CWE-345: Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- wwbn avideoWWBN AVideo Authorization Bypass via Users_affiliations add.json.php7.1 High
- basekick-labs arcArc Enterprise cluster replication accepts unauthenticated MsgReplicateSync messages, enabling cluster-wide data injection from any TLS-trusted peer8.3 High
- basekick-labs arcArc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path-traversal worm primitive8.3 High
- syed balkhi charitableCharitable < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass5.3 Medium
- saad iqbal mycredmyCred < 3.2.5 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification in buyCRED5.3 Medium
- tektoncd pipelines-as-codePipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header8.2 High
- red hat advanced cluster management for kubernetes 2.16, advanced cluster management for kubernetes 2.17 +1 moreLighthouse: lighthouse: cross-cluster dns spoofing via unvalidated endpointslice ip addresses8.7 High
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.16, advanced cluster management for kubernetes 2.17 +2 moreSubmariner: submariner: missing validation of remote endpoint subnets and clusterid enables cross-cluster traffic hijack8.7 High
- dropbox samlyMissing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses7.6 High
- emqxEMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution6.6 Medium
- coturnCoturn: STUN attributes after MESSAGE-INTEGRITY are processed, letting on-path attackers modify authenticated TURN requests2.3 Low
- unitronix betterdeskBetterDesk has a replay behavior vulnerability when devices are deleted7.7 High
- notepad-plus-plusNotepad++: shortcuts.xml Macro HMAC Bypass Enables Conditional Elevated Command Execution5.4 Medium
- medplumMedplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage7.1 High
- kong inc. meshKong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier7.0 High
- jahlives openssl encryptopenssl_encrypt before 1.4.0 HMAC Authentication Bypass via Environment Variable9.3 Critical
- jahlives openssl encryptopenssl_encrypt before 1.4.0 Insecure Default Configuration8.7 High
- ondata ckan-mcp-serverCKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning6.5 Medium
- openchoreoOpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)5.3 Medium
- triggerdotdev trigger.devTrigger.dev: Cross-tenant payload poisoning via packet write + replay4.2 Medium
- rtcamp log in with googleWordPress Log in with Google plugin <= 1.4.2 - Broken Authentication vulnerability9.8 Critical
- postgresqlPostgreSQL pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext6.5 Medium
- nodejs undiciundici vulnerable to caching and replay of unsafe HTTP method responses3.7 Low
- jfrog artifactoryPotential package cache integrity issue in JFrog Artifactory8.1 High
- unknown estatik real estate pluginEstatik Real Estate Plugin < 4.3.4 - Unauthenticated Arbitrary-Recipient Mail Relay via Signed-Value Mismatch3.7 Low
- No product listedCPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to validate the integrity of the...8.4 High
- microsoft entra id, entra +1 moreAzure Entra ID Spoofing Vulnerability8.8 High
- No product listedInsufficient verification of data authenticity for some Intel(R) Trust Domain Extensions (Intel(R...5.6 Medium
- opensignlabs opensignOpenSignLabs OpenSign - Insufficient Verification of Data Authenticity7.5 High
- cyberpanelCyberPanel 2.4.3 Authenticated RCE via Remote Backup Feature8.7 High
- red hat multicluster global hub 1.4.9, multicluster global hub 1.5.8, multicluster global hub 1.6.6 +2 more +4 moreMulticluster-global-hub: multicluster-global-hub: manager trusts self-asserted evt.source() for leaf-hub identity in all status handlers8.5 High
- samsung smart switchInsufficient verification of data authenticity in Smart Switch trouble scanning mode prior to...4.7 Medium
- posimyth nexter blocksNexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection3.8 Low
- klever-io klever-goKlever-Go: PubKeysBitmap padding bits bypass the BLS signature quorum7.1 High
- aehrc pathlingPathling: $import-pnp operation enables authenticated SSRF, credential leakage, and warehouse data poisoning8.6 High
- unknown simple captcha with cloudflare turnstileSimple CAPTCHA with Cloudflare Turnstile < 1.42.0 - Unauthenticated Turnstile Protection Bypass via Reusable Forminator Cache Key5.3 Medium
- unknown subscriptions for woocommerceSubscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture Token5.9 Medium
- thimpress wp events managerWP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR5.3 Medium
- metagauss registrationmagicRegistrationMagic < 6.0.9.5 - Unauthenticated Payment Bypass via Amount-Blind PayPal Verification5.3 Medium
- rustaurius five star restaurant reservationsFive Star Restaurant Reservations < 2.7.23 - Unauthenticated Payment Bypass and Booking Confirmation via IDOR5.3 Medium
- unknown simple membershipSimple Membership < 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification5.3 Medium
- gitroomhq postiz-appInsufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions6.5 Medium
- ayecode ltd getpaidGetPaid < 2.8.55 - Unauthenticated Worldpay Payment Bypass via Insufficient IPN Verification5.9 Medium
- unknown wp travel engine, wp travel engine travel engine +1 moreWP Travel Engine < 6.8.2 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver and Amount Verification5.3 Medium
- thimpress wp hotel bookingWP Hotel Booking < 2.3.2 - Unauthenticated PayPal Payment Bypass5.3 Medium
- insta instaknxserviceappInsta InstaKNXServiceApp Firmware Update CreateWebClientAndDownloadFileList data authenticity6.3 Medium
- unknown formidable formsFormidable Forms < 6.32.1 - Unauthenticated Payment Bypass via PayPal APPROVAL_PENDING Subscription Status5.9 Medium
- unknown integrate phonepe with woocommerceIntegrate PhonePe with WooCommerce <= 1.2.1 - Unauthenticated Payment Bypass via Transaction ID Reuse7.5 High
- inspirythemes realhomes membershipsRealHomes Memberships < 3.1.0 - Subscriber+ Membership Payment Bypass4.3 Medium
- apache cxfApache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters9.1 Critical
- Show moreLoading…