Falhas do tipo CWE-345

676 resultados

Verificação insuficiente de autenticidade de dados

A aplicação recebe dados de fontes externas (rede, arquivo, entrada do usuário) mas não valida adequadamente se eles realmente vieram de quem diz vir ou se não foram alterados no caminho. Isso permite que um atacante forje, intercepte ou modifique dados sem que o sistema detecte, comprometendo integridade e confiança.

Exemplo

Um serviço REST que confia cegamente em um campo 'user_id' vindo do cliente, sem verificar assinatura ou token, permitindo que alguém mude a URL para acessar dados de outro usuário. Ou um arquivo de configuração lido sem validar sua hash, permitindo execução de código malicioso se o arquivo for corrompido.

Como mitigar

Use mecanismos criptográficos de autenticação (HMAC, assinatura digital, certificados TLS) para garantir a origem e integridade dos dados. No lado do servidor, nunca confie em identificadores ou claims do cliente — valide contra seu próprio estado autorizado (sessão, JWT assinado, etc).

CVE-2025-12999CRITICALUrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-ForwardEPSS 0.3%CVE-2022-37928HIGHInsufficient Verification of Data Authenticity vulnerability in Hewlett Packard Enterprise HPE Nimble Storage Hybrid Flash Arrays and NimbleEPSS 0.3%CVE-2023-6236HIGHEap: oidc app attempting to access the second tenant, the user should be prompted to logEPSS 0.3%CVE-2023-6323MEDIUMThroughTek Kalay SDK insufficient verification of message authenticityEPSS 0.3%CVE-2025-49199HIGHBackup files can be modified and uploadedEPSS 0.3%CVE-2026-62874CRITICALAzure Billing Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-12245MEDIUMchatwoot Widget IFrameHelper.js initPostMessageCommunication origin validationEPSS 0.3%CVE-2023-4589CRITICALInsufficient verification of data authenticity vulnerability in Delinea Secret ServerEPSS 0.3%CVE-2022-3703HIGHETIC Telecom Remote Access Server Insufficient Verification of Data AuthenticityEPSS 0.3%CVE-2026-54239HIGHFaustWP — Authentication Bypass via Initialization Vector Modification in Token EnvelopeEPSS 0.3%CVE-2021-4122—It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attEPSS 0.3%CVE-2026-114612CRITICALLiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt KeyEPSS 0.3%CVE-2025-27680CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.750 Application 20.0.1442 allows Insecure Firmware Image with InsuffiEPSS 0.3%CVE-2023-41896HIGHFake websocket server installation permits full takeover in Home Assistant CoreEPSS 0.3%CVE-2026-54496CRITICALMissing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundnessEPSS 0.3%CVE-2025-27558CRITICALIEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or EPSS 0.3%CVE-2023-48238HIGHJWT Algorithm Confusion in json-web-token libraryEPSS 0.3%CVE-2024-30250HIGHIn Astro-Shield, setting a correct `integrity` attribute to injected code allows to bypass the allow-listsEPSS 0.3%CVE-2022-37008HIGHThe recovery module has a vulnerability of bypassing the verification of an update package before use. Successful exploitation of this vulneEPSS 0.3%CVE-2022-30267HIGHEmerson Ovation Insufficient Verification of Data AuthenticityEPSS 0.3%