atacante pode modificar tanto os dados quanto o mecanismo de verificação, ou fornecer um valor falso, e o software aceita sem questionar.

Example

Um servidor recebe um arquivo com um MD5 anexado. Em vez de recalcular o hash e comparar, o código apenas verifica se o campo 'checksum' existe. Um atacante modifica o arquivo, recalcula o MD5 falsificado, envia ambos, e o servidor aceita o arquivo corrompido como válido.

How to mitigate

Sempre recalcule o hash/checksum do dado recebido e compare com o valor fornecido usando comparação de tempo constante. Para dados críticos, use HMAC com chave secreta ou assinatura criptográfica (RSA, ECDSA) em vez de apenas hash simples. Documente qual algoritmo e qual chave devem ser usados, e rejeite qualquer discrepância.

CVE-2024-32883HIGHMCUboot Injection attack of unprotected TLV valuesEPSS 0.1%CVE-2025-61480HIGHAn issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial ofEPSS 0.1%CVE-2026-56416MEDIUMPossible heap buffer overflow when validator canonicalizes RDATA that contains domain nameEPSS 0.1%CVE-2026-31839HIGHStriae has a hash validation utility vulnerabilityEPSS 0.1%CVE-2024-46992HIGHElectron ASAR Integrity bypass by just modifying the contentEPSS 0.1%CVE-2026-5504MEDIUMPKCS7 CBC Padding Oracle — Plaintext RecoveryEPSS 0.1%CVE-2024-23461MEDIUMZCC macOS Upgrade ZIP Bomb DoSEPSS 0.1%CVE-2026-32303HIGHCryptomator: Tampered vault configuration allows MITM attack on Hub APIEPSS 0.1%CVE-2023-41970MEDIUMRepair App local code execution with arbitrary privilegesEPSS 0.1%CVE-2026-54578LOWmport verify can compare stale checksum data after hashing failuresEPSS 0.1%CVE-2025-4616LOWPrisma Browser: Insufficient Validation of Untrusted Input Vulnerability in Prisma BrowserEPSS 0.1%CVE-2024-31958MEDIUMAn issue was discovered in Samsung Mobile Processor EExynos 2200, Exynos 1480, Exynos 2400. It lacks a check for the validation of native haEPSS 0.1%CVE-2026-54174HIGHmelange: Incomplete package integrity verification allows data section substitutionEPSS 0.1%CVE-2025-33193MEDIUMNVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause improper validation of integrity. A successfEPSS 0.1%CVE-2024-47255MEDIUMIn 2N Access Commander versions 3.1.1.2 and prior, a local attacker can escalate their privileges in the system which could allow for arbitrEPSS 0.1%CVE-2024-7402HIGHNetskope Client Configuration Tampering with Local MITMEPSS 0.1%CVE-2025-4418MEDIUMAVEVA PI Connector for CygNet Improper Validation of Integrity Check ValueEPSS 0.1%CVE-2024-47935MEDIUMTXOne Networks StellarProtect (Legacy Mode), StellarEnforce, and Safe Lock Improper Validation of Integrity Check Value VulnerabilityEPSS 0.1%CVE-2026-32318HIGHCryptomator for IOS: Tampered vault configuration allows MITM attack on Hub APIEPSS 0.1%CVE-2026-32317HIGHCryptomator for Android: Tampered vault configuration allows MITM attack on Hub APIEPSS 0.1%