CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- sigstore sigstore-javaVulnerability with bundle verification in sigstore-java5.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThe application failed to account for exceptions thrown by the `loadManifestFromFile` method...5.4 Medium
- cisco catalyst sd-wan manager, sd-wan vedge router +1 moreCisco SD-WAN Software Signature Verification Bypass Vulnerability4.9 Medium
- fortinet forticlient, forticlientmac +1 moreAn improper verification of cryptographic signature vulnerability [CWE-347] in FortiClient MacOS...6.8 Medium
- mutt, neomutt, red hat enterprise linux 7 +3 more +5 moreMutt: neomutt: in-reply-to email header field it not protected by cryptograpic signing5.3 Medium
- mutt, neomutt, red hat enterprise linux 10 +4 more +6 moreMutt: neomutt: to and cc email header fields are not protected by cryptographic signing6.5 Medium
- dataeaseDataease arbitrary interface access vulnerability9.3 Critical
- huawei harmonyosPermission control vulnerability in the hidebug module Impact: Successful exploitation of this...8.2 High
- golang-jwt jwtBad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt3.1 Low
- laravel reverbLaravel Reverb has Missing API Signature Verification6.3 Medium
- abb 620 series iec/cn, arg600/arp600 dual sim, arg600/arp600/arr600/arc600 single sim +28 more +30 moreUnauthorized Modifications of Firmware and Configuration4.6 Medium
- astroxnetwork agent dartAgent Dart missing certificate verification checks8.7 High
- rittal gmbh & co. kg iot interface & cmc iii processing unitImproper signature verification of firmware upgrade files9.8 Critical
- indutny ellipticValid ECDSA signatures erroneously rejected in Elliptic4.8 Medium
- schneider electric data center expertCWE-347: Improper Verification of Cryptographic Signature vulnerability exists that could...7.2 High
- github enterprise serverAn Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed when the encrypted assertions feature w…9.5 Critical
- indutny ellipticElliptic's verify function omits uniqueness validation9.1 Critical
- ssoreadyXML Signature Bypass via differential XML parsing in ssoready9.3 Critical
- alpine halo9, alpsalpine ilx-f509 firmware +1 moreAlpine Halo9 Improper Verification of Cryptographic Signature Vulnerability4.6 Medium
- teamviewer full client, host, remote full client +1 more +3 moreImproper signature verification of VPN driver installation in TeamViewer Remote Clients8.8 High
- teamviewer host, remote full client, remote host +2 moreImproper signature verification of Printer driver installation in TeamViewer Remote Clients8.8 High
- red hat build of keycloak, build of keycloak 22, build of keycloak 24 +8 more +10 moreKeycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloak7.7 High
- apache druidApache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cookie via Padding Oracle Attack5.3 Medium
- libreofficeSignatures in "repair mode" should not be trusted7.8 High
- secreto31126 whatsapp-api-jswhatsapp-api-js fails to validate message's signature5.8 Medium
omniauth-samlRubyGemsomniauth-saml vulnerable to Improper Verification of Cryptographic Signature9.9 Critical- omniauth saml, onelogin ruby-saml, gitlab +1 more +3 moreThe Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector10.0 Critical
adyenPyPIAdyen APIs Library for Python timing attack vulnerability6.9 Medium- spring bootCVE-2024-38807: Signature Forgery Vulnerability in Spring Boot's Loader6.3 Medium
- github enterprise serverAn XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when...9.5 Critical
- zscaler client connectorSignature validation error in DLL allows disabling anti-tampering protection5.7 Medium
- zscaler client connectorIncorrect signature validation of package6.4 Medium
- zscaler client connectorSignature validation issue leads to Anti-Tampering bypass7.8 High
- elliptic project ellipticElliptic allows BER-encoded signatures9.1 Critical
- elliptic project ellipticElliptic's EDDSA missing signature length check5.3 Medium
- filestashAn issue was discovered in filestash v0.4. The usage of the ssh.InsecureIgnoreHostKey() disables...5.3 Medium
- litestreamAn issue was discovered in litestream v0.3.13. The usage of the ssh.InsecureIgnoreHostKey()...5.3 Medium
- palo alto networks cortex xdr agentCortex XDR Agent: Improper File Signature Verification Checks6.8 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +21 more +23 moreWindows Enroll Engine Security Feature Bypass Vulnerability7.0 High
- nsoftware ipworks ssh, /n software ipworks ssh sftpserver +1 more/n software IPWorks SSH insufficient file access verification2.3 Low
- realtek rtl819x jungle sdk, level1 wbr-6013 firmware, level one wbr6013 +3 more +5 moreA firmware update vulnerability exists in the boa formUpload functionality of Realtek rtl819x...7.2 High
- samsung android, samsung mobile devices +1 moreImproper verification of signature in FilterProvider prior to SMR Jul-2024 Release 1 allows local...6.5 Medium
- ibm websphere application serverIBM WebSphere Application Server identity spoofing8.8 High
- freefrom k.k. "freefrom - the nostr client" app for android, "freefrom - the nostr client" app for ios, freefrom kk the nostr client app +2 moreImproper verification of cryptographic signature issue exists in "FreeFrom - the nostr client"...5.3 Medium
- netapp storagegrid, storagegrid (formerly storagegrid webscale) +1 moreCVE-2024-21988 SSH Cryptographic Implementation Vulnerability in StorageGRID (formerly StorageGRID Webscale)5.3 Medium
- kiteworks security-advisories, nextcloud user oidc +1 moreNextcloud user_oidc's ID4me does not validate signature or expiration5.4 Medium
- authlibAuthlib has algorithm confusion with asymmetric public keys7.5 High
- google android, android kernel +1 moreThere is a possible escalation of privilege due to improperly used crypto. This could lead to...9.8 Critical
titon/frameworkPackagisttiton/framework vulnerable to Remote Code Execution via Chosen-Ciphertext Attack9.8 Critical- teamviewer remote, remote (full client), remote (host) +2 moreImproper fingerprint validation in the TeamViewer Client6.4 Medium
- Show moreLoading…