CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- simple password store project password storeAn issue was discovered in password-store.sh in pass in Simple Password Store 1.7.x before 1.7.2....9.8 Critical
- enigmailThe signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control...7.5 High
- carbonblack carbon black cbAn issue was discovered in Carbon Black Cb Response. A maliciously crafted Universal/fat binary...5.5 Medium
- objective development software gmbh little snitchLittle Snitch versions 4.0 to 4.0.6 use the SecStaticCodeCheckValidityWithErrors() function...5.3 Medium
- joyent http-signature, hackerone http-signature node module +1 moreHeader Forgery in http-signature7.5 High
- bouncycastle bc-java, debian linux +1 moreIn Bouncy Castle JCE Provider ECDSA does not fully validate ASN.1 encoding of signature on verification7.5 High
- hyperledger irohaHyperledger Iroha versions v1.0_beta and v1.0.0_beta-1 are vulnerable to transaction and block...7.5 High
- bouncycastle legion-of-the-bouncy-castle-java-crytography-api, canonical ubuntu linux, netapp 7-mode transition tool +2 more +4 moreIn Bouncy Castle JCE Provider it is possible to inject extra elements in the sequence making up the signature and still have it validate7.5 High
- mcafee data loss prevention (dlp) endpoint, data loss prevention endpoint +1 moreSB10233 - Data Loss Prevention (DLP) Endpoint before 10.0.500 and DLP Endpoint before 11.0.400 - Application Protections Bypass vulnerability5.8 Medium
- qualcomm mdm9206 firmware, mdm9607 firmware, mdm9650 firmware +26 more +28 moreIn Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon...9.8 Critical
- apple mac os xAn issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue...5.9 Medium
- docker notaryDocker Notary Signature Algorithm Not Matched to Key vulnerability7.5 High
- rubygems, debian linux +1 moreRubyGems Improper Verification of Cryptographic Signature vulnerability9.8 Critical
- simplesamlphp saml2, simplesamlphp, debian linux +2 moreSimpleSAMLphp saml2 incorrect signature validation8.1 High
- simplesamlphpSimpleSAMLphp Improper Verification of Cryptographic Signature7.5 High
- shibboleth xmltooling-c, arubanetworks clearpass, debian linux +2 moreShibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on...6.5 Medium
- strongswanThe rsa_pss_params_parse function in libstrongswan/credentials/keys/signature_params.c in...5.3 Medium
- apache jmeterMissing certificate validation in Apache JMeter9.8 Critical
- simplesamlphp, debian linux +1 moreSimpleSAMLphp Signature validation bypass8.1 High
- powerdns, powerdns recursor +1 moreAn issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up...5.9 Medium
- shibboleth xmltooling-c, debian linux +1 moreShibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on...6.5 Medium
- cisco node-joseCisco node-jose improper validation of JWT signature7.5 High
- samlify project samlifySamlify vulnerable to Authentication Bypass by allowing tokens to be reused with different usernames7.5 High
- enigmail, debian linux +1 moreAn issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature...7.5 High
- enigmail, debian linux +1 moreAn issue was discovered in Enigmail before 1.9.9. Signature spoofing is possible because the UI...7.5 High
- cisco nx-os, unified computing system +1 moreA vulnerability in Cisco NX-OS System Software could allow an authenticated, local attacker to...6.7 Medium
- cisco nx-os, unified computing system +1 moreA vulnerability in Cisco NX-OS System Software could allow an authenticated, local attacker to...6.7 Medium
- huawei fusionsphere openstackFusionSphere OpenStack V100R006C00SPC102(NFV)has an improper verification of cryptographic...6.7 Medium
- huawei hiwalletHuawei APP HiWallet earlier than 5.0.3.100 versions do not support signature verification for APK...5.3 Medium
- belden tofino xenon security appliance firmwareAn issue has been discovered on the Belden Hirschmann Tofino Xenon Security Appliance before 03.2...6.8 Medium
- shibboleth opensaml, debian linux +1 moreThe DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in...8.1 High
- shibboleth service provider, debian linux +1 moreshibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth...8.1 High
- akeo rufusAkeo Consulting Rufus prior to version 2.17.1187 does not adequately validate the integrity of...5.3 Medium
- connect2id nimbus jose\+jwtImproper Verification of Cryptographic Signature in Nimbus JOSE+JWT7.5 High
- xoev osci transport librarySignature Wrapping exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java)...6.5 Medium
- google android, qualcomm, inc. all qualcomm products +1 moreA PKCS#1 v1.5 signature verification routine in all Android releases from CAF using the Linux...7.8 High
- google chrome, redhat enterprise linux desktop, enterprise linux server +1 more +3 moreInsufficient consistency checks in signature handling in the networking stack in Google Chrome...6.5 Medium
- apple iphone os, mac os x +1 moreAn issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10...9.8 Critical
- intel virusscan enterprise linux (vsel), mcafee virusscan enterprise +1 moreImproper verification of cryptographic signature vulnerability in Intel Security VirusScan...5.0 Medium
- openelecThe auto-update feature of Open Embedded Linux Entertainment Center (OpenELEC) 6.0.3, 7.0.1, and...8.1 High
- linux kernel, embysupport security +1 moreIt was discovered in the Linux kernel before 4.11-rc8 that root can gain direct access to an...4.4 Medium
- hyperHTTPS MitM vulnerability due to lack of hostname verification4.8 Medium
- python rsa, fedoraproject fedora, opensuse leap +1 more +3 morePython RSA allows attackers to spoof signatures5.3 Medium
- apache httpasyncclient, httpclient +1 moreImproper Verification of Cryptographic Signature in org.apache.httpcomponents:httpclient5.8 Medium
- urbanairship python-oauth2SimpleGeo python-oauth2 does not check the nonce allowing replay attacks4.3 Medium
- mozilla firefox, seamonkey, opensuse +4 more +6 moreThe crypto.generateCRMFRequest method in Mozilla Firefox before 28.0 and SeaMonkey before 2.25...5.0 Medium
- microsoft winverifytrust function, windows 10 version 1507, windows 10 version 1607 +42 more +44 moreWinVerifyTrust Signature Validation Vulnerability5.5 Medium
- google chromeGoogle Chrome before 17.0.963.46 does not properly check signatures, which allows remote...5.0 Medium
- openssl, red hat enterprise linux 10, enterprise linux 3 +11 more +13 moreOpenssl: openssl: signature forgery via improper pkcs-1 padding removal leading to certificate validation bypass9.1 Critical
- grandstream bt-100 firmwareGrandstream BudgeTone (BT) 100 Voice over IP (VoIP) phones do not properly check the Call-ID,...7.5 High
- Show moreLoading…