CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- siemens opcenter xA vulnerability has been identified in Opcenter X (All versions < V2604). Affected applications...10.0 Critical
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +17 more +19 more.NET Security Feature Bypass Vulnerability8.1 High
- evbee dc-80Missing firmware validation allows remote code execution9.3 Critical
- phalcon cphalconPhalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)8.2 High
- sigstore sigstore-gosigstore-go: Multi-log threshold bypass via single compromised log5.9 Medium
- yeswikiYesWiki: Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`8.2 High
- corvusinfo corvuspay woocommerce payment gateway, corvuspay woocommerce payment gateway +1 moreCorvusPay WooCommerce Payment Gateway <= 2.7.4 - Unauthenticated Improper Verification of Cryptographic Signature to Payment Bypass via /wp-json/corvuspay/success/ REST Endpoint5.3 Medium
- havelsan liman mysAuthentication Bypass in HAVELSAN's Open Source Project Liman MYS8.1 High
- gitea open source git serverGitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write9.6 Critical
- watchguard fireware, fireware os +1 moreWatchGuard Firebox Firmware Image Validation Bypass in WatchGuard Fireware OS8.6 High
- libreswanIKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload7.5 High
- libreswanIKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload7.5 High
- cubespace cw0057 reaction wheelImproper verification of cryptographic signature in CubeSpace CW0057 Reaction Wheel3.3 Low
- red hat confidential compute attestation, ansible automation platform 2, ansible automation platform 2.6 for rhel 9 +12 more +14 moreSequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion7.4 High
- centrifugal centrifugoCentrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass8.2 High
- sigstore sigstore-jssigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced7.5 High
- sigstore sigstore-javaSigstore Java has a vulnerability with bundle verification of integratedTime2.0 Low
- hitachi virtual storage platform one block 23, 24, 26, 28lack of validation for firmware update in Hitachi Virtual Storage3.7 Low
- hcl software traveler for microsoft outlookHCL Traveler for Microsoft Outlook (HTMO) is susceptible to an application modification vulnerability6.7 Medium
- sigstore sigstore-jssigstore-js: DSSE payloadType type-binding failure5.4 Medium
- cactiCacti: Package Import Signature Validation Bypass Allows Self-Signed Packages7.1 High
- netflix lemurLemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure4.8 Medium
- wolfsslPKCS7_verify signer confusion allows forged signatures to be accepted5.9 Medium
- wolfsslPKCS#12 MAC verification uses attacker-controlled comparison length6.0 Medium
- red hat build of keycloak, build of keycloak 26.6, build of keycloak 26.6.4 +3 more +5 moreOrg.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion8.1 High
- wolfsslHMAC zero-length tag forgery in EVP_DigestVerifyFinal2.1 Low
- openidentityplatform openamOpenAM Authentication Bypass via RADIUS Spoofing7.5 High
- wolfsslwolfSSL_PKCS7_verify() reports success for degenerate (certs-only) PKCS#7 with no signer8.2 High
- aten unizonATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Execution Vulnerability7.2 High
- rocket.chatRocket.Chat: SAML signature validation skipped when IdP certificate field is empty9.3 Critical
- mastodonMastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuring5.3 Medium
motioneyePyPImotionEye: LFI → pass‑the‑hash admin → unsafe restore → unauth action exec (RCE)9.8 Critical- jhb-software payload-plugins@jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing7.1 High
- corewcfCoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages7.4 High
- corewcfCoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation10.0 Critical
- corewcfCoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate7.4 High
- corewcfCoreWCF: WS-Security signature substitution via document-wide Signature lookup5.9 Medium
web-token/jwt-experimentalPackagist,web-token/jwt-libraryPackagist +1 morePHP JWT Framework: Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decryption6.0 Medium- sztheory relyraRelyra SAML SignatureValue not cryptographically verified -> authentication bypass9.1 Critical
- mervinpraison praisonaiPraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)8.6 High
- mervinpraison praisonaiPraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing8.6 High
- masteriyo - lms, themegrill masteriyo - lms +1 moreWordPress Masteriyo - LMS plugin <= 2.1.8 - Broken Authentication vulnerability6.5 Medium
- sensiolabs symfony, symfony mailomat-mailer +1 moreSymfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade6.3 Medium
- simple-help simplehelpSimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification9.5 Critical
- apache cxfApache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry6.5 Medium
- cloud foundry cf deployment, uaa +1 moreUAA accepts SAML Encrypted Assertions authentication bypass9.0 Critical
- davidanderson updraftplus: wp backup & migration pluginUpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc8.1 High
- nationalsecurityagency ghidraGhidra < 12.1 - Authentication Bypass via Null Signature in PKIAuthenticationModule8.7 High
- spring security, vmware spring security +1 moreSAML Payloads Decrypted Without Valid Signature3.7 Low
- sap se netweaver as abap and abap platformXML Signature Wrapping in SAML Authentication in SAP NetWeaver AS ABAP and ABAP Platform9.9 Critical
- Show moreLoading…