Falhas do tipo CWE-353

43 resultados

Ausência de Verificação de Integridade

A aplicação recebe dados (arquivo, mensagem, pacote) sem validar se foram alterados durante o armazenamento ou transmissão. Sem um mecanismo de integridade como hash, assinatura ou MAC, um atacante pode modificar os dados sem ser detectado, comprometendo a confiabilidade das operações.

Exemplo

Um servidor web transmite um arquivo de configuração crítico ao cliente sem incluir um hash SHA-256. Um atacante na rede intercepta e modifica o arquivo, injetando credenciais maliciosas. O cliente aceita o arquivo alterado como legítimo porque não há verificação.

Como mitigar

Implemente verificação de integridade obrigatória: calcule e transmita um hash criptográfico (SHA-256+) ou assinatura digital junto aos dados; o receptor valida antes de usar. Em transporte, use HTTPS/TLS; em armazenamento, use HMAC ou assinatura.

CVE-2021-28545HIGHAcrobat Reader DC Missing Support for Integrity CheckEPSS 2.3%CVE-2021-28546MEDIUMAcrobat Reader DC Missing Support for Integrity CheckEPSS 1.4%CVE-2019-10943—A vulnerability has been identified in SIMATIC Drive Controller family (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl.EPSS 1.0%CVE-2020-10124—NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt, authenticate, or verify the integrity of messages between the BNA and the host EPSS 0.7%CVE-2020-7878—An arbitrary file download and execution vulnerability was found in the VideoOffice X2.9 and earlier versions (CVE-2020-7878). This issue isEPSS 0.7%CVE-2020-7808HIGHRAONWIZ Inc K Upload, arguments modiffication via missing support for integrity check vulnerabilityEPSS 0.7%CVE-2021-26608HIGHhandysoft groupware arbitrary file download and execution vulnerabilityEPSS 0.6%CVE-2019-19160MEDIUMReportexpress ProPlus contains a vulnerability that could allow an arbitrary code execution by inserted VBscript into the configure file(rxpEPSS 0.6%CVE-2023-29290MEDIUMAdobe Commerce Guest Cart Shipping Address Overwrite IDOR EPSS 0.6%CVE-2019-11480HIGHUbuntu kernel snap build process could use unauthenticated sourcesEPSS 0.5%CVE-2020-10266HIGHRVD#1487: No integrity checks on UR+ platform artifacts when installed in the robotEPSS 0.5%CVE-2020-7810HIGHHandySoft ActiveX File Download and Execution VulnerabilityEPSS 0.4%CVE-2021-26610HIGHgodomall5 remote code execution vulnerabilityEPSS 0.4%CVE-2019-12804HIGHHunesion i-oneNet Missing Support for Integrity Check vulnerabilityEPSS 0.4%CVE-2022-24404MEDIUMCiphertext Malleability in TETRAEPSS 0.3%CVE-2023-28865MEDIUMDiebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR15, 4.0.0 SR05, 4.1.0 SR03, and 4.2.0 SR02 fails to validate the directory conteEPSS 0.3%CVE-2025-48811MEDIUMWindows Virtualization-Based Security (VBS) Enclave Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-48803MEDIUMWindows Virtualization-Based Security (VBS) Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-10010MEDIUMIntegrity Validation Bypass in CryptoPro Secure Disk for BitLockerEPSS 0.3%CVE-2024-46917HIGHDiebold Nixdorf Vynamic Security Suite through 4.3.0 SR01 does not validate file attributes or the contents of /root during integrity validaEPSS 0.2%