Fallos del tipo CWE-354

151 resultados

Validação inadequada de valor de integridade

O sistema calcula ou recebe um valor de verificação de integridade (checksum, hash, assinatura) mas não valida corretamente se esse valor corresponde aos dados reais. Isso permite que um atacante modifique dados sem detecção, comprometendo a confiabilidade da informação transmitida ou armazenada.

Ejemplo

Uma API retorna um JSON com dados de usuário e inclui um MD5 dos dados para verificação. Se o código que consome a API nunca realmente compara o hash calculado com o hash recebido (ou faz a comparação de forma fraca), um intermediário pode alterar os dados e recalcular um hash falso que a validação deixa passar.

Cómo mitigar

Sempre validar que o valor de integridade recebido ou calculado corresponde exatamente aos dados verificados antes de usar esses dados. Use algoritmos criptográficos fortes (SHA-256 ou superior) e implemente a verificação em todas as camadas de processamento, não apenas em uma.

CVE-2022-25946HIGHOn all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided ConfigurEPSS 0.4%CVE-2024-48930HIGHsecp256k1-node vulnerable to private key extraction over ECDHEPSS 0.4%CVE-2026-26007HIGHcryptography Subgroup Attack Due to Missing Subgroup Validation for SECT CurvesEPSS 0.4%CVE-2026-34181HIGHPKCS#12 Files with PBMAC1 Are Accepted with Short HMAC KeysEPSS 0.4%CVE-2023-34459MEDIUMOpenZeppelin Contracts's MerkleProof multiproofs may allow proving arbitrary leaves for specific treesEPSS 0.4%CVE-2026-85243MEDIUMApache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message StructureEPSS 0.4%CVE-2022-38955HIGHAn exploitable firmware modification vulnerability was discovered on the Netgear WPN824EXT WiFi Range Extender. An attacker can conduct a MIEPSS 0.4%CVE-2024-25678MEDIUMIn LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled.EPSS 0.4%CVE-2016-15028MEDIUMICEPAY REST-API-NET Checksum Validation RestClient.cs RestClient integrity checkEPSS 0.3%CVE-2023-31437MEDIUMAn issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log mEPSS 0.3%CVE-2026-33026CRITICALnginx-ui Backup Restore Allows Tampering with Encrypted BackupsEPSS 0.3%CVE-2023-33981MEDIUMBriar before 1.4.22 allows attackers to spoof other users' messages in a blog, forum, or private group, but each spoofed message would need EPSS 0.3%CVE-2024-34714HIGHHoppscotch Extension responds to calls made by origins not in the domain listEPSS 0.3%CVE-2023-4929MEDIUMNPort 5000 Series Firmware Improper Validation of Integrity Check VulnerabilityEPSS 0.3%CVE-2021-4148—A vulnerability was found in the Linux kernel's block_invalidatepage in fs/buffer.c in the filesystem. A missing sanity check may allow a loEPSS 0.3%CVE-2026-59642HIGHCMS AuthenticatedData content not bound to MAC when authAttrs presentEPSS 0.3%CVE-2026-49230MEDIUMApache APISIX: Authentication bypass in jwe-decryptEPSS 0.3%CVE-2026-103601HIGHCcmBlockCipher and KCcmBlockCipher leave unverified plaintext in the output buffer after a failed tag checkEPSS 0.3%CVE-2022-38956MEDIUMAn exploitable firmware downgrade vulnerability was discovered on the Netgear WPN824EXT WiFi Range Extender. An attacker can conduct a MITM EPSS 0.3%CVE-2018-5441—An Improper Validation of Integrity Check Value issue was discovered in PHOENIX CONTACT mGuard firmware versions 7.2 to 8.6.0. mGuard deviceEPSS 0.3%