Fallos del tipo CWE-354

120 resultados

Validação inadequada de valor de integridade

O sistema calcula ou recebe um valor de verificação de integridade (checksum, hash, assinatura) mas não valida corretamente se esse valor corresponde aos dados reais. Isso permite que um atacante modifique dados sem detecção, comprometendo a confiabilidade da informação transmitida ou armazenada.

Ejemplo

Uma API retorna um JSON com dados de usuário e inclui um MD5 dos dados para verificação. Se o código que consome a API nunca realmente compara o hash calculado com o hash recebido (ou faz a comparação de forma fraca), um intermediário pode alterar os dados e recalcular um hash falso que a validação deixa passar.

Cómo mitigar

Sempre validar que o valor de integridade recebido ou calculado corresponde exatamente aos dados verificados antes de usar esses dados. Use algoritmos criptográficos fortes (SHA-256 ou superior) e implemente a verificação em todas as camadas de processamento, não apenas em uma.

CVE-2026-26275HIGHhttpsig-hyper has Improper Digest Verification that May Allow Message Integrity BypassEPSS 0.2%CVE-2026-73459HIGHSecurity Advisory 0160EPSS 0.2%CVE-2026-8720MEDIUMHMAC-BLAKE2 final discards message when key length exceeds block sizeEPSS 0.2%CVE-2022-39844MEDIUMImproper validation of integrity check vulnerability in Smart Switch PC prior to version 4.3.22083 allows local attackers to delete arbitrarEPSS 0.2%CVE-2023-42143MEDIUMMissing Integrity Check in Shelly TRV 20220811-152343/v2.1.8@5afc928c allows malicious users to create a backdoor by redirecting the device EPSS 0.2%CVE-2026-32313HIGHxmlseclibs is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized DecryptionEPSS 0.2%CVE-2025-55155MEDIUMMantisBT: Authentication bypass for some passwords due to PHP type jugglingEPSS 0.2%CVE-2026-5479HIGHwolfSSL EVP ChaCha20-Poly1305 AEAD authentication tagEPSS 0.2%CVE-2026-20354MEDIUMCisco Secure Email S/MIME Ciphertext Decryption VulnerabiltyEPSS 0.1%CVE-2020-9210MEDIUMThere is an insufficient integrity vulnerability in Huawei products. A module does not perform sufficient integrity check in a specific scenEPSS 0.1%CVE-2026-32600HIGHxml-security is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized DecryptionEPSS 0.1%CVE-2026-12816HIGHIESEngine stream-mode MAC forgery via length-dependent KDF splitEPSS 0.1%CVE-2026-59642HIGHCMS AuthenticatedData content not bound to MAC when authAttrs presentEPSS 0.1%CVE-2026-12802HIGHCMS AuthEnvelopedData fails to enforce tag-length on decryptionEPSS 0.1%CVE-2022-33711—Improper validation of integrity check vulnerability in Samsung USB Driver Windows Installer for Mobile Phones prior to version 1.7.56.0 allEPSS 0.1%CVE-2026-13385CRITICALAn Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-theEPSS 0.1%CVE-2026-25934MEDIUMgo-git improperly verifies data integrity values for .idx and .pack filesEPSS 0.1%CVE-2026-12817HIGHOpenPGP AEAD decryption skips final tag on chunk-aligned dataEPSS 0.1%CVE-2022-39845MEDIUMImproper validation of integrity check vulnerability in Samsung Kies prior to version 2.6.4.22074 allows local attackers to delete arbitraryEPSS 0.1%CVE-2023-36537HIGHImproper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow an authenticated user to enable an escalation of priEPSS 0.1%