Falhas do tipo CWE-345

683 resultados

Verificação insuficiente de autenticidade de dados

A aplicação recebe dados de fontes externas (rede, arquivo, entrada do usuário) mas não valida adequadamente se eles realmente vieram de quem diz vir ou se não foram alterados no caminho. Isso permite que um atacante forje, intercepte ou modifique dados sem que o sistema detecte, comprometendo integridade e confiança.

Exemplo

Um serviço REST que confia cegamente em um campo 'user_id' vindo do cliente, sem verificar assinatura ou token, permitindo que alguém mude a URL para acessar dados de outro usuário. Ou um arquivo de configuração lido sem validar sua hash, permitindo execução de código malicioso se o arquivo for corrompido.

Como mitigar

Use mecanismos criptográficos de autenticação (HMAC, assinatura digital, certificados TLS) para garantir a origem e integridade dos dados. No lado do servidor, nunca confie em identificadores ou claims do cliente — valide contra seu próprio estado autorizado (sessão, JWT assinado, etc).

CVE-2026-46538MEDIUMMicrosoft UFO accepts cross-device TASK_END messages by session_id only, allowing peer task-result injectionEPSS 0.2%CVE-2026-61591HIGHdjust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)EPSS 0.2%CVE-2026-40487HIGHPostiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSSEPSS 0.2%CVE-2026-50526HIGH.NET Tampering VulnerabilityEPSS 0.2%CVE-2026-48106HIGHArc Enterprise cluster replication accepts unauthenticated MsgReplicateSync messages, enabling cluster-wide data injection from any TLS-trusted peerEPSS 0.2%CVE-2026-48105HIGHArc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path-traversal worm primitiveEPSS 0.2%CVE-2024-31341MEDIUMWordPress User Profile Builder plugin <= 3.11.2 - Bypass Vulnerability vulnerabilityEPSS 0.2%CVE-2026-53425HIGHMissing InResponseTo validation in Samly allows acceptance of unsolicited SAML responsesEPSS 0.2%CVE-2026-48063CRITICALBaileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payloadEPSS 0.2%CVE-2024-7979HIGHInsufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege eEPSS 0.2%CVE-2026-49284HIGHSimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`EPSS 0.2%CVE-2026-112101MEDIUMBlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validationEPSS 0.2%CVE-2026-121620HIGHCoopCycle coopcycle-web 5.6.0 before 6.20.0 Missing Zelty Webhook Signature VerificationEPSS 0.2%CVE-2026-50575HIGHBetterDesk has a replay behavior vulnerability when devices are deletedEPSS 0.2%CVE-2026-69105HIGHPotential package cache integrity issue in JFrog ArtifactoryEPSS 0.2%CVE-2024-48916HIGHCeph is vulnerable to authentication bypass through RadosGWEPSS 0.2%CVE-2026-39155MEDIUMKnot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability in mod-onlinesign where the next NSEC owner name can be computed incoEPSS 0.2%CVE-2023-23940MEDIUMOpenZeppelin Contracts for Cairo is vulnerable to signature validation bypassEPSS 0.2%CVE-2023-43800HIGHInsufficient Verification of Data Authenticity in Arduino Create AgentEPSS 0.2%CVE-2026-100872HIGHSylius 2.x before 2.1.16 and 2.2.9 Payment Amount OverwriteEPSS 0.2%