CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- foxitsoftware phantompdf, reader +1 moreAn issue was discovered in Foxit Reader and PhantomPDF before 9.5. It allows signature validation...7.5 High
- foxitsoftware phantompdf, reader +1 moreAn issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It allows signature...7.5 High
- foxitsoftware phantompdf, reader +1 moreAn issue was discovered in Foxit PhantomPDF Mac and Foxit Reader for Mac before 4.0. It allows...7.5 High
- cisco ios xe, ios xe software 3.2.0sg +1 moreCisco IOS XE Software Digital Signature Verification Bypass Vulnerability6.8 Medium
- antonkueltz fastecdsaImproper Verification of Cryptographic Signature in fastecdsa7.5 High
- aviatrix controllerAn issue was discovered in Aviatrix Controller through 5.1. An attacker with any signed SAML...7.5 High
- naver whale browser installerWhale Browser Installer before 1.2.0.5 versions don't support signature verification for Flash...9.1 Critical
- powerdns recursor, debian linux, fedoraproject fedora +2 more +4 moreAn issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer...7.5 High
- opto22 softpac projectOpto 22 SoftPAC Project Version 9.6 and prior. SoftPAC’s firmware files’ signatures are not...5.7 Medium
- opto22 softpac projectOpto 22 SoftPAC Project Version 9.6 and prior. Paths specified within the zip files used to...6.5 Medium
- pivotal software spring security, spring security +1 moreSignature Wrapping Vulnerability with spring-security-saml2-service-provider8.8 High
- cisco firepower threat defense software, secure firewall management center, secure firewall threat defense +2 moreCisco Firepower Threat Defense Software Signature Verification Bypass Vulnerability4.9 Medium
- openstack keystone, canonical ubuntu linux +1 moreOpenStack Keystone does not check signature TTL of the EC2 credential auth method5.4 Medium
- titan sf rush smart band firmwareAn issue was discovered on Tata Sonata Smart SF Rush 1.12 devices. It has been identified that...8.1 High
- qualcomm, inc. snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, qualcomm sda845 firmware, sdm845 firmware +1 more +3 moreWlan binary which is not signed with OEMs RoT is working on secure device without authentication...7.8 High
- microsoft research javascript cryptography library v1.4, research javascript cryptography library +1 moreIncorrect Calculation in the MSR JavaScript Cryptography Library9.8 Critical
- lenovo lenovoappscenariopluginsystem for lenovo system interface foundation, system interface foundation +1 moreA vulnerability was reported in LenovoAppScenarioPluginSystem for Lenovo System Interface...5.0 Medium
- google androidAn issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) (with Fingerprint...7.8 High
- apache netbeans, oracle graalvm +1 moreImproper Verification of Cryptographic Signature in Apache Netbeans7.5 High
- lenovo system updateMITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A...7.5 High
- google androidAn issue was discovered on Samsung mobile devices with N(7.1), O(8.x), and P(9.0) software....9.1 Critical
- jenkins mac, jenkins project mac plugin +1 moreMissing SSH host key validation in Mac Plugin7.4 High
- debian linux, golang package ssh +1 moreImproper Verification of Cryptographic Signature in golang.org/x/crypto7.5 High
- cisco enterprise nfv infrastructure software, na +1 moreCisco Enterprise NFV Infrastructure Software Remote Code Execution Vulnerability6.7 Medium
- linuxfoundation the update frameworkIncorrect threshold signature computation in TUF9.8 Critical
- jetbrains riderIn JetBrains Rider versions 2019.3 EAP2 through 2019.3 EAP7, there were unsigned binaries...7.5 High
- canonical python-aptpython-apt downloads from untrusted sources4.7 Medium
- pysaml2 project pysaml2, canonical ubuntu linux, debian linux +2 moreImproper Verification of Cryptographic Signature in PySAML27.5 High
- wolfsslwolfSSL before 4.3.0 mishandles calls to wc_SignatureGenerateHash, leading to fault injection in...7.5 High
- petwant pf-103 firmware, skymee petalk ai firmware +1 moreUnencrypted HTTP communications for firmware upgrades in Petalk AI and PF-103 allow man-in-the...8.1 High
- canonical ubuntu cobbler, cobbler +1 moreA Security Bypass vulnerability exists in Ubuntu Cobbler before 2,2,2 in the cobbler-ubuntu...5.9 Medium
- decentralized anonymous payment system project anonymous payment system, pivx private instant verified transactions +1 moreAn issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. The...7.5 High
- apt, debian advanced package tool, linux +2 moreIt was found that apt-key in apt, all versions, do not correctly validate gpg keys with the...3.7 Low
- red hat redhat-upgrade-tool, redhat enterprise linux +1 moreredhat-upgrade-tool: Does not check GPG signatures when upgrading versions9.8 Critical
- matrix synapseImproper Verification of Cryptographic Signature in matrix-synapse9.8 Critical
- simplesamlphp, xmlseclibs project xmlseclibs, debian linux +2 moreSignature validation bypass in XmlSecLibs8.8 High
- python-ecdsa project python-ecdsa, redhat ceph storage, openstack +1 more +3 moreImproper Verification of Cryptographic Signature in Pure-Python ECDSA7.4 High
- juniper junos, juniper networks junos os +1 moreJunos OS: EX2300, EX3400 Series: Veriexec signature checking not enforced in specific versions of Junos OS7.8 High
- keybaseThe Keybase app 2.13.2 for iOS provides potentially insufficient notice that it is employing a...7.5 High
- mozilla thunderbirdA crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer...7.5 High
- cisco ios xe, nx-os, nx-os software 6.0(2)a1(1) +50 more +52 moreCisco NX-OS and IOS XE Software Virtual Service Image Signature Bypass Vulnerability6.7 Medium
- cisco ios, ios xe, ios xe software 3.2.11asg +2 moreCisco IOS XE Software Digital Signature Verification Bypass Vulnerability6.7 Medium
- dell bsafe crypto-j, rsa bsafe crypto-j, bsafe cert-j +14 more +16 moreRSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Improper Verification of...6.5 Medium
- fortinet fortios ips engineMultiple padding oracle vulnerabilities (Zombie POODLE, GOLDENDOODLE, OpenSSL 0-length) in the...5.9 Medium
- openpgpjsImproper Key Verification in openpgp7.5 High
- openpgpjsMessage Signature Bypass in openpgp7.5 High
- keycloak, redhat single sign-on +1 moreImproper Verification of Cryptographic Signature in keycloak8.1 High
- huawei hima-al00b, hima-al00b firmware +1 moreHuawei mobile phones Hima-AL00Bhave with Versions earlier than HMA-AL00C00B175 have a signature...7.8 High
- cpanelcPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement...4.8 Medium
- qualcomm, inc. snapdragon auto, snapdragon consumer iot, snapdragon mobile, qualcomm mdm9607 firmware, mdm9640 firmware +13 more +15 moreUser keystore signature is ignored in boot and can lead to bypass boot image signature...7.8 High
- Show moreLoading…