CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- lfdt-lockness cggmp21CGGMP24 is missing a check in the ZK proof used in CGGMP219.3 Critical
- infocert gosign, tinexta infocert s.p.a. gosign desktop +1 moreGoSign Desktop < 2.4.1 Insecure Update Mechanism RCE7.0 High
- zoom communications inc. workplace vdi client, zoom workplace virtual desktop infrastructure +1 moreZoom Workplace VDI Client for Windows - Improper Verification of Cryptographic Signature7.5 High
- evervault, evervault evervault-go +1 moreEvervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves8.7 High
- jetbrains resharperIn JetBrains ReSharper before 2025.2.4 missing signature verification in DPA Collector allows...8.4 High
- hcl software devops loopHCL DevOps Loop is susceptible to an improper authentication vulnerability8.1 High
- apple macosA downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing...5.5 Medium
- apple macosA downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing...5.5 Medium
- arista networks danz monitoring fabricCryptographic validation of upgrade images could be circumventing by dropping a specifically crafted file into the upgrade ISO5.9 Medium
- edgelesssys contrastContrast before 1.12.1 Insecure LUKS2 Persistent Storage6.9 Medium
- d-link dap-2695, dlink dap-2695 firmware +1 moreD-Link DAP-2695 Firmware Update sub_40C6B8 signature verification7.5 High
- edgelesssys constellationConstellation allows insecure use of LUKS2 persistent storage partitions8.3 High
- light & wonder, inc. / shfl entertainment, inc. / shuffle master, inc. deck mate 1Shuffle Master Deck Mate 1 Unauthenticated EEPROM Firmware Execution7.0 High
- light & wonder, inc. / shfl entertainment, inc. / shuffle master, inc. deck mate 2Shuffle Master Deck Mate 2 Insecure Update Chain7.0 High
- apache sparkApache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacks6.5 Medium
- microsoft playwright, microsoft/playwright +1 morePlaywright Spoofing Vulnerability5.3 Medium
- fortinet forticlient, forticlientmac +1 moreAn Improper Verification of Cryptographic Signature vulnerability [CWE-347] in FortiClient MacOS...6.8 Medium
- cyberlord92 oauth single sign on – sso (oauth client)OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Authentication Bypass via get_resource_owner_from_id_token()9.8 Critical
- formbricksFormbricks missing JWT signature verification9.4 Critical
- microworld technologies escan avMicroWorld eScan AV Insecure Update Mechanism Allows Man-in-the-Middle Replacement of Updates9.3 Critical
- smci mbd-x12stwSupermicro BMC firmware update validation bypass7.2 High
- smci x13sem-fSupermicro BMC firmware update validation bypass7.2 High
- mohammadzain2008 linkrLinkr allows manifest tampering leading to arbitrary file injection9.7 Critical
- cisco ios xr software, ios xr +1 moreCisco IOS XR Software Image Verification Bypass Vulnerability6.0 Medium
- copeland e3 supervisory controller firmware, copeland lp e3 supervisory control +1 moreFirmware upgrade packages are unsigned8.6 High
- cgm clininetPossibility to generate a session for any user via the "ex:action" parameter after obtaining access to the JWT key8.8 High
- consensys gnarkgnark is vulnerable to signature malleability in EdDSA and ECDSA due to missing scalar checks8.6 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +23 more +25 moreWindows Certificate Spoofing Vulnerability5.3 Medium
- lenovo 510 fhd webcam, performance fhd webcam +1 moreA potential vulnerability was reported in the Lenovo 510 FHD and Performance FHD web cameras that...7.0 High
- siemens mendix saml (mendix 10.12 compatible), mendix saml (mendix 10.21 compatible), mendix saml (mendix 9.24 compatible) +2 moreA vulnerability has been identified in Mendix SAML (Mendix 10.12 compatible) (All versions < V4.0...8.7 High
- zscaler authentication serverSAML 2.0 Public Key Validation Issue9.6 Critical
- debian devscriptsIt was discovered that uscan, a tool to scan/watch upstream sources for new releases of software,...9.8 Critical
- apple macosA downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in...5.5 Medium
- node-samlNode-SAML Contains SAML Signature Verification Vulnerability10.0 Critical
- hp linux imaging and printing, hp, inc. hp linux imaging and printing software +1 moreHP Linux Imaging and Printing Software - Use of DSA Key5.9 Medium
- node-samlNode-SAML SAML Authentication Bypass9.3 Critical
- samsung wear os, samsung mobile devices +1 moreImproper verification of intent by broadcast receiver in System UI for Galaxy Watch prior to SMR...6.2 Medium
- siemens tia administratorA vulnerability has been identified in TIA Administrator (All versions < V3.0.6). The affected...6.9 Medium
- bitcoinjs tiny-secp256k1tiny-secp256k1 allows for verify() bypass when running in bundled environment8.1 High
- amd athlon™ 3000 series desktop processors with radeon™ graphics, athlon™ 3000 series mobile processors with radeon™ graphics, epyc™ 4004 series +43 more +45 moreImproper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with...6.4 Medium
- No product listedQuest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2...9.6 Critical
- trailofbits rfc3161-clientrfc3161-client has insufficient verification for timestamp response signatures9.3 Critical
- red hat builds for red hat openshift, custom metric autoscaler operator for red hat openshift, multicluster global hub +24 more +26 moreGithub.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results3.7 Low
- microsoft windows 11 version 24h2, windows server 2025, windows server 2025 (server core installation) +1 more +3 moreWindows App Control for Business Security Feature Bypass Vulnerability5.1 Medium
- igel os, microsoft windows 10 1507, windows 10 1607 +13 more +15 moreIn IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly...4.6 Medium
- denoDeno's AES GCM authentication tags are not verified7.7 High
- siemens building x - security manager edge controller (acc-ap), sipass integrated ac5102 \(acc-g2\) firmware, sipass integrated acc-ap firmware +2 moreA vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions), SiPass...5.9 Medium
- samlify project samlifysamlify SAML Signature Wrapping attack9.9 Critical
- openpgpjsOpenPGP.js's message signature verification can be spoofed8.7 High
- openpubkey, openpubkey opkssh +1 moreAuthentication Bypass in OPKSSH9.3 Critical
- Show moreLoading…