CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- dell alienware update, update, command update +1 more +3 moreDell Command | Update, Dell Update, and Alienware Update versions prior to 4.7 contain a improper...7.8 High
- reason-jose project reason-josereason-jose ignores signature checks5.9 Medium
- google androidIn the Android operating system, there is a possible way to replace a boot partition due to...7.8 High
- ip-label newtestThe Robot application in Ip-label Newtest before v8.5R0 was discovered to use weak signature...9.8 Critical
- libgit2libgit2 fails to verify SSH keys by default5.3 Medium
- pqclean project pqcleanCRYSTALS-DILITHIUM (in Post-Quantum Cryptography Selected Algorithms 2022) in PQClean d03da30 may...7.5 High
- ruckuswireless r310 firmware, r500 firmware, r600 firmware +11 more +13 moreIn Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5...7.5 High
- ruckuswireless r310 firmware, r500 firmware, r600 firmware +11 more +13 moreIn Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5...9.8 Critical
- rust-lang cargoCargo did not verify SSH host keys5.3 Medium
- trustedfirmware op-teeAn unprotected memory-access operation in optee_os in TrustedFirmware Open Portable Trusted...6.4 Medium
- tendermint-light-client project tendermint-light-client, informalsystems tendermint-rs, tendermint-light-client-js project tendermint-light-client-js +1 more +3 moreLight client verification not taking into account chain ID5.4 Medium
- amd radeon rx 5000 series & pro w5000 series, radeon rx 6000 series & pro w6000 series, enterprise driver +25 more +27 moreInsufficient verification of multiple header signatures while loading a Trusted Application (TA)...7.8 High
- schneider electric ecostruxure operator terminal expert, pro-face blue +1 moreA CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in the...7.0 High
- schneider electric ecostruxure operator terminal expert, pro-face blue +1 moreA CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that allows...7.0 High
- apple ipados, macos, iphone os +2 moreAn issue in code signature validation was addressed with improved checks. This issue is fixed in...5.5 Medium
- cloudflare warp, warp mobile client +1 moreLock WARP switch bypass on WARP mobile client using iOS quick action6.7 Medium
- datahubDataHub missing JWT signature check9.9 Critical
- grafana, netapp e-series performance analyzer +1 moreGrafana plugin signature bypass vulnerability6.1 Medium
- node-saml, node saml project saml +1 moreSignature bypass via multiple root elements in node-SAML7.7 High
- node-saml passport-samlSignature bypass via multiple root elements in Passport-SAML7.4 High
- cisco ios xe software, ios xe +1 moreCisco IOS XE Software for Catalyst 9200 Series Switches Arbitrary Code Execution Vulnerability6.1 Medium
- freedesktop dbus, fedoraproject fedora +1 moreAn issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x...6.5 Medium
- sylabs sif, singularity image format +1 moreDigital Signature Hash Algorithms Not Validated in sylabs/sif6.3 Medium
- github.com/peterzen/goresolver, go-resolver project go-resolver +1 moreIncorrect validation of root DNSSEC public keys in github.com/peterzen/goresolver7.5 High
- secp256k1-js project secp256k1-jssecp256k1-js implements ECDSA without required r and s validation, leading to signature forgery7.5 High
- debian linux, fedoraproject fedora, isc bind +2 more +4 moreMemory leaks in EdDSA DNSSEC verification code7.5 High
- debian linux, fedoraproject fedora, isc bind +2 more +4 moreMemory leak in ECDSA DNSSEC verification code7.5 High
- sigstore cosignVulnerabilities with blob verification in sigstore cosign5.5 Medium
- matrix dendriteSignature checks not applied to some retrieved missing events7.3 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon wearables, qualcomm aqt1000 firmware, csrb31024 firmware +46 more +48 morePossible authentication bypass due to improper order of signature verification and hashing in the...7.3 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, qualcomm aqt1000 firmware, ar8031 firmware +127 more +129 morePossible authentication bypass due to improper order of signature verification and hashing in the...7.3 High
- foxit pdf editor, pdf reader, phantompdf +2 moreFoxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, mishandle...5.5 Medium
- emerson electric proficy machine edition, emerson electric\'s proficy +1 moreEmerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-347...5.9 Medium
- zoom rooms, zoom video communications inc room for conference room for windows +1 moreLocal Privilege Escalation in the Zoom Rooms for Windows Client8.8 High
- zoom meetings, zoom video communications inc client for meetings for macos +1 moreLocal Privilege Escalation in Zoom Client for Meetings for MacOS8.8 High
- zoom meetings, zoom video communications inc client for meetings for macos +1 moreLocal Privilege Escalation in Auto Updater for Zoom Client for Meetings for macOS8.8 High
- sigstore policy-controller, policy controller +1 moreAbility to bypass attestation verification in sigstore PolicyController7.1 High
- sigstore cosignFalse positive signature verification in cosign7.1 High
- omron cp1w-cif41 firmware, sysmac cj2h firmware, sysmac cj2m firmware +4 more +6 moreThe Omron SYSMAC Cx product family PLCs (CS series, CJ series, and CP series) through 2022-05-18...9.8 Critical
- omron nj101-1000 firmware, nj101-1020 firmware, nj101-9000 firmware +22 more +24 moreThe Omron SYSMAC Nx product family PLCs (NJ series, NY series, NX series, and PMAC series)...9.8 Critical
- openzeppelin contracts, openzeppelin-contracts +1 moreOpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers7.5 High
- gradleGradle's dependency verification can ignore checksum verification when signature verification cannot be performed6.6 Medium
- dell bsafe crypto-c micro edition, bsafe crypto-c-micro-edition, bsafe micro-edition-suite +4 more +6 moreDell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, ...9.1 Critical
- kjur jsrsasignImproper Verification of Cryptographic Signature7.7 High
- dominionvoting imagecast x, dominion voting systems imagecast x application, imagecast x firmware +2 more2.2.1 IMPROPER VERIFICATION OF CRYPTOGRAPHIC SIGNATURE CWE-3476.8 Medium
- biscuit-auth biscuit, biscuitsec biscuit-auth, biscuit-go +2 more +4 moreSignature forgery in Biscuit9.8 Critical
- inhand networks inrouter302, inhandnetworks ir302 firmware +1 moreA firmware update vulnerability exists in the iburn firmware checks functionality of InHand...9.9 Critical
- ecdsautils project ecdsautils, debian linux, fedoraproject fedora +2 moreTrivial signature forgery in ecdsautils10.0 Critical
- google llc google-oauth-java-client, google oauth client library for java +1 moreIncorrect signature verification on Google-oauth-java-client8.7 High
- b. braun melsungen ag data module compactplus, spacecom, battery pack with wi-fi +1 more +3 moreB. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus7.6 High
- Show moreLoading…