CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- texas instruments omap, ti omap l138 firmware +1 moreFlawed SK_LOAD module authenticity check in Texas Instruments OMAP L1388.2 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +33 more +35 moreNetty's wrapping plain trust manager silently disables hostname verification7.5 High
- f5 big-ip edge client, big-ip access policy manager, big-ip advanced firewall manager +17 more +19 moreBIG-IP Edge Client for macOS vulnerability7.8 High
- consensys gnark-cryptoDuplicate Advisory: Consensys gnark-crypto allows Signature Malleability9.8 Critical
- warp-tech warpgateSSH key password bypassed in warpgate4.8 Medium
- aes-gcm project aes-gcm, rustcrypto aeads, fedoraproject fedora +2 moreAEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failure4.7 Medium
- input-output-hk hydraSnapshot signature not including HeadID will allow replay attacks6.5 Medium
- pmmp pocketmine-mpPocketMine-MP 5.2.0 Server Crash via Incorrect EC Curve8.7 High
- cisco ios xr software, ios xr +1 moreA vulnerability in the iPXE boot function of Cisco IOS XR software could allow an authenticated,...6.7 Medium
- cisco ios xr software, ios xr +1 moreA vulnerability in Cisco IOS XR Software image verification checks could allow an authenticated,...5.7 Medium
- microsoft office, 365 apps, 365 apps for enterprise +5 more +7 moreMicrosoft Office Spoofing Vulnerability5.5 Medium
- siemens qms automotiveA vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile...7.8 High
- acronis agent, cyber protect 15, cyber protect +2 moreLocal privilege escalation due to unrestricted loading of unsigned libraries. The following...7.8 High
- zscaler zia admin portal, internet access admin portal +1 moreImproper SAML signature verification9.6 Critical
- borgbackup borgArchive spoofing vulnerability in borgbackup4.7 Medium
- cisco emergency responder, unified communications manager, unity connection +2 moreA vulnerability in Cisco Emergency Responder, Cisco Unified Communications Manager (Unified CM),...6.5 Medium
- openpgpjsCleartext Signed Message Signature Spoofing in openpgpjs4.3 Medium
- motorola ebts/mbts base radio, ebts base radio firmware, ebts mbts base radio +1 more +3 moreMotorola EBTS/MBTS Base Radio fails to check firmware authenticity. The Motorola MBTS Base Radio...7.2 High
- motorola mbts site controller, mbts site controller firmware +1 moreMotorola MBTS Site Controller fails to check firmware update authenticity. The Motorola MBTS Site...7.2 High
- e.foundation app loungeImproper verification of applications' cryptographic signatures in the /e/OS app store client App...6.5 Medium
- node-saml, node saml project saml +1 more@node-saml/node-saml's validatePostRequestAsync does not include checkTimestampsValidityError5.3 Medium
- huawei emui, harmonyos +1 moreVulnerability of insecure signatures in the ServiceWifiResources module. Successful exploitation...7.5 High
- huawei emui, harmonyos +1 moreVulnerability of insecure signatures in the OsuLogin module. Successful exploitation of this...7.5 High
- trailofbits uthenticodeuthenticode signature validation bypass vulnerability9.1 Critical
- trailofbits uthenticodeuthenticode EKU validation bypass5.9 Medium
- zoom rooms, zoom, zoom video communications, inc. desktop client for windows and zoom rooms for windows +2 moreImproper privilege management in Zoom Desktop Client for Windows and Zoom Rooms for Windows...8.8 High
- f5 big-ip edge client, access policy manager clients, big-ip access policy manager +2 moreBIG-IP Edge Client for macOS vulnerability7.8 High
- samba, fedoraproject fedora, red hat enterprise linux 6 +6 more +8 moreSamba: smb2 packet signing is not enforced when "server signing = required" is set5.9 Medium
- belkin wemo smart plug wsp080, wemo smart plug wsp080 firmware +1 moreIncorrect signature verification of the firmware during the Device Firmware Update process of...6.5 Medium
- microsoft mono, mono 6.12.0 +1 moreMono Authenticode Validation Spoofing Vulnerability5.3 Medium
- dell powerstore, powerstoreos, powerstoret os +2 moreDell PowerStore versions prior to 3.5 contain an improper verification of cryptographic...7.2 High
- zoom video communications, inc. for windows client, zoom virtual desktop infrastructure, zoom video communications, inc. rooms client for windows +2 more +4 moreImproper privilege management in Zoom for Windows, Zoom Rooms for Windows, and Zoom VDI for...8.7 High
- zoom, zoom video communications, inc. for windows client +1 moreZoom for Windows clients prior to 5.13.5 contain an improper verification of cryptographic...2.8 Low
- notaryproject notation-goVerification bypass can cause users into verifying the wrong artifact8.4 High
- moov signedxmlSignature validation bypass in github.com/moov-io/signedxml9.1 Critical
- django-sesIncorrect signature verification in django-ses4.6 Medium
- acronis cyber protect home officeLocal privilege escalation due to unrestricted loading of unsigned libraries. The following...7.8 High
- dell ecs, elastic cloud storage +1 moreDELL ECS prior to 3.8.0.2 contains an improper verification of cryptographic signature...5.9 Medium
- gitlabAn issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8,...4.3 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +28 more +30 moreWindows Spoofing Vulnerability5.5 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +13 more +15 moreWindows Enroll Engine Security Feature Bypass Vulnerability5.3 Medium
natscrates.ioNATS TLS certificate common name validation bypassNo score- veritas netbackup it analytics, aptare it analytics +1 moreAn issue was discovered in Veritas NetBackup IT Analytics 11 before 11.2.0. The application...5.3 Medium
- omicronenergy stationguard, stationscout +1 moreThe update process in OMICRON StationGuard and OMICRON StationScout before 2.21 can be exploited...9.8 Critical
- eugeny russhrussh may use insecure Diffie-Hellman keys5.9 Medium
- cisco enterprise nfv infrastructure softwareA vulnerability in the upgrade signature verification of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, local attacker to provide an unauthentic upgrade file for…7.8 High
- fortinet fortios, fortiproxy, fortiswitch +1 more +3 moreAn improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all...4.1 Medium
- connectwise controlThe cryptographic code signing process and controls on ConnectWise Control through 22.9.10032 ...9.8 Critical
- westerndigital my cloud osWestern Digital My Cloud devices before OS5 do not use cryptographically signed Firmware upgrade...9.8 Critical
- openzeppelin contracts, cairo-contracts +1 moreOpenZeppelin Contracts for Cairo is vulnerable to signature validation bypass6.4 Medium
- Show moreLoading…