Falhas do tipo CWE-354

151 resultados

Validação inadequada de valor de verificação de integridade

É quando o código não valida corretamente (ou não valida de jeito nenhum) checksums, hashes ou assinaturas criptográficas que devem garantir que dados não foram modificados. Sem essa validação, um atacante consegue alterar dados em trânsito ou em repouso sem ser detectado.

Exemplo

Um sistema baixa um arquivo com um hash SHA-256 fornecido pelo servidor, mas calcula o hash local de forma errada, compara apenas os primeiros 8 caracteres em vez dos 64, ou sequer verifica se o resultado bate. O atacante altera o arquivo durante o download e ninguém percebe.

Como mitigar

Sempre calcular o hash/checksum completo do dado recebido e comparar byte-a-byte com o valor esperado. Use funções criptográficas estabelecidas (SHA-256 ou superior), nunca invente sua própria lógica de validação, e lance exceção se a verificação falhar. Para dados críticos, considere assinatura criptográfica em vez de apenas hash.

CVE-2024-23462LOWZCC Mac validinstaller file integrity check missingEPSS 0.2%CVE-2024-56169MEDIUMA validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI Relying Parties (such as Fort) are supposed to maintainEPSS 0.2%CVE-2026-26275HIGHhttpsig-hyper has Improper Digest Verification that May Allow Message Integrity BypassEPSS 0.2%CVE-2024-51141HIGHAn issue in TOTOLINK Bluetooth Wireless Adapter A600UB allows a local attacker to execute arbitrary code via the WifiAutoInstallDriver.exe aEPSS 0.2%CVE-2026-50128MEDIUMMastodon: Spoofing of attribution domainsEPSS 0.2%CVE-2026-50021MEDIUMpnpm: Integrity Check Bypass via Missing Lockfile Integrity FieldEPSS 0.2%CVE-2026-107846CRITICALbitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction listEPSS 0.2%CVE-2021-41206HIGHIncomplete validation of shapes in multiple TF opsEPSS 0.2%CVE-2025-61480HIGHAn issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial ofEPSS 0.2%CVE-2026-12816HIGHIESEngine stream-mode MAC forgery via length-dependent KDF splitEPSS 0.2%CVE-2025-24148MEDIUMThis issue was addressed with improved handling of executable types. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS VEPSS 0.2%CVE-2026-48028MEDIUMMastodon: Removal of integrity-protected JSON entries from signed activitiesEPSS 0.2%CVE-2026-31719HIGHcrypto: krb5enc - fix async decrypt skipping hash verificationEPSS 0.2%CVE-2026-32105CRITICALxrdp: RDP MAC signature (dataSignature) never verified on receive — integrity bypass in non-TLS modeEPSS 0.2%CVE-2026-89320HIGHHmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrityEPSS 0.2%CVE-2023-28002MEDIUMAn improper validation of integrity check value vulnerability [CWE-354] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.12, 6.4 all versioEPSS 0.2%CVE-2026-73459HIGHSecurity Advisory 0160EPSS 0.2%CVE-2025-11694HIGHRockwell Automation CompactLogix 5370 Controllers – Multiple VulnerabilitiesEPSS 0.2%CVE-2026-12817HIGHOpenPGP AEAD decryption skips final tag on chunk-aligned dataEPSS 0.2%CVE-2026-93318HIGHCache poisoning via unvalidated image layer DiffIDsEPSS 0.2%