CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- hypr passwordlessImproper Verification of Cryptographic Signature vulnerability in HYPR Passwordless on Windows...5.6 Medium
gree/josePackagistgree/jose - "None" Algorithm treated as valid in tokensNo score- zoom video communications, inc. workplace vdi app for windows, zoom vdi windows meeting client, workplace virtual desktop infrastructure +2 moreZoom Workplace VDI App for Windows - Insufficient Verification of Data Authenticity6.7 Medium
- typo3TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController5.3 Medium
- parallels desktopParallels Desktop Updater Improper Verification of Cryptographic Signature Local Privilege Escalation Vulnerability7.8 High
- node-saml xml-crypto, node saml project xml crypto +1 moreXML signature verification bypass due improper verification of signature / signature spoofing10.0 Critical
- zscaler client connectorInsecure MacOS code sign check fallback7.5 High
- mpdavis python-josepython-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret9.3 Critical
- python-jose project python-josepython-jose algorithm confusion with OpenSSH ECDSA keys6.5 Medium
- red hat build of keycloak 22, build of keycloak 22.0.10, single sign-on 7 +2 moreKeycloak: impersonation via logout token exchange3.4 Low
- zoom, zoom video communications, inc. desktop client for macos, zoom workplace desktop +2 moreZoom Desktop Client for macOS - Improper Privilege Management5.5 Medium
- zoom, zoom video communications, inc. desktop client for windows, zoom workplace desktop +2 moreZoom Desktop Client for Windows - Improper Privilege Management5.9 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +31 more +33 moreWindows Cryptographic Services Security Feature Bypass Vulnerability7.8 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +28 more +30 moreSecure Boot Security Feature Bypass Vulnerability7.4 High
- huawei emui, harmonyos +1 moreVulnerability of package name verification being bypassed in the HwIms module. Impact: Successful...9.1 Critical
- dlink covr 1100, covr 1102, covr 1103 +1 more +3 moreAn issue in D-Link COVR 1100, 1102, 1103 AC1200 Dual-Band Whole-Home Mesh Wi-Fi System (Hardware...8.1 High
- red hat enterprise linux 8, enterprise linux 9 +1 moreOsbuild-composer: race condition may disable gpg verification for package repositories6.1 Medium
- dcit perl-cryptxIn the CryptX module before 0.062 for Perl, gcm_decrypt_verify() and...9.8 Critical
- snow software inventory agent, snowsoftware snow inventory agent +1 moreImproper validation of update packages7.8 High
- snow software inventory agent, snowsoftware snow inventory agent +1 moreImproper validation of update packages7.8 High
- svix svix-webhookssvix vulnerable to Authentication Bypass5.9 Medium
- rockwell automation factorytalk® service platform, rockwellautomation factorytalk services platform +1 moreRockwell Automation FactoryTalk® Service Platform Service Token Vulnerability9.8 Critical
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability3.3 Low
- studionetworksolutions sharebrowserStudio Network Solutions ShareBrowser before 7.0 on macOS mishandles signature verification, aka...9.8 Critical
- gnu gnutls, debian linux, fedoraproject fedora +10 more +12 moreGnutls: rejects certificate chain with distributed trust7.5 High
- gitlabImproper Verification of Cryptographic Signature in GitLab3.5 Low
- gentoo portageGentoo Portage missing PGP validation of executed code9.8 Critical
- hyperledger aries cloud agent, aries-cloudagent-python +1 moreHyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC9.9 Critical
- korenix jetnet series, jetnet 4508-w firmware, jetnet 4508 firmware +40 more +42 moreUnauthenticated Firmware Upgrade9.8 Critical
- matrix-org matrix-rust-sdkmatrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity4.3 Medium
- hitachi energy relion 670/650/sam600-io series, hitachienergy relion 650 firmware, relion 670 firmware +1 more +3 moreA vulnerability exists in the Relion update package signature validation. A tampered update...4.5 Medium
- honor magic os, magicos +1 moreSome Honor products are affected by signature management vulnerability, successful exploitation...7.3 High
- honor magic os, magicos +1 moreSome Honor products are affected by signature management vulnerability, successful exploitation...4.0 Medium
- hihonor nth-an00 firmware, honor nth-an00 +1 moreSome Honor products are affected by signature management vulnerability, successful exploitation...4.0 Medium
- hihonor nth-an00 firmware, honor nth-an00 +1 moreSome Honor products are affected by signature management vulnerability, successful exploitation...7.3 High
- hihonor nth-an00 firmware, honor nth-an00 +1 moreSome Honor products are affected by signature management vulnerability, successful exploitation...7.3 High
- yiiframework yii2-authclientThe Oauth2 PKCE implementation is vulnerable6.8 Medium
- zoom, zoom communications inc. clients, zoom meeting software development kit +2 more +4 moreImproper authentication in some Zoom clients before version 5.16.5 may allow an authenticated...6.4 Medium
- dena h2oh2o vulnerable to TLS session resumption misdirection6.1 Medium
- misskeyMisskey's missing signature validation allows arbitrary users to impersonate any remote user.9.3 Critical
- amd radeon pro vega 56 firmware, radeon pro vega 64 firmware, radeon rx vega 56 firmware +7 more +9 moreImproper signature verification of RadeonTM RX Vega M Graphics driver for Windows may allow an...6.7 Medium
- amd radeon pro vega 56 firmware, radeon pro vega 64 firmware, radeon rx vega 56 firmware +7 more +9 moreImproper signature verification of RadeonTM RX Vega M Graphics driver for Windows may allow an...6.7 Medium
- hanwha vision co., ltd. pnv-a6081r, hanwhavision pno-a6081r-e1t firmware, pno-a6081r-e2t firmware +1 more +3 moreCommand injection via wave install file7.2 High
- sigstore gitsignGitsign's Rekor public keys fetched from upstream API instead of local TUF client.4.2 Medium
- browserify browserify-sign, debian linux +1 morebrowserify-sign vulnerable via an upper bound check issue in `dsaVerify` that leads to a signature forgery attack6.5 Medium
- vmware tools, debian linux, fedoraproject fedora +2 more +4 moreVMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has...7.1 High
- networknt light-oauth2light-oauth2 missing public key verification5.9 Medium
- zscaler client connectorLinux ZCC allows unsigned updates, allowing elevated Code Execution8.2 High
- zscaler client connectorIPC Bypass Through PLT Section in ELF7.1 High
- free5gc udmfree5GC udm vulnerable to Invalid Curve Attack7.5 High
- Show moreLoading…