CWE-345: Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- huawei ar120-s firmware, ar1200-s firmware, ar1200 firmware +15 more +17 moreSome Huawei products have an insufficient verification of data authenticity vulnerability. A...5.9 Medium
- openstack python-keystoneclient, debian linux, redhat openstack +2 moreInsufficient Verification of Data Authenticity in python-keystoneclient9.8 Critical
- cisco email security appliance (esa), email security appliance firmware +1 moreCisco Email Security Appliance MP3 Content Filter Bypass Vulnerability5.8 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, qualcomm apq8009 firmware, apq8017 firmware +53 more +55 moreLack of integrity check allows MODEM to accept any NAS messages which can result into...9.8 Critical
- huawei elle-al00b, elle-al00b firmware +1 moreSmartphones with software of ELLE-AL00B 9.1.0.109(C00E106R1P21), 9.1.0.113(C00E110R1P21), 9.1.0...6.2 Medium
- huawei p30, p30 firmware +1 moreP30 smartphones with versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1) have an insufficient...6.2 Medium
- matrix synapseImproper Verification of Cryptographic Signature in matrix-synapse9.8 Critical
- adobe systems incorporated magento 2, magento +1 moreMagento 2 Community Edition Insufficient Logging4.9 Medium
- adobe systems incorporated magento 2, magento +1 moreMagento 2 Community Edition Security Bypass7.5 High
- mikrotik routeros, tenable mikrotik routeros +1 moreRouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below are vulnerable to a DNS unrelated...7.5 High
- isc bind, bind 9 +1 moreA flaw in mirror zone validity checking can allow zone data to be spoofed5.9 Medium
- sap process integration, sap se process integration, business-to-business add-on +1 moreIn SAP NetWeaver Process Integration (AS2 Adapter), before versions 1.0 and 2.0, the attacker is...5.3 Medium
- tcpdump libpcaprpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platforms provides details about why...5.3 Medium
- qualcomm, inc. snapdragon auto, snapdragon mobile, snapdragon wearables, qualcomm mdm9607 firmware, msm8909w firmware +16 more +18 moreBoot image not getting verified by AVB in Snapdragon Auto, Snapdragon Mobile, Snapdragon...7.8 High
- keeper k5 firmwareOn Keeper K5 20.1.0.25 and 20.1.0.63 devices, remote code execution can occur by inserting an SD...6.8 Medium
- cisco hyperflex hx-series, hyperflex hx220c af m5 firmware, hyperflex hx220c edge m5 firmware +3 more +5 moreCisco HyperFlex Software Counter Value Injection Vulnerability5.3 Medium
- mozilla firefoxIf a wildcard ('*') is specified for the host in Content Security Policy (CSP) directives, any...5.3 Medium
- amd zu11eg firmware, zu15eg firmware, zu17eg firmware +38 more +40 moreA weakness was found in Encrypt Only boot mode in Zynq UltraScale+ devices. This could lead to an...5.5 Medium
- fortinet fortimanagerLack of root file system integrity checking in Fortinet FortiManager VM application images of all...9.8 Critical
- siemens simatic drive controller family, simatic et 200sp open controller cpu 1515sp pc (incl. siplus variants), simatic et 200sp open controller cpu 1515sp pc2 (incl. siplus variants) +15 more +17 moreA vulnerability has been identified in SIMATIC ET 200SP Open Controller CPU 1515SP PC (All...7.5 High
- icedtea icedtea-web, debian linux, opensuse leap +2 moreIt was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be...6.3 Medium
- auth0 passport-sharepointAuth0 Passport-SharePoint does not validate JWT signature7.3 High
- hunesion i-onenetHunesion i-oneNet Missing Support for Integrity Check vulnerability7.8 High
- cisco advanced malware protection for endpoints, amp for endpoints +1 moreCisco Advanced Malware Protection for Endpoints Windows Command Injection Vulnerability6.7 Medium
- keycloak, redhat single sign-on +1 moreImproper Certificate Validation and Insufficient Verification of Data Authenticity in Keycloak6.5 Medium
- keycloak, redhat single sign-on +1 moreForced Logout in keycloak-connect4.7 Medium
- inateck wp2002 firmwareDue to unencrypted and unauthenticated data communication, the wireless presenter Inateck WP2002...8.8 High
upmergenpmPrototype Pollution in upmerge7.5 High- cisco unified computing system (managed), unified computing system server firmware +1 moreCisco Unified Computing System BIOS Signature Bypass Vulnerability4.4 Medium
- fortinet fortiosLack of root file system integrity checking in Fortinet FortiOS VM application images all...6.5 Medium
- twitter kit for ios, kit +1 moreThis vulnerability was caused by an incomplete fix to CVE-2017-0911. Twitter Kit for iOS versions...5.4 Medium
- cloud foundry bosh backup and restoreBBR could run arbitrary scripts on deployment VMs7.7 High
- kofax front office serverIn Kofax Front Office Server Administration Console 4.1.1.11.0.5212, some fields, such as...4.9 Medium
- jfrog artifactoryJFrog Artifactory Pro 6.5.9 has Incorrect Access Control.9.8 Critical
- freeradius, canonical ubuntu linux, fedoraproject fedora +7 more +9 moreFreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is...9.8 Critical
- microsoft windows, windows server, windows 10 +7 more +9 moreAn elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV...7.8 High
- sophos ipsec client, ncp-e ncp secure entry client +1 moreThe Sophos UTM VPN endpoint interacts with client software provided by NPC Engineering (www.ncp-e...8.1 High
- hospira plum a+ infusion system, plum a+3 infusion system, symbiq infusion system +3 more +5 moreHospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and...9.8 Critical
- cisco hyperflex hx-series, hyperflex hx data platform +1 moreCisco HyperFlex Arbitrary Statistics Write Vulnerability4.0 Medium
- hex coreHex authenticity of signed packages not validated8.8 High
- hexHex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in...8.8 High
- logmxGUP (generic update process) in LightySoft LogMX before 7.4.0 does not properly verify the...7.5 High
- defaults-deep project defaults-deepPrototype Pollution in defaults-deep9.8 Critical
- powerdns recursor, power dns pdns-recursor +1 moreAn issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the...3.7 Low
- spring security, vmware spring framework +1 moreAuthorization Bypass During JWT Issuer Validation with spring-security3.3 Low
- schneider electric se modicon m221, all versions, schneider-electric somachine basic +1 moreA Insufficient Verification of Data Authenticity (CWE-345) vulnerability exists in the Modicon...8.2 High
- synacor zimbra collaboration suiteZimbra Collaboration before 8.8.10 GA allows text content spoofing via a loginErrorCode value.5.3 Medium
- medtronic 24950 mycarelink monitor, 24952 mycarelink monitor, mycarelink 24950 patient monitor firmware +1 more +3 moreMedtronic MyCareLink 24950 Patient Monitor Insufficient Verification of Data Authenticity4.4 Medium
- keycloak, redhat single sign-on +1 moreKeycloak Authentication Error5.4 Medium
- open shortest path first (ospf) protocol, quagga, suse opensuse +2 more +4 moreOpen Shortest Path First (OSPF) protocol implementations may improperly determine LSA recency in affected Quagga and downstream implementations (SUSE, openSUSE, and Red Hat packages)8.2 High
- Show moreLoading…