Fallos del tipo CWE-354

151 resultados

Validação inadequada de valor de integridade

O sistema calcula ou recebe um valor de verificação de integridade (checksum, hash, assinatura) mas não valida corretamente se esse valor corresponde aos dados reais. Isso permite que um atacante modifique dados sem detecção, comprometendo a confiabilidade da informação transmitida ou armazenada.

Ejemplo

Uma API retorna um JSON com dados de usuário e inclui um MD5 dos dados para verificação. Se o código que consome a API nunca realmente compara o hash calculado com o hash recebido (ou faz a comparação de forma fraca), um intermediário pode alterar os dados e recalcular um hash falso que a validação deixa passar.

Cómo mitigar

Sempre validar que o valor de integridade recebido ou calculado corresponde exatamente aos dados verificados antes de usar esses dados. Use algoritmos criptográficos fortes (SHA-256 ou superior) e implemente a verificação em todas as camadas de processamento, não apenas em uma.

CVE-2024-23462LOWZCC Mac validinstaller file integrity check missingEPSS 0.2%CVE-2024-56169MEDIUMA validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI Relying Parties (such as Fort) are supposed to maintainEPSS 0.2%CVE-2026-26275HIGHhttpsig-hyper has Improper Digest Verification that May Allow Message Integrity BypassEPSS 0.2%CVE-2024-51141HIGHAn issue in TOTOLINK Bluetooth Wireless Adapter A600UB allows a local attacker to execute arbitrary code via the WifiAutoInstallDriver.exe aEPSS 0.2%CVE-2026-50128MEDIUMMastodon: Spoofing of attribution domainsEPSS 0.2%CVE-2026-50021MEDIUMpnpm: Integrity Check Bypass via Missing Lockfile Integrity FieldEPSS 0.2%CVE-2026-107846CRITICALbitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction listEPSS 0.2%CVE-2021-41206HIGHIncomplete validation of shapes in multiple TF opsEPSS 0.2%CVE-2025-61480HIGHAn issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial ofEPSS 0.2%CVE-2026-12816HIGHIESEngine stream-mode MAC forgery via length-dependent KDF splitEPSS 0.2%CVE-2025-24148MEDIUMThis issue was addressed with improved handling of executable types. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS VEPSS 0.2%CVE-2026-48028MEDIUMMastodon: Removal of integrity-protected JSON entries from signed activitiesEPSS 0.2%CVE-2026-31719HIGHcrypto: krb5enc - fix async decrypt skipping hash verificationEPSS 0.2%CVE-2026-32105CRITICALxrdp: RDP MAC signature (dataSignature) never verified on receive — integrity bypass in non-TLS modeEPSS 0.2%CVE-2026-89320HIGHHmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrityEPSS 0.2%CVE-2023-28002MEDIUMAn improper validation of integrity check value vulnerability [CWE-354] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.12, 6.4 all versioEPSS 0.2%CVE-2026-73459HIGHSecurity Advisory 0160EPSS 0.2%CVE-2025-11694HIGHRockwell Automation CompactLogix 5370 Controllers – Multiple VulnerabilitiesEPSS 0.2%CVE-2026-12817HIGHOpenPGP AEAD decryption skips final tag on chunk-aligned dataEPSS 0.2%CVE-2026-93318HIGHCache poisoning via unvalidated image layer DiffIDsEPSS 0.2%