CWE-345: Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- critical moments cmsaasstarterCMSaasStarter: JWT Token Not Verified on Server Session6.5 Medium
- netgear rax30, rax30 firmware +1 moreNETGEAR RAX30 lighttpd Misconfiguration Remote Code Execution Vulnerability7.5 High
- silabs z\/ip gateway sdk, silabs.com z/ip gateway sdk +1 moreZ/IP Gateway Device Reset Locally Denial of Service Vulnerability7.5 High
- red hat jboss enterprise application platform 7, jboss enterprise application platform 8, jboss enterprise application platform 8.0 for rhel 8 +2 more +4 moreEap: oidc app attempting to access the second tenant, the user should be prompted to log7.3 High
- huawei emui, harmonyos +1 moreVulnerability of package name verification being bypassed in the Calendar app. Impact: Successful...7.5 High
- ays pro survey makerInsufficient verification of data authenticity issue in Survey Maker prior to 3.6.4 allows a...5.3 Medium
- kindspells astro-shieldIn Astro-Shield, setting a correct `integrity` attribute to injected code allows to bypass the allow-lists7.5 High
- kilbot wcpos – point of sale (pos) plugin for woocommerceWooCommerce POS <= 1.4.11 - Insufficient Verification of Data Authenticity to Authenticated (Customer+) Information Disclosure4.3 Medium
- unitronics unilogic, unistream unilogic +1 moreUnitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-348: Use of Less Trusted Source8.8 High
- pinterest querybookCross-site websocket hijacking in Querybook5.6 Medium
- metagauss eventprime, eventprime – events calendar, bookings and tickets +1 moreEventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Unauthenticated Booking Payment Bypass5.3 Medium
- aio-libs aiosmtpdSMTP smuggling in aiosmtpd5.3 Medium
- silabs.com pc controller, silabs z-wave pc-based controller +1 moreSilicon Labs PC Controller Denial of Service Vulnerability6.5 Medium
- mozilla firefoxThe `fetch()` API and navigation incorrectly shared the same cache, as the cache key did not...9.8 Critical
- amd alveo u200 firmware, alveo u250 firmware, alveo u280 firmware +50 more +52 moreInsufficient verification of data authenticity in the configuration state machine may allow a...3.3 Low
- ibm security verify access appliance, security verify access docker, security verify access +2 moreIBM Security Access Manager Container improper file validation6.2 Medium
- mobyMoby classic builder cache poisoning6.9 Medium
- huawei emui, harmonyos +1 moreVulnerability of trust relationships being inaccurate in distributed scenarios. Successful...7.5 High
- gitlabImproper Verification of Cryptographic Signature in GitLab3.5 Low
- exim, debian linux, fedoraproject extra packages for enterprise linux +1 more +3 moreExim through 4.97 allows SMTP smuggling in certain configurations. Remote attackers can use a...5.3 Medium
- sendmail, freebsd, redhat enterprise linux +2 moresendmail through at least 8.14.7 allows SMTP smuggling in certain configurations. Remote...5.3 Medium
- postfix, fedoraproject fedora, redhat enterprise linux +2 morePostfix through 3.8.4 allows SMTP smuggling unless configured with smtpd_data_restrictions...5.3 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode...6.3 Medium
asyncsshPyPIAsyncSSH vulnerable to Prefix Truncation Attack (a.k.a. Terrapin Attack) against ChaCha20-Poly1305 and Encrypt-then-MAC5.9 Medium- 9bis kitty, apache sshd, sshj +68 more +70 morePrefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin5.9 Medium
- google chromeInsufficient data validation in Updater in Google Chrome prior to 120.0.6099.62 allowed a remote...8.8 High
- github.com/mojocn/base64captcha, mojotv base64captcha +1 moreCaptcha verification bypass in github.com/mojocn/base64Captcha5.3 Medium
- electronASAR Integrity bypass via filetype confusion in electron6.1 Medium
- simplesamlphp xml-security, saml2 +1 moreValidation of SignedInfo6.8 Medium
- joaquimserafim json-web-token, json web token +1 moreJWT Algorithm Confusion in json-web-token library7.5 High
- vantage6vantage6 Node accepts non-whitelisted algorithms from malicious server7.2 High
- kyvernoAttacker can cause Kyverno user to unintentionally consume insecure image7.1 High
- kyvernoDenial of service from malicious signature in kyverno6.1 Medium
- hanwha vision co., ltd. pnv-a6081r, hanwhavision pno-a6081r-e1t firmware, pno-a6081r-e2t firmware +1 more +3 moreCommand injection via wave install file7.2 High
- moodle, fedoraproject extra packages for enterprise linux, fedora +2 moreMoodle: cache poisoning risk with endpoint revision numbers3.3 Low
- asyncssh project asyncsshAsyncSSH Rogue Session Attack6.8 Medium
- asyncssh project asyncsshAsyncSSH Rogue Extension Negotiation5.9 Medium
- mitsubishi electric corporation melsec iq-f series fx5-40ssc-g, melsec iq-f series fx5-40ssc-s, melsec iq-f series fx5-80ssc-g +496 more +498 moreArbitrary Command Execution Vulnerability in Mitsubishi Electric proprietary protocol communication of multiple FA products10.0 Critical
- google chrome, debian linux, fedoraproject fedora +2 moreInsufficient data validation in USB in Google Chrome prior to 119.0.6045.105 allowed a remote...8.8 High
- home-assistant core, home-assistant, home-assistant home-assistant-js-websocket +2 moreFake websocket server installation permits full takeover in Home Assistant Core7.1 High
- home-assistant home assistant companion, core +1 moreArbitrary URL load in Android WebView in `MyActivity.kt` in Home Assistant Companion for Android8.6 High
- arduino create agent, arduino-create-agent +1 moreInsufficient Verification of Data Authenticity in Arduino Create Agent7.3 High
- nodejs node, node.js, fedoraproject fedora +2 moreWhen the Node.js policy feature checks the integrity of a resource against a trusted manifest,...7.5 High
- apache inlongApache InLong: General user Unauthorized access User Management6.5 Medium
- netty, red hat cryostat 4 on rhel 9, openshift serverless +28 more +30 moreNetty has Insufficient Bailiwick Validation for NS Records8.7 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +28 more +30 moreNetty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records8.7 High
- fortinet fortianalyzer, fortianalyzer-bigdata, fortimanager +2 moreA insufficient verification of data authenticity vulnerability [CWE-345] in FortiAnalyzer version...5.0 Medium
- f5 big-ip edge client, access policy manager clients, big-ip access policy manager +2 moreBIG-IP Edge Client for macOS vulnerability7.3 High
- openvswitch, fedora, red hat fast datapath for rhel 7 +12 more +14 moreOpenvswitch don't match packets on nd_target field7.1 High
- gitlabIncorrect Authorization in GitLab4.3 Medium
- Show moreLoading…