CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- lenovo driver management, drivers management +1 moreA DLL preloading vulnerability was reported in Lenovo Driver Management prior to version 2.9.0719...7.3 High
- dell alienware command center (awcc), alienware command center application, command \| update +1 more +3 moreDell Command Update, Dell Update, and Alienware Update versions prior to 4.3 contains a Improper...7.8 High
- showdoc, star7th star7th/showdoc +1 moreMissing Cryptographic Step in star7th/showdoc5.3 Medium
- swisslog-healthcare hmi-3 control panel firmwareA firmware validation issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus...9.8 Critical
- schneider-electric evlink city evc1s22p4 firmware, evlink city evc1s7p4 firmware, evlink parking ev.2 firmware +3 more +5 moreA CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in EVlink City ...7.2 High
- parity libsecp256k1Overflow in libsecp256k19.8 Critical
- fortinet fortimailA missing cryptographic step in the Identity-Based Encryption service of FortiMail before 7.0.0...5.9 Medium
- fortinet fortimailA missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4...7.5 High
- debian linux, linux kernel +1 morekernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID...7.8 High
- stellar js-stellar-sdkUtils.readChallengeTx does not verify the server account signature6.5 Medium
- togatech tenvoyImproper Verification of Cryptographic Signature in tenvoy9.8 Critical
- hitachi id bravura security fabricAn issue was discovered in Hitachi ID Bravura Security Fabric 11.0.0 through 11.1.3, 12.0.0...8.8 High
- bubble fireworks project fireworks, fxbin bubble-fireworks +1 moreMissing validation of JWT signature7.5 High
- inverse sogo, debian linux +1 moreSOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any...7.5 High
@aws-crypto/client-browsernpm,@aws-crypto/client-nodenpm +1 moreImproper Verification of Cryptographic Signature in aws-encryption-sdk-javascriptNo scoreaws-encryption-sdk-cliPyPIImproper Verification of Cryptographic Signature in aws-encryption-sdk-cliNo scoreaws-encryption-sdkPyPIImproper Verification of Cryptographic Signature in aws-encryption-sdkNo score- amazon aws encryption sdkAWS Encryption SDK for Java Improper Verification of Cryptographic Signature5.3 Medium
- entrouvert lasso, debian linux, fedoraproject fedora +2 moreLasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.7.5 High
- schneider-electric homelynk firmware, spacelynk firmware +1 moreImproper Verification of Cryptographic Signature vulnerability exists inhomeLYnk (Wiser For KNX)...7.2 High
- schneider-electric homelynk firmware, spacelynk firmware +1 moreImproper Verification of Cryptographic Signature vulnerability exists in homeLYnk (Wiser For KNX)...7.2 High
- ibm power 9 systems, power9 system firmware, scale-out lc system firmware +2 moreIBM Power9 Self Boot Engine(SBE) could allow a privileged user to inject malicious code and...8.0 High
- apache pulsarAuthentication with JWT allows use of “none”-algorithm9.8 Critical
github.com/russellhaering/gosaml2GoSignature Validation BypassNo scoregithub.com/russellhaering/goxmldsigGoSignature Validation BypassNo score- microsoft libdnf, fedoraproject fedora, redhat enterprise linux +2 moreA flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This...7.5 High
- grassroot platform, grassrootza grassroot-platform +1 moreMissing validation of JWT signature in `grassrootza/grassroot-platform`7.5 High
- manydesigns portofinoMissing validation of JWT signature in `ManyDesigns/Portofino`9.1 Critical
- filecoin lotusBLS Signature "Malleability"5.9 Medium
- github.com/robotsandpencils/go-saml, robotsandpencils go-saml +1 moreWeak hash (SHA-1) in github.com/RobotsAndPencils/go-saml5.3 Medium
- mozilla thunderbirdAn attacker may perform a DoS attack to prevent a user from sending encrypted email to a...6.5 Medium
- mozilla thunderbirdThunderbird did not check if the user ID associated with an OpenPGP key has a valid self...4.3 Medium
- kjur jsrsasignRSA signature validation vulnerability on maleable encoded message in jsrsasign9.1 Critical
- unionpayintl union payUnion Pay up to 3.3.12, for iOS mobile apps, contains a CWE-347: Improper Verification of...7.5 High
- unionpayintl union payUnion Pay up to 3.4.93.4.9, for android, contains a CWE-347: Improper Verification of...7.5 High
- unionpayintl union payUnion Pay up to 1.2.0, for web based versions contains a CWE-347: Improper Verification of...7.5 High
- phpseclib, debian linux +1 moreImproper Certificate Validation in phpseclib7.5 High
- red hat, inc. rpm, fedoraproject fedora, redhat enterprise linux +2 moreA flaw was found in the RPM package in the read functionality. This flaw allows an attacker who...5.5 Medium
- cisco ios xe software, ios xe +1 moreCisco IOS XE Software Fast Reload Vulnerabilities6.7 Medium
- cisco ios xe software, ios xe +1 moreCisco IOS XE Software Fast Reload Vulnerabilities6.7 Medium
- cisco ios xe software, ios xe +1 moreCisco IOS XE Software for the Catalyst 9000 Family Arbitrary Code Execution Vulnerability6.8 Medium
- drweb security spaceDr.Web Security Space versions 11 and 12 allow elevation of privilege for local users without...7.8 High
- keylime, fedoraproject fedora +1 moreA flaw was found in keylime 5.8.1 and older. The issue in the Keylime agent and registrar code invalidates the cryptographic chain of trust from the Endorsement Key certificate to agent attestations.9.8 Critical
- cisco anyconnect secure mobility clientCisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability7.8 High
- palo alto networks prisma cloud compute, paloaltonetworks prisma cloud +1 morePrisma Cloud Compute: SAML Authentication Bypass Vulnerability in Console9.1 Critical
- sap hana databaseSAP HANA Database, versions - 1.0, 2.0, accepts SAML tokens with MD5 digest, an attacker who...6.5 Medium
- cisco ios xr software, ios xr +1 moreCisco IOS XR Software for Cisco 8000 Series Routers and Network Convergence System 540 Series Routers Image Verification Vulnerabilities6.7 Medium
- cisco ios xr software, ios xr +1 moreCisco IOS XR Software for Cisco 8000 Series Routers and Network Convergence System 540 Series Routers Image Verification Vulnerabilities6.7 Medium
- company cs-c2shw firmwareBash injection vulnerability and bypass of signature verification in Rostelecom CS-C2SHW 5.0.082...9.8 Critical
- identitypython pysaml2, debian linux +1 moreOpen default xmlsec1 key-type preference6.5 Medium
- Show moreLoading…