CWE-345: Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- hickory-dns Hickory DNS before 0.26.0-beta.1 DNSSEC Validation Bypass via Non-IN Class Records 6.3 Medium
- hickory-dns Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC 8.7 High
- hickory-dns Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC3 8.7 High
- hickory-dns Hickory DNS through 0.26.0-alpha.1 DNSSEC NSEC Validation Bypass for Empty Non-Terminals 6.3 Medium
- hickory-dns Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Missing RFC 6840 Checks 8.2 High
- hickory-dns Hickory DNS 0.25.0 before 0.26.2 DNSSEC Validation Bypass via SOA Record 6.3 Medium
- hickory-dns Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Unrelated RRset 6.9 Medium
- apache software foundation james Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred No score
- fullworks quick event manager Quick Event Manager 9.9.5 - 9.18 - Unauthenticated PayPal IPN Verification Bypass via the 'debug' Parameter 5.3 Medium
- rustaurius order tracking Order Tracking < 3.6.0 - Unauthenticated Payment Confirmation Forgery via PayPal IPN Listener 5.3 Medium
- kubeflow pipelines Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user) 5.4 Medium
- pocket-id Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing 9.6 Critical
- watchguard authpoint authentication gateway WatchGuard AuthPoint Gateway Improper HMAC Validation in LDAP Authentication Callback Allows Forged Authentication Results 8.9 High
- coopcycle coopcycle-web CoopCycle coopcycle-web 5.6.0 before 6.20.0 Missing Zelty Webhook Signature Verification 8.3 High
- qihoo 360 d600-2, d603-2, d606-6 +3 more +5 more Qihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verify_sign signature verification 10.0 Critical
- emerson ovation Emerson Ovation Insufficient Verification of Data Authenticity 8.7 High
- robiningelbrecht dreeve Dreeve before 5.8.0 Missing Authentication in Strava Webhook POST Handler 6.9 Medium
- eupago gateway for woocommerce, unknown eupago gateway for woocommerce +1 more Eupago Gateway For Woocommerce 4.5.0 - 4.7.5 - Unauthenticated Payment Confirmation Bypass 5.3 Medium
- unknown cryptocloud CryptoCloud - Crypto Payment Gateway 3.0.0 - 3.0.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Webhook Secret 5.3 Medium
- petpooja munshi Munshi Payment Bypass via Unauthenticated Webhook Endpoint 8.7 High
- unknown payhere payment gateway PayHere Payment Gateway 2.4.0 - 2.4.5 - Unauthenticated Payment Bypass via Unverified Payment Notification 5.3 Medium
- http4k http4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body Integrity 8.2 High
- tryghost activitypub ActivityPub Undo handler can unfollow or remove reposts on behalf of other accounts 5.3 Medium
- zuke-build zuke Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gate 7.1 High
- juspay hyperswitch Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector 8.2 High
- red hat ceph storage 9, enterprise linux 10, enterprise linux 6 +7 more +9 more Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations 6.8 Medium
- apache software foundation kafka Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured 9.1 Critical
- apache software foundation kafka Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default 5.9 Medium
- juniper networks session smart conductor, session smart router +1 more Session Smart Router and Session Smart Conductor: Lack of integrity verification in cache files causes arbitrary code execution and privilege escalation 8.8 High
- unknown sadad qa payment Sadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation via Signature Bypass 5.3 Medium
- unknown bitpay gateway for woocommerce BitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass via Payment Return Handler 5.3 Medium
- mewebstudio pos mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks 8.7 High
- watchguard fireware os Fireware OS Missing Authentication in FireCluster State Sync Allows BOVPN Tunnel Denial of Service 6.0 Medium
- eclipse foundation keypont ML-KEM key-pair lookup can bind an unrelated or attacker-planted public key, exposing encapsulated shared secrets 5.5 Medium
- unknown paydunya woocommerce payment gateway PayDunya WooCommerce Payment Gateway 1.1.6 - Unauthenticated Order Payment Completion via Webhook Forgery 5.3 Medium
- damo academy videollama2 DAMO Academy VideoLLaMA2 Model Loading __init__.py load_pretrained_model integrity check 5.3 Medium
- python-social-auth social-core Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim 6.8 Medium
- rathena fluxcp rathena FluxCP PayPal IPN PaymentNotifyRequest.php verifyiprange origin validation 6.9 Medium
- unknown eurobank woocommerce payment gateway Eurobank WooCommerce Payment Gateway <= 2.1.1 - Unauthenticated Order Payment Forgery via Unverified Callback 5.3 Medium
- yoosee gm8135s camera Yoosee GM8135S Camera Secure Boot signature verification 9.3 Critical
- qodeinteractive qi addons for elementor Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget 2.4 Low
- gitroomhq postiz-app Forged signed tokens let any registered user take over other users and organizations 9.9 Critical
- craftcms commerce-mollie Unauthenticated payment reuse allows unpaid orders to be marked as paid 8.7 High
- intranda goobi-viewer-core Goobi viewer: OpenID JWT audience not enforced by the verifier 7.4 High
- unknown essential addons for elementor Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and Post Timeline Title Tag 3.5 Low
- berriai litellm LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key 9.9 Critical
- go-chi chi Chi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-For 6.3 Medium
- latepoint LatePoint < 5.7.5 - Unauthenticated Payment Bypass via 'payment_portion' Parameter 5.3 Medium
- mra13 simple shopping cart Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verification Bypass 2.7 Low
- mra13 simple shopping cart Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient 5.3 Medium
- Show olderLoading…