Fallos del tipo CWE-345

557 resultados

Verificação insuficiente de autenticidade de dados

É quando o software aceita dados sem validar adequadamente se vieram de uma fonte legítima e confiável. O sistema confia em informações (mensagens, arquivos, requisições) sem confirmar sua origem ou integridade, permitindo que um atacante forje, modifique ou injete dados maliciosos que serão processados como se fossem legítimos.

Ejemplo

Um serviço aceita atualizações de configuração via JSON sem verificar assinatura digital ou token HMAC. Um atacante intercepta a requisição e modifica o payload para redirecionar logs para um servidor controlado por ele — e o serviço aplica a mudança porque 'recebeu um JSON válido'.

Cómo mitigar

Implemente autenticação criptográfica de dados: use assinatura digital (HMAC, RSA, ECDSA) ou tokens com validade (JWT com chave secreta), valide sempre a origem da mensagem antes de processar, e recuse dados sem prova de autenticidade. Não confie apenas em formato válido ou canal de transporte — valide origem e integridade.

CVE-2025-0149MEDIUMZoom Apps - Insufficient Verification of Data AuthenticityEPSS 0.2%CVE-2023-27977MEDIUMA CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause access to delete files inEPSS 0.2%CVE-2025-8038CRITICALCSP frame-src was not correctly enforced for pathsEPSS 0.2%CVE-2024-12369MEDIUMElytron-oidc-client: oidc authorization code injectionEPSS 0.2%CVE-2025-59160LOWmatrix-js-sdk has insufficient validation when considering a room to be upgraded by anotherEPSS 0.2%CVE-2026-49212MEDIUMSymfony UX: LiveComponentHydrator HMAC checksum lacks component and slot bindingEPSS 0.2%CVE-2023-27979MEDIUMA CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could allow the renaming of files in EPSS 0.2%CVE-2026-33729MEDIUMOpenFGA has an Authorization Bypass through cached keysEPSS 0.2%CVE-2024-28251MEDIUMCross-site websocket hijacking in QuerybookEPSS 0.2%CVE-2025-30192HIGHA Recursor configured to send out ECS enabled queries can be sensitive to spoofing attemptsEPSS 0.2%CVE-2026-73840MEDIUMOpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)EPSS 0.2%CVE-2022-31598—Due to insufficient input validation, SAP Business Objects - version 420, allows an authenticated attacker to submit a malicious request thrEPSS 0.2%CVE-2026-52812HIGHGogs: LFS dedupe path leaks private repo content across tenantsEPSS 0.2%CVE-2026-53536MEDIUMActivepieces: Cross-tenant file download via missing JWT audience check on step-files signed URLEPSS 0.2%CVE-2026-23966CRITICALsm-crypto Affected by Private Key Recovery in SM2-PKEEPSS 0.2%CVE-2020-13178—A function in the Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows prior to version 20.04.1 does not properly validaEPSS 0.2%CVE-2026-7606MEDIUMTRENDnet TEW-821DAP Firmware Update new_gui_update_firmware data authenticityEPSS 0.2%CVE-2026-7611MEDIUMTRENDnet TEW-821DAP Firmware Update cameo_dev.sh platform_do_upgrade_cameo_dev data authenticityEPSS 0.2%CVE-2026-45058CRITICALelecterm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmarkEPSS 0.2%CVE-2022-22757MEDIUMRemote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to thEPSS 0.2%