Falhas do tipo CWE-345

557 resultados

Verificação insuficiente de autenticidade de dados

A aplicação recebe dados de fontes externas (rede, arquivo, entrada do usuário) mas não valida adequadamente se eles realmente vieram de quem diz vir ou se não foram alterados no caminho. Isso permite que um atacante forje, intercepte ou modifique dados sem que o sistema detecte, comprometendo integridade e confiança.

Exemplo

Um serviço REST que confia cegamente em um campo 'user_id' vindo do cliente, sem verificar assinatura ou token, permitindo que alguém mude a URL para acessar dados de outro usuário. Ou um arquivo de configuração lido sem validar sua hash, permitindo execução de código malicioso se o arquivo for corrompido.

Como mitigar

Use mecanismos criptográficos de autenticação (HMAC, assinatura digital, certificados TLS) para garantir a origem e integridade dos dados. No lado do servidor, nunca confie em identificadores ou claims do cliente — valide contra seu próprio estado autorizado (sessão, JWT assinado, etc).

CVE-2022-22757MEDIUMRemote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to thEPSS 0.2%CVE-2025-15385CRITICALInsufficient Verification of Data Authenticity vulnerability in TECNO Mobile com.Afmobi.Boomplayer allows Authentication Bypass.This issue aEPSS 0.2%CVE-2026-33233HIGHAutoGPT Platform: Remote Code Execution via Unsafe Pickle Deserialization of Redis Cache EntriesEPSS 0.2%CVE-2026-50526HIGH.NET Tampering VulnerabilityEPSS 0.2%CVE-2021-34572MEDIUMInsufficient Verification of Data Authenticity in Enbra EWM (replay attack)EPSS 0.2%CVE-2026-2968MEDIUMCesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verificationEPSS 0.2%CVE-2026-46538MEDIUMMicrosoft UFO accepts cross-device TASK_END messages by session_id only, allowing peer task-result injectionEPSS 0.2%CVE-2025-14444MEDIUMRegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_paymentEPSS 0.2%CVE-2022-46370HIGHRumpus - FTP server Improper Token Verification EPSS 0.2%CVE-2026-40487HIGHPostiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSSEPSS 0.2%CVE-2024-7979HIGHInsufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege eEPSS 0.2%CVE-2024-31341MEDIUMWordPress User Profile Builder plugin <= 3.11.2 - Bypass Vulnerability vulnerabilityEPSS 0.2%CVE-2025-2346MEDIUMIROAD Dash Cam X5/Dash Cam X6 Domain origin validationEPSS 0.2%CVE-2026-49284HIGHSimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`EPSS 0.2%CVE-2023-23940MEDIUMOpenZeppelin Contracts for Cairo is vulnerable to signature validation bypassEPSS 0.2%CVE-2025-67298HIGHAn issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profileEPSS 0.2%CVE-2026-48799HIGHPostiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhookEPSS 0.2%CVE-2026-6986MEDIUMCesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verificationEPSS 0.2%CVE-2026-33471CRITICALnimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncationEPSS 0.2%CVE-2026-47304HIGH.NET Security Feature Bypass VulnerabilityEPSS 0.2%