CWE-345: Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- unknown payment gateway for telcellPayment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret5.3 Medium
- vllmvLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID7.1 High
- oracle business intelligence, oracle corporation business intelligence enterprise edition +1 moreVulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics ...6.5 Medium
- oracle solarisVulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System)...3.1 Low
- google chromeUse after free in Variations in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- tox-dev filelockfilelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker4.7 Medium
- advantech adam-3600A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to...8.6 High
- langbot-app langbotLangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verification8.3 High
- blackbelttechnology pi-agent-dashboardBlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validation5.3 Medium
- mobatek mobaxtermLack of integrity checks in Mobatek’s MobaXterm8.5 High
- unknown ipospays payment gateway for woocommerceiPOSpays Payment Gateway for WooCommerce < 1.4.7 - Unauthenticated Payment Confirmation Forgery5.3 Medium
- dan rossiter document galleryDocument Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber Webhook Signature Bypass5.3 Medium
- unknown coinbase commerce payment gateway for woocommerceCoinbase Commerce Payment Gateway for WooCommerce <= 1.4.1 - Unauthenticated Webhook Signature Bypass via Empty-Default Webhook Shared Secret5.3 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +3 more +5 moreBootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization7.4 High
- ondata ckan-mcp-serverCKAN MCP Server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)3.1 Low
- sgl-project sglangSGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /generate6.3 Medium
- ivanti connect secureIvanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache...7.0 High
- authlib joserfcjoserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json9.1 Critical
- discourse discourse-activity-pubDiscourse ActivityPub: Fix inbound actor validation and apply outbound request SSRF hardening8.6 High
- unknown rede itaú for woocommerceRede Itaú for WooCommerce 3.7.1 - 5.5.2 - Unauthenticated Order Status Manipulation via maxiPago Debit Webhook5.3 Medium
- unknown rede itaú for woocommerceRede Itaú for WooCommerce < 5.5.3 - Unauthenticated Order Status Manipulation via 3DS Failure Webhook5.3 Medium
- unknown cardinity payment gateway for woocommerceCardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Project Secret5.3 Medium
- better-authBetter Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy9.1 Critical
- error311 fileriseFileRise OIDC login can bind an attacker identity to an existing local account8.1 High
- pipecat-ai pipecatPipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation5.6 Medium
- giteaGitea required Actions check bypass through skipped workflows6.5 Medium
- bizspring shop, java mall +1 moreBizSpring Shop through commit cf22d39daaf1 Payment Bypass via test_post_pay Endpoint7.1 High
- tickeraTickera < 3.6.0.4 - Unauthenticated Order Payment Bypass via 2Checkout IPN5.3 Medium
- unknown wpforms lite, wpforms lite +1 moreWPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal Commerce5.3 Medium
- unknown visma pay for woocommerceVisma Pay for WooCommerce < 1.2.2 - Unauthenticated Payment Bypass and Order Data Disclosure via Gateway Return Endpoint6.5 Medium
- sunshinephotocart sunshine photo cartSunshine Photo Cart < 3.7.4 - Unauthenticated Content Injection via sunshine_modal_add_comment()5.3 Medium
- unknown ltl freight quotesLTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored HTML Injection via Checkout Error Message5.3 Medium
- schneider electric sage rtu 1410, sage rtu 1430, sage rtu 1450 +3 more +5 moreCWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow...8.6 High
- d-link dcs-930lD-Link DCS-930L Emergency HTTP Recovery Server bootloader_region.bin mpfd_decode signature verification9.4 Critical
- codefori vscode-ibmiCode for IBMi: Uses IBM i components with blind check allowing arbitrary code execution8.9 High
- zcashfoundation zebraZebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies6.3 Medium
- edgelesssys contrastContrast 1.8.0 before 1.24.1 Mesh CA Key Cross-Manifest Exposure via Peer Recovery8.7 High
- instantsoft icms2InstantSoft icms2 Billing paypal.php validatePaypalOrder data authenticity5.3 Medium
- narinder singh pay with metamask for woocommerce – cryptocurrency payment gatewayWordPress Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway plugin <= 1.7.2 - Bypass Vulnerability vulnerability5.3 Medium
- go-vikunja vikunjaVikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover7.5 High
- jexactylJexactyl: Stripe checkout confirmation accepts mismatched-currency/amount payments as full payment (payment forgery)7.1 High
- ibm datapower gateway 10.5.0, datapower gateway, datapower gateway 10.6.0 +2 more +4 moreIBM DataPower Gateway Insufficient Verification of Data Authenticity6.5 Medium
- unknown airwallex online payments gatewayAirwallex Online Payments Gateway < 1.36.0 - Unauthenticated Payment Bypass via Forged Webhook5.3 Medium
- asynchttpclient async-http-clientAsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check3.7 Low
- hashicorp vault, vault enterprise +1 moreVault PKI ACME Issues Certificate With Unvalidated SANs5.9 Medium
- manacle technologies multi-tenant erp systemAccount Takeover Vulnerability in Manacle Technologies ERP System9.3 Critical
- unknown nexi xpay buildNexi XPay Build <= 7.6.2 - Unauthenticated Payment Bypass via NPG Notification Handler7.5 High
- wolfsshwolfSSH ECDSA host key curve not validated against negotiated algorithm9.0 Critical
- modelcontextprotocol typescript-sdkMCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server7.5 High
- cloud foundry uaa, cf-deployment +1 moreSelf-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions6.5 Medium
- Show moreLoading…