CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- perl-crypt-jwtperl-CRYPT-JWT 0.022 and earlier is affected by: Incorrect Access Control. The impact is: bypass...9.8 Critical
- oisf suricataOpen Information Security Foundation Suricata prior to version 4.1.3 is affected by: Denial of...7.5 High
- perl crypt::jwt crypt::jwt, perl crypt\ \ +1 morePerl Crypt::JWT prior to 0.023 is affected by: Incorrect Access Control. The impact is: allow...9.8 Critical
- mailvelopeMailvelope prior to 3.3.0 allows private key operations without user interaction via its client...6.5 Medium
- red hat spacewalk, redhat satellite +1 moreIt was found that Spacewalk, all versions through 2.8, did not safely compute client token...4.3 Medium
- django-rest-registration project django-rest-registrationImproper Verification of Cryptographic Signature in django-rest-registration9.8 Critical
jwt-simplenpmSignature Verification Bypass in jwt-simpleNo score- huawei ar1200, ar1200-s, ar150, ar160, ar200, ar2200, ar2200-s, ar3200, srg1300, srg2300, srg3300, ar1200-s firmware, ar1200 firmware +9 more +11 moreThere is a digital signature verification bypass vulnerability in AR1200, AR1200-S, AR150, AR160,...6.7 Medium
- golang crypto, debian linux +1 moreGolang/x/crypto message forgery vulnerability5.9 Medium
- enigmailEnigmail before 2.0.11 allows PGP signature spoofing: for an inline PGP message, an attacker can...7.5 High
- yarnpkg websiteThe signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only...5.9 Medium
- gpg-pgp project gpg-pgpThe signature verification routine in the Airmail GPG-PGP Plugin, versions 1.0 (9) and earlier,...5.9 Medium
- cisco nx-os software, nx-os +1 moreCisco NX-OS CLI Command Software Image Signature Verification Vulnerabilities6.7 Medium
- cisco nx-os software, nx-os +1 moreCisco NX-OS CLI Command Software Image Signature Verification Vulnerabilities6.7 Medium
- cisco nx-os software, nx-os +1 moreCisco NX-OS CLI Command Software Image Signature Verification Vulnerability6.7 Medium
- cisco nx-os software, nx-os +1 moreCisco MDS 9700 Series Multilayer Directors and Nexus 7000/7700 Series Switches Software Patch Signature Verification Vulnerability6.7 Medium
- cisco nx-os software, nx-os +1 moreCisco NX-OS Software Patch Signature Verification Bypass Vulnerability6.4 Medium
- cisco nx-os, nx-os software +1 moreCisco Nexus 3000 Series and 9000 Series Switches in NX-OS Mode CLI Command Software Image Signature Verification Vulnerability6.7 Medium
- cisco nx-os software, nx-os +1 moreCisco FXOS and NX-OS Software Secure Configuration Bypass Vulnerability6.7 Medium
- cisco nx-os software, nx-os +1 moreCisco NX-OS Software Arbitrary File Overwrite Vulnerability6.7 Medium
- libp2pFailure to properly verify ed25519 signatures in libp2p-core7.5 High
- cisco duo network gateway, duo security network gateway +1 moreMultiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal7.7 High
- hp laserjet enterprise printers, hp pagewide enterprise printers, hp laserjet managed printers, hp officejet enterprise printers, color laserjet cm4540 mfp firmware, color laserjet enterprise cp5525 firmware +141 more +143 moreHP LaserJet Enterprise printers, HP PageWide Enterprise printers, HP LaserJet Managed printers,...9.8 Critical
- hp laserjet enterprise, hp pagewide enterprise, hp laserjet managed, and hp officejet enterprise printers, color laserjet cm4540 mfp firmware, color laserjet cp5525 firmware +136 more +138 moreIn HP LaserJet Enterprise, HP PageWide Enterprise, HP LaserJet Managed, and HP OfficeJet...9.8 Critical
- denx u-bootAn exploitable vulnerability exists in the verified boot protection of the Das U-Boot from...8.2 High
- cisco nexus 3000 series switches, nexus 9000 series fabric switches in aci mode, nexus 9000 series switches in standalone nx-os mode +2 more +4 moreCisco NX-OS Software Image Signature Verification Vulnerability6.7 Medium
- enigmailEnigmail before 2.0.6 is prone to to OpenPGP signatures being spoofed for arbitrary messages...6.5 Medium
- gnome evolution, debian linux +1 moreGNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary...6.5 Medium
- adobe reader, acrobat dc, acrobat reader dc +2 more +4 moreAdobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019...6.5 Medium
- mozilla thunderbirdA flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird...5.3 Medium
- siemens simatic s7-400 cpu 412-1 dp v7, simatic s7-400 cpu 412-2 dp v7, simatic s7-400 cpu 412-2 pn v7 +22 more +24 moreA vulnerability has been identified in SIMATIC S7-400 (incl. F) V6 and below (All versions),...8.2 High
- subaru starlink 2017 firmware, starlink 2018 firmware, starlink 2019 firmware +2 moreA vulnerability in the update mechanism of Subaru StarLink Harman head units 2017, 2018, and 2019...6.4 Medium
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 11 Configuration tool, under certain circumstances, will bypass OIDC...3.6 Low
- axtls project axtlsIn sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature...5.9 Medium
- axtls project axtlsIn sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature...5.9 Medium
- axtls project axtlsIn sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature...5.9 Medium
- canonical ubuntu linuxThe Linux kernel, as used in Ubuntu 18.10 and when booted with UEFI Secure Boot enabled, allows...7.8 High
- bitdefender gravityzoneThe installer for BitDefender GravityZone relies on an encoded string in a filename to determine...9.8 Critical
- cisco ios xe software, ios xe +1 moreCisco IOS XE Software Digital Signature Verification Bypass Vulnerability6.7 Medium
- xelerance openswanIn verify_signed_hash() in lib/liboswkeys/signatures.c in Openswan before 2.6.50.1, the RSA...7.5 High
- strongswan, canonical ubuntu linux, debian linux +2 moreIn verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and...7.5 High
- strongswan, canonical ubuntu linux, debian linux +2 moreIn verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and...7.5 High
- matrix synapse, debian linux +1 moreMatrix Synapse Improper Signature Validation8.8 High
- opensuse libzypplibzypp does not reevaluate malicious rpms once downloaded7.8 High
- debian advanced package tool, canonical ubuntu linux +1 moreThe mirror:// method implementation in Advanced Package Tool (APT) 1.6.x before 1.6.4 and 1.7.x...5.9 Medium
- android open source project android, apple ios, macos +3 more +5 moreBluetooth implementations may not sufficiently validate elliptic curve parameters during Diffie-Hellman key exchange8.0 High
- wizkunde samlbaseWizkunde SAMLBase SAML Bypass7.5 High
- gigabyte gb-bsi7h-6500, gb-bsi7h-6500 firmware, gb-bxi7-5775 +1 more +3 moreGIGABYTE BRIX UEFI firmware is not cryptographically signed9.8 Critical
- diqee diqee360 firmwareAn issue was discovered on Diqee Diqee360 devices. A firmware update process, integrated into the...7.8 High
- json-jwt project json-jwtJson-jwt did not verify the cryptographic signature for data5.3 Medium
- Show moreLoading…