Fallos del tipo CWE-354

151 resultados

Validação inadequada de valor de integridade

O sistema calcula ou recebe um valor de verificação de integridade (checksum, hash, assinatura) mas não valida corretamente se esse valor corresponde aos dados reais. Isso permite que um atacante modifique dados sem detecção, comprometendo a confiabilidade da informação transmitida ou armazenada.

Ejemplo

Uma API retorna um JSON com dados de usuário e inclui um MD5 dos dados para verificação. Se o código que consome a API nunca realmente compara o hash calculado com o hash recebido (ou faz a comparação de forma fraca), um intermediário pode alterar os dados e recalcular um hash falso que a validação deixa passar.

Cómo mitigar

Sempre validar que o valor de integridade recebido ou calculado corresponde exatamente aos dados verificados antes de usar esses dados. Use algoritmos criptográficos fortes (SHA-256 ou superior) e implemente a verificação em todas as camadas de processamento, não apenas em uma.

CVE-2026-58061HIGHCCM-family modes write plaintext to caller buffer before tag checkEPSS 0.3%CVE-2026-76852HIGHNetcore NR268 1.7.121109 Forgeable Firmware Authenticity Check in mtd_writeEPSS 0.3%CVE-2023-50738MEDIUMA firmware downgrade prevention vulnerability has been identified in newer Lexmark devices.EPSS 0.3%CVE-2023-23119MEDIUMThe use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes Ubiquiti airFiber AF2X Radio firmwarEPSS 0.3%CVE-2023-23120MEDIUMThe use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes TRENDnet TV-IP651WI Network Camera fEPSS 0.3%CVE-2025-54887CRITICALjwe: Missing AES-GCM authentication tag validation in encrypted JWEsEPSS 0.3%CVE-2023-30356HIGHMissing Support for an Integrity Check in Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows attackers to update the device EPSS 0.3%CVE-2023-24063MEDIUMDiebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR10 fails to validate /etc/mtab during the Pre-Boot Authorization (PBA) process. EPSS 0.3%CVE-2026-54580HIGHmport index decompression can leave partial or corrupt index data after zstd failuresEPSS 0.3%CVE-2026-82549MEDIUMLinux Foundation Magma SecurityModeComplete integrity checkEPSS 0.3%CVE-2026-75803CRITICALAEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()EPSS 0.3%CVE-2025-3247MEDIUMContact Form 7 <= 6.0.5 - Order Replay VulnerabilityEPSS 0.3%CVE-2026-113714LOWvirtualenv: Downloaded wheel selection and caching precede verificationEPSS 0.2%CVE-2026-16317HIGHSilent Drop of TLS 1.3 Encrypted Records in s2n-tlsEPSS 0.2%CVE-2026-75625CRITICALKraken Agents Peer-to-Peer Download Cache Poisoning via Digest Verification BypassEPSS 0.2%CVE-2026-28498HIGHAuthlib: Fail-Open Cryptographic Verification in OIDC Hash BindingEPSS 0.2%CVE-2026-12803HIGHKCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery)EPSS 0.2%CVE-2025-39203HIGHA vulnerability exists in the IEC 61850 of the MicroSCADA X SYS600 product. An IEC 61850-8 crafted message content from IED or remote systemEPSS 0.2%CVE-2026-9653HIGH1756-EN2, 1756-EN3, and 1756-ENBT - Denial of Service via CIP Connection IDEPSS 0.2%CVE-2026-72929HIGHWindows Installer Elevation of Privilege VulnerabilityEPSS 0.2%