Fallos del tipo CWE-345

683 resultados

Verificação insuficiente de autenticidade de dados

É quando o software aceita dados sem validar adequadamente se vieram de uma fonte legítima e confiável. O sistema confia em informações (mensagens, arquivos, requisições) sem confirmar sua origem ou integridade, permitindo que um atacante forje, modifique ou injete dados maliciosos que serão processados como se fossem legítimos.

Ejemplo

Um serviço aceita atualizações de configuração via JSON sem verificar assinatura digital ou token HMAC. Um atacante intercepta a requisição e modifica o payload para redirecionar logs para um servidor controlado por ele — e o serviço aplica a mudança porque 'recebeu um JSON válido'.

Cómo mitigar

Implemente autenticação criptográfica de dados: use assinatura digital (HMAC, RSA, ECDSA) ou tokens com validade (JWT com chave secreta), valide sempre a origem da mensagem antes de processar, e recuse dados sem prova de autenticidade. Não confie apenas em formato válido ou canal de transporte — valide origem e integridade.

CVE-2025-15598MEDIUMDataease SQLBot JWT Token auth.py validateEmbedded signature verificationEPSS 0.2%CVE-2026-48781CRITICALPostiz has cross-tenant SUPERADMIN takeover via Skool-provider JWT forgeryEPSS 0.2%CVE-2026-44434MEDIUMQuicly is vulnerable to stateless reset injectionEPSS 0.2%CVE-2026-19219HIGHDialogHandler UploadPaths Tampering Vulnerability in Telerik UI for ASP.NET AJAXEPSS 0.2%CVE-2026-63405MEDIUMAnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary BodyEPSS 0.2%CVE-2026-32231HIGHZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload dataEPSS 0.2%CVE-2022-36315MEDIUMWhen loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entrieEPSS 0.2%CVE-2026-55430MEDIUMCoder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data accessEPSS 0.2%CVE-2019-10157MEDIUMIt was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backEPSS 0.2%CVE-2022-46692MEDIUMA logic issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, iOS 15.7EPSS 0.2%CVE-2026-121545MEDIUMDreeve before 5.8.0 Missing Authentication in Strava Webhook POST HandlerEPSS 0.2%CVE-2026-92360MEDIUMag-ui-protocol ag-ui Event Application Layer agent.ts prepareRunAgentInput origin validationEPSS 0.2%CVE-2019-1880MEDIUMCisco Unified Computing System BIOS Signature Bypass VulnerabilityEPSS 0.2%CVE-2023-44402MEDIUMASAR Integrity bypass via filetype confusion in electronEPSS 0.2%CVE-2026-73437MEDIUMOn affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper/destinatEPSS 0.2%CVE-2026-114050HIGHvLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUIDEPSS 0.2%CVE-2026-66785HIGHSubmariner: submariner: missing validation of remote endpoint subnets and clusterid enables cross-cluster traffic hijackEPSS 0.2%CVE-2024-2382MEDIUMAuthorize.net Payment Gateway For WooCommerce <= 8.0 - Insufficient Verification of Data Authenticity to Unauthenticated Payment BypassEPSS 0.2%CVE-2026-111392MEDIUMSGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /generateEPSS 0.2%CVE-2026-47664HIGHPathling: $import-pnp operation enables authenticated SSRF, credential leakage, and warehouse data poisoningEPSS 0.2%