Weaknesses of type CWE-924

24 results

Falta de integridade na mensagem durante transmissão

É quando dados são transmitidos entre sistemas sem mecanismos que garantam que a mensagem não foi alterada ou corrompida no caminho. Um atacante pode interceptar, modificar e reenviar a mensagem sem que o receptor detecte a manipulação, comprometendo a confiabilidade da comunicação.

Example

Um servidor envia instruções de configuração para um dispositivo IoT via HTTP sem assinatura digital. Um atacante na mesma rede modifica a instrução para desabilitar autenticação, e o dispositivo aceita como legítimo porque não há verificação de integridade.

How to mitigate

Use mecanismos criptográficos para garantir integridade: HTTPS com certificados válidos, assinatura digital de mensagens, ou HMAC. Para APIs críticas, implemente também compressão com hash verificado e considere pinning de certificado em clientes móveis.

CVE-2021-21390MEDIUMMITM modification of request bodies in MinIOEPSS 0.9%CVE-2022-3166HIGHMicroLogix 1100 & 1400 Product Web Server Application Vulnerable to Denial-Of-Service Condition AttackEPSS 0.7%CVE-2021-34793HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Transparent Mode Denial of Service VulnerabilityEPSS 0.6%CVE-2021-3716—A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary. A MitM attacker could use tEPSS 0.6%CVE-2024-43450HIGHWindows DNS Spoofing VulnerabilityEPSS 0.6%CVE-2023-3347MEDIUMSamba: smb2 packet signing is not enforced when "server signing = required" is setEPSS 0.4%CVE-2024-44730CRITICALIncorrect access control in the function handleDataChannelChat(dataMessage) of Mirotalk before commit c21d58 allows attackers to forge chat EPSS 0.4%CVE-2021-41034—The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint. As a consequence EPSS 0.4%CVE-2025-0592HIGHSICK Lector8xx and InspectorP8xx vulnerable for code executionEPSS 0.3%CVE-2020-10635MEDIUMICSA-20-098-05 KUKA.Sim Pro Improper Enforcement of Message Integrity During Transmission in a Communication ChannelEPSS 0.3%CVE-2023-6408HIGH CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause a dEPSS 0.3%CVE-2023-2885HIGHChannel Accessible by Non-Endpoint in CBOT's ChatbotEPSS 0.3%CVE-2024-8933HIGHCWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause retrEPSS 0.3%CVE-2025-29628CRITICALA Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware before master.619, Home EPSS 0.3%CVE-2023-22372MEDIUMBIG-IP Edge Client for Windows and Mac OS vulnerabilityEPSS 0.2%CVE-2024-39229MEDIUMAn issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X3EPSS 0.2%CVE-2024-12399MEDIUMCWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause partEPSS 0.2%CVE-2026-12576HIGHDVP80ES3 Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerabilityEPSS 0.2%CVE-2023-30565LOW CQI Data Sniffing EPSS 0.1%CVE-2026-54891MEDIUMPlaintext APPLICATION_DATA injected during TLS handshake delivered to client application post-handshake in sslEPSS 0.1%