CWE-345: Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- ciliumCilium NetworkPolicy bypass via pod labels7.6 High
- getcomposer composerComposer allows cache poisoning from other projects built on the same host8.8 High
- lf-edge, zededa eve os, linuxfoundation edge virtualization engine +1 moreRootfs Not Protected8.8 High
- contribsys sidekiqsidekiq Denial of Service vulnerability7.5 High
- cisco ios xr software, ios xr +1 moreA vulnerability in the iPXE boot function of Cisco IOS XR software could allow an authenticated,...6.7 Medium
- delinea secret serverInsufficient verification of data authenticity vulnerability in Delinea Secret Server9.1 Critical
- manageengine adselfservice plus, zohocorp manageengine adselfservice plus +1 moreManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability6.8 Medium
- ibm aspera faspexIBM Aspera Faspex security bypass5.3 Medium
- rarlab winrarRARLabs WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to...7.8 High
- audiocodes 405hd firmware, 445hd firmware, c450hd firmware +1 more +3 moreAn issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. The validation of...7.8 High
- zoom, zoom video communications, inc. desktop client for windows +1 moreInsufficient verification of data authenticity in Zoom Desktop Client for Windows before 5.14.5...8.0 High
- empoweridEmpowerID Multi-Factor Authentication Code information disclosure2.6 Low
- johnsoncontrols videoedgeVideoEdge config7.1 High
- codesys development systemCODESYS: Missing integrity check in CODESYS Development System8.8 High
- phpjabbers cleaning business softwareIn PHPJabbers Cleaning Business Software 1.0, lack of verification when changing an email address...9.8 Critical
- phpjabbers class scheduling systemIn PHP Jabbers Class Scheduling System 1.0, lack of verification when changing an email address...9.8 Critical
- f5 big-ip edge client, access policy manager clients, big-ip access policy manager +2 moreBIG-IP Edge Client for Windows and macOS vulnerability7.1 High
- certifi, certifi python-certifi, fedoraproject fedora +6 more +8 moreCertifi's removal of e-Tugra root certificate7.5 High
- bd alaris guardrails editor, becton dickinson & co bd alarisâ„¢ guardrailsâ„¢ editor +1 moreLack of Dataset Integrity Checking6.7 Medium
- bd alaris 8015 pcu firmware, becton dickinson & co bd alaris™ point-of-care unit (pcu) model 8015 +1 moreWireless Card Firmware Improperly Signed5.2 Medium
- honeywell c300, c300 firmware +1 moreController design flaw - unsigned firmware9.8 Critical
- linuxfoundation tekton pipelines, tektoncd pipeline +1 morePipelines do not validate child UIDs3.7 Low
- graylog, graylog2 graylog2-server +1 moreInsecure source port usage for DNS queries in Graylog3.7 Low
- cmscommander cms commander, thoefter cms commander – manage multiple sites +1 moreCMS Commander <= 2.287 - Authorization Bypass through Use of Insufficiently Unique Cryptographic Signature8.1 High
- ricoh printer driver packager nxThe driver installation package created by Printer Driver Packager NX v1.0.02 to v1.1.25 fails to...7.8 High
- brizy, themefusecom brizy – page builder +1 moreBrizy Page Builder <= 2.4.18 - IP Address Spoofing to Protection Mechanism Bypass3.7 Low
- advantech webaccess, webaccess/scada +1 moreAdvantech WebAccess Insufficient Type Distinction7.3 High
- hangzhou hopechart iot technology co., ltd. hqt401, hopechart hqt401 firmware +1 moreImproper backend communication allows access and manipulation of the telemetry data8.6 High
- wordappWordapp <= 1.6.0 - Authorization Bypass through Use of Insufficiently Unique Cryptographic Signature9.8 Critical
- snap one ovrc cloud, snapone orvc +1 moreSnap One OvrC Pro devices versions 7.2 and prior do not validate firmware...8.6 High
- jenkins saml single sign on, jenkins project saml single sign on(sso) plugin +1 moreJenkins SAML Single Sign On(SSO) Plugin missing hostname validation4.8 Medium
- apsystems alternergy power control softwareAltenergy Power Control Software C1.2.5 was discovered to contain a remote code execution (RCE)...7.2 High
- wpplugins hide my wp ghost, johndarrel wp ghost (hide my wp ghost) – security & firewall +1 moreHide My WP Ghost – Security Plugin <= 5.0.18 - IP Address Spoofing to Protection Mechanism Bypass6.5 Medium
- google android, unisoc (shanghai) technologies co., ltd. sc9863a/sc9832e/sc7731e/t610/t310/t606/t760/t610/t618/t606/t612/t616/t760/t770/t820/s8000 +1 moreIn modem, there is a possible missing verification of HashMME value in Security Mode Command....5.5 Medium
- ami megarac sp-xAMI MegaRAC SPx12 and SPx13 devices have Insufficient Verification of Data Authenticity.9.1 Critical
- blackvue dr750-2ch ir lte firmware, dr750-2ch lte firmware +1 moreBlackVue DR750-2CH LTE v.1.012_2022.10.26 does not employ authenticity check for uploaded...9.8 Critical
- pega synchronization engine, pegasystems rpa: synchronization engine +1 moreA man in the middle can redirect traffic to a malicious server in a compromised configuration.8.1 High
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be...4.5 Medium
- schneider electric igss data server(igssdataserver.exe), schneider-electric custom reports, igss dashboard +3 more +5 moreA CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server...8.8 High
- schneider electric igss data server(igssdataserver.exe), schneider-electric custom reports, igss dashboard +3 more +5 moreA CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server...6.5 Medium
- schneider electric igss data server(igssdataserver.exe), schneider-electric custom reports, igss dashboard +3 more +5 moreA CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server...6.5 Medium
- akuvox e11, e11 firmware +1 moreCVE-2023-03506.5 Medium
- google chromeInsufficient data validation in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote...6.5 Medium
- zerocoin libzerocoinZerocoin libzerocoin Proof CoinSpend.cpp CoinSpend data authenticity4.6 Medium
- goauthentik authentikInsufficient user check in FlowTokens by Email stage9.1 Critical
- keycloak, redhat openshift container platform, openshift container platform for ibm linuxone +2 more +4 moreKeycloak vulnerable to user impersonation via stolen UUID code5.0 Medium
- samsung android, samsung mobile routine +1 moreInsufficient Verification of Data Authenticity vulnerability in Routine prior to versions 2.6.30...7.4 High
- shopware swagpaypalSwagPayPal payment not sent to PayPal correctly7.5 High
- openzeppelin contracts, cairo-contracts +1 moreOpenZeppelin Contracts for Cairo is vulnerable to signature validation bypass6.4 Medium
- snap one wattbox wb-300-ip-3, snapav wattbox wb-300-ip-3 firmware +1 moreSnap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior use a proprietary local area network ...6.7 Medium
- Show moreLoading…