CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- identitypython pysaml2SAML XML Signature wrapping6.5 Medium
- foxitsoftware foxit reader, gonitro nitro pro, nitro reader +14 more +16 moreThe Portable Document Format (PDF) specification does not provide any information regarding the...5.3 Medium
- code-industry master pdf editor, foxitsoftware foxit reader, phantompdf +10 more +12 moreThe Portable Document Format (PDF) specification does not provide any information regarding the...5.3 Medium
- linuxfoundation dexAuthentication Bypass in dex9.8 Critical
- dexidp dexCritical security issues in XML encoding in Dex9.3 Critical
- hyperledger indy-nodeAuthorization bypass in Hyperledger Indy7.5 High
- zx2c4 password-storepass through 1.7.3 has a possibility of using a password for an unintended resource. For...7.5 High
- inspur nf5180m5 firmware, nf5260m5 firmware, nf5266m5 firmware +12 more +14 moreInspur NF5266M5 through 3.21.2 and other server M5 devices allow remote code execution via...7.2 High
- python openid connect project openid connect, openidc pyoidc +1 moreCryptographic issues in Python oic6.8 Medium
- tesla model x firmwareTesla Model X vehicles before 2020-11-23 have key fobs that accept firmware updates without...6.5 Medium
- hackerone nextcloud server, nextcloud server +1 moreA wrong generation of the passphrase for the encrypted block in Nextcloud Server 19.0.1 allowed...5.3 Medium
- adobe acrobat, acrobat reader, acrobat reader dc +1 more +3 moreAcrobat Reader DC for macOS Signature Validation Bypass2.8 Low
- adobe acrobat, acrobat reader, acrobat reader dc +1 more +3 moreAcrobat Reader DC for macOS Signature Verification Bypass Could Lead to Privilege Escalation7.7 High
- pax prolinosAn unsigned-library issue was discovered in ProlinOS through 2.4.161.8859R. This OS requires...7.8 High
- servicestackSignature validation bypass in ServiceStack5.3 Medium
- intel bmc firmware, nvidia dgx servers +1 moreNVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC...6.7 Medium
- apple ipados, ios and ipados, iphone os +2 moreThis issue was addressed by verifying host keys when connecting to a previously-known SSH server....6.5 Medium
- auth0 omniauth-auth0Regression in JWT Signature Validation7.4 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1709 +30 more +32 moreWindows Spoofing Vulnerability5.3 Medium
- fusionauth samlv2FusionAuth fusionauth-samlv2 0.2.3 allows remote attackers to forge messages and bypass...9.1 Critical
- foxitsoftware foxit reader, phantompdf +1 moreAn issue was discovered in Foxit Reader and PhantomPDF before 4.1 on macOS. Because the Hardened...7.5 High
- goxmldsig project goxmldsig, fedoraproject fedora +1 moreSignature Validation Bypass in goxmldsig5.3 Medium
- cisco identity services engine software, fmc1000-k9 bios, fmc1000-k9 firmware +20 more +22 moreMultiple Cisco UCS-Based Products UEFI Secure Boot Bypass Vulnerability6.2 Medium
- sqreen php microagentLack of cryptographic signature verification in the Sqreen PHP agent daemon before 1.16.0 makes...7.3 High
- wibu codemeterCodeMeter (All versions prior to 6.90 when using CmActLicense update files with CmActLicense Firm...7.5 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon wired infrastructure and networking, qualcomm ipq6018 firmware, kamorta firmware +26 more +28 moreu'Improper authentication and signature verification of debug polices in secure boot loader will...7.8 High
- red hat ansible, redhat ansible engine, debian linux +3 more +5 moreImproper Verification of Cryptographic Signature in ansible7.1 High
- auth0 jsonwebtoken, node-jsonwebtoken +1 morejsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()6.4 Medium
- ti simplelink-cc2640r2 software development kitThe Bluetooth Low Energy Secure Manager Protocol (SMP) implementation in Texas Instruments...8.8 High
- oasis-open oasis digital signature servicesIn OASIS Digital Signature Services (DSS) 1.0, an attacker can control the validation outcome (i...7.5 High
- ncr aptra xfs, selfserv atm +1 moreNCR SelfServ ATMs running APTRA XFS 05.01.00 do not properly validate softare updates for the...7.6 High
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +41 more +43 moreWindows Spoofing Vulnerability7.8 High
- jetbrains toolboxIn JetBrains ToolBox version 1.17 before 1.17.6856, the set of signature verifications omitted...7.5 High
- dp3t-backend-software development kit project development kitAn issue was discovered in DP3T-Backend-SDK before 1.1.1 for Decentralised Privacy-Preserving Proximity Tracing (DP3T). When it is configured to check JWT before uploading/publishing keys, it is possi…7.5 High
- gnu grub2, canonical ubuntu linux, debian linux +12 more +14 moreGRUB2: avoid loading unsigned kernels when GRUB is booted directly under secureboot without shim6.4 Medium
- osisoft pi api, pi buffer subsystem, pi connector +6 more +8 moreIn OSIsoft PI System multiple products and versions, a local attacker can plant a binary and...7.8 High
- pritunl pritunl-clientA flaw was found in pritunl-client before version 1.0.1116.6. A lack of signature verification...7.5 High
- sylabs singularityExecution Control List (ECL) Is Insecure in Singularity7.5 High
- amazon toughImproper verification of signature threshold in tough8.6 High
- huawei p30, p30 firmware +1 moreHUAWEI P30 with versions earlier than 10.1.0.135(C00E135R2P11) have an improper signature...5.5 Medium
- tendermintDenial of Service in TenderMint6.5 Medium
- palo alto networks pan-osPAN-OS: Authentication Bypass in SAML Authentication10.0 Critical
- johnsoncontrols exacqvision enterprise manager, exacqvision web service, johnson controls exacqvision enterprise manager versions 20.03.3.0 and prior +1 more +3 moreexacqVision Software - Improper Verification of Cryptographic Signature6.8 Medium
- argent recoverymanagerIn Argent RecoveryManager before 0xdc350d09f71c48c5D22fBE2741e4d6A03970E192, the executeRecovery...7.5 High
- kjur jsrsasign, netapp max data +1 moreECDSA signature validation vulnerability by accepting wrong ASN.1 encoding in jsrsasign7.5 High
- mattermost serverMattermost Server SAML implementation does not require encryption or signature verification as default7.5 High
- satoshilabs trezor model t firmware, trezor one firmware +1 moreBIP-143 in the Bitcoin protocol specification mishandles the signing of a Segwit transaction,...6.5 Medium
- redhat enterprise linuxA PGP signature bypass flaw was found in fwupd (all versions), which could lead to the...6.0 Medium
- p5-crypt-perl project p5-crypt-perlCrypt::Perl::ECDSA in the Crypt::Perl (aka p5-Crypt-Perl) module before 0.32 for Perl fails to...8.8 High
- foxitsoftware phantompdfAn issue was discovered in Foxit PhantomPDF before 8.3.10. It allows signature validation bypass...7.5 High
- Show moreLoading…