Falhas do tipo CWE-354

120 resultados

Validação inadequada de valor de verificação de integridade

É quando o código não valida corretamente (ou não valida de jeito nenhum) checksums, hashes ou assinaturas criptográficas que devem garantir que dados não foram modificados. Sem essa validação, um atacante consegue alterar dados em trânsito ou em repouso sem ser detectado.

Exemplo

Um sistema baixa um arquivo com um hash SHA-256 fornecido pelo servidor, mas calcula o hash local de forma errada, compara apenas os primeiros 8 caracteres em vez dos 64, ou sequer verifica se o resultado bate. O atacante altera o arquivo durante o download e ninguém percebe.

Como mitigar

Sempre calcular o hash/checksum completo do dado recebido e comparar byte-a-byte com o valor esperado. Use funções criptográficas estabelecidas (SHA-256 ou superior), nunca invente sua própria lógica de validação, e lance exceção se a verificação falhar. Para dados críticos, considere assinatura criptográfica em vez de apenas hash.

CVE-2022-45191MEDIUMAn issue was discovered on Microchip RN4870 1.43 devices. An attacker within BLE radio range can cause a denial of service by sending a pairEPSS 0.2%CVE-2025-11543CRITICALImproper Validation of Integrity Check Value vulnerability in Sharp Display Solutions projectors allows a attacker may create and run unauthEPSS 0.2%CVE-2026-75625CRITICALKraken Agents Peer-to-Peer Download Cache Poisoning via Digest Verification BypassEPSS 0.2%CVE-2026-40323HIGHSP1 V6 Recursion Circuit Row-Count Binding GapEPSS 0.2%CVE-2025-25183LOWvLLM using built-in hash() from Python 3.12 leads to predictable hash collisions in vLLM prefix cacheEPSS 0.2%CVE-2026-32148HIGHLockfile checksums not verified in Hex allows dependency integrity bypassEPSS 0.2%CVE-2024-23462LOWZCC Mac validinstaller file integrity check missingEPSS 0.2%CVE-2026-16317HIGHSilent Drop of TLS 1.3 Encrypted Records in s2n-tlsEPSS 0.2%CVE-2026-82549MEDIUMLinux Foundation Magma SecurityModeComplete integrity checkEPSS 0.2%CVE-2024-51141HIGHAn issue in TOTOLINK Bluetooth Wireless Adapter A600UB allows a local attacker to execute arbitrary code via the WifiAutoInstallDriver.exe aEPSS 0.2%CVE-2026-50128MEDIUMMastodon: Spoofing of attribution domainsEPSS 0.2%CVE-2026-50021MEDIUMpnpm: Integrity Check Bypass via Missing Lockfile Integrity FieldEPSS 0.2%CVE-2021-41206HIGHIncomplete validation of shapes in multiple TF opsEPSS 0.2%CVE-2024-56169MEDIUMA validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI Relying Parties (such as Fort) are supposed to maintainEPSS 0.2%CVE-2026-48028MEDIUMMastodon: Removal of integrity-protected JSON entries from signed activitiesEPSS 0.2%CVE-2026-32105CRITICALxrdp: RDP MAC signature (dataSignature) never verified on receive — integrity bypass in non-TLS modeEPSS 0.2%CVE-2025-24148MEDIUMThis issue was addressed with improved handling of executable types. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS VEPSS 0.2%CVE-2023-28002MEDIUMAn improper validation of integrity check value vulnerability [CWE-354] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.12, 6.4 all versioEPSS 0.2%CVE-2025-11694HIGHRockwell Automation CompactLogix 5370 Controllers – Multiple VulnerabilitiesEPSS 0.2%CVE-2026-12803HIGHKCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery)EPSS 0.2%