Falhas do tipo CWE-354

151 resultados

Validação inadequada de valor de verificação de integridade

É quando o código não valida corretamente (ou não valida de jeito nenhum) checksums, hashes ou assinaturas criptográficas que devem garantir que dados não foram modificados. Sem essa validação, um atacante consegue alterar dados em trânsito ou em repouso sem ser detectado.

Exemplo

Um sistema baixa um arquivo com um hash SHA-256 fornecido pelo servidor, mas calcula o hash local de forma errada, compara apenas os primeiros 8 caracteres em vez dos 64, ou sequer verifica se o resultado bate. O atacante altera o arquivo durante o download e ninguém percebe.

Como mitigar

Sempre calcular o hash/checksum completo do dado recebido e comparar byte-a-byte com o valor esperado. Use funções criptográficas estabelecidas (SHA-256 ou superior), nunca invente sua própria lógica de validação, e lance exceção se a verificação falhar. Para dados críticos, considere assinatura criptográfica em vez de apenas hash.

CVE-2022-25946HIGHOn all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided ConfigurEPSS 0.4%CVE-2024-48930HIGHsecp256k1-node vulnerable to private key extraction over ECDHEPSS 0.4%CVE-2026-26007HIGHcryptography Subgroup Attack Due to Missing Subgroup Validation for SECT CurvesEPSS 0.4%CVE-2026-34181HIGHPKCS#12 Files with PBMAC1 Are Accepted with Short HMAC KeysEPSS 0.4%CVE-2023-34459MEDIUMOpenZeppelin Contracts's MerkleProof multiproofs may allow proving arbitrary leaves for specific treesEPSS 0.4%CVE-2026-85243MEDIUMApache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message StructureEPSS 0.4%CVE-2022-38955HIGHAn exploitable firmware modification vulnerability was discovered on the Netgear WPN824EXT WiFi Range Extender. An attacker can conduct a MIEPSS 0.4%CVE-2024-25678MEDIUMIn LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled.EPSS 0.4%CVE-2016-15028MEDIUMICEPAY REST-API-NET Checksum Validation RestClient.cs RestClient integrity checkEPSS 0.3%CVE-2023-31437MEDIUMAn issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log mEPSS 0.3%CVE-2026-33026CRITICALnginx-ui Backup Restore Allows Tampering with Encrypted BackupsEPSS 0.3%CVE-2023-33981MEDIUMBriar before 1.4.22 allows attackers to spoof other users' messages in a blog, forum, or private group, but each spoofed message would need EPSS 0.3%CVE-2024-34714HIGHHoppscotch Extension responds to calls made by origins not in the domain listEPSS 0.3%CVE-2023-4929MEDIUMNPort 5000 Series Firmware Improper Validation of Integrity Check VulnerabilityEPSS 0.3%CVE-2021-4148—A vulnerability was found in the Linux kernel's block_invalidatepage in fs/buffer.c in the filesystem. A missing sanity check may allow a loEPSS 0.3%CVE-2026-59642HIGHCMS AuthenticatedData content not bound to MAC when authAttrs presentEPSS 0.3%CVE-2026-49230MEDIUMApache APISIX: Authentication bypass in jwe-decryptEPSS 0.3%CVE-2026-103601HIGHCcmBlockCipher and KCcmBlockCipher leave unverified plaintext in the output buffer after a failed tag checkEPSS 0.3%CVE-2022-38956MEDIUMAn exploitable firmware downgrade vulnerability was discovered on the Netgear WPN824EXT WiFi Range Extender. An attacker can conduct a MITM EPSS 0.3%CVE-2018-5441—An Improper Validation of Integrity Check Value issue was discovered in PHOENIX CONTACT mGuard firmware versions 7.2 to 8.6.0. mGuard deviceEPSS 0.3%