CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- zohocorp manageengine password manager pro, manageengine pam360 +1 moreAuthentication Bypass8.8 High
- jfrog artifactoryIntegration credential holders may impersonate users in JFrog Access7.2 High
- jfrog artifactoryPotential improper SAML signature verification in JFrog Artifactory7.5 High
- No product listedIn CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4, bootxsa.efi fails to properly validate...7.5 High
- No product listedCPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly validate LUKS encryption...9.1 Critical
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWindows Schannel Security Feature Bypass Vulnerability5.3 Medium
- red hat jboss enterprise application platform 7, jboss enterprise application platform 7.4 els on rhel 7, jboss enterprise application platform 7.4.25 +2 more +4 morePicketlink-federation: picketlink saml 2.0 auth bypass via missing assertions8.1 High
- red hat jboss enterprise application platform 7, jboss enterprise application platform 7.4 els on rhel 7, jboss enterprise application platform 7.4.25 +1 more +3 morePicketlink-federation: auth bypass in picketlink saml unsolicited-response9.8 Critical
- sap approuter, sap se business ai platform (approuter) +1 moreMultiple vulnerabilities in SAP Business AI Platform (Approuter)5.9 Medium
- pegasystems pega infinityPega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls.8.6 High
- estonian information system authority (ria) digidoc, digidoc4, libdigidocpp +2 moreSignature validation vulnerability affecting DigiDoc applications4.4 Medium
- systemd systemd-homedsystemd-homed: local privilege escalation via missing home-record signature verification on the authenticate path6.7 Medium
- klever-io klever-goKlever-Go: PubKeysBitmap padding bits bypass the BLS signature quorum7.1 High
- microsoft 365 admin center, windows admin center +1 moreMicrosoft 365 Admin Center Elevation of Privilege Vulnerability9.8 Critical
- microsoft teamsMicrosoft Teams Spoofing Vulnerability7.5 High
- wso2 api control plane, api manager, multiple products +3 more +5 moreAuthentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover10.0 Critical
- progress marklogic serverSAML authentication bypass in Progress MarkLogic Server9.1 Critical
- redhat build of keycloak, red hat build of keycloak 26.4, build of keycloak 26.4.14 +5 more +7 moreKeycloak-services: keycloak-services: saml broker metadata import disables response signature validation7.4 High
- redhat build of keycloak, red hat build of keycloak 26.6, build of keycloak 26.6.8 +3 more +5 moreKeycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens3.7 Low
- misskey-dev misskeyMisskey: JSON-LD signature validation + compaction may lead to improper activity handling9.2 Critical
- timlegge xml::sig, xml\ \ +1 moreXML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check7.5 High
- timlegge net::saml2, net\ +1 moreNet::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPath instead of the signed subtre…8.1 High
- timlegge xml::sig, xml\ \ +1 moreXML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID9.1 Critical
- timlegge net::saml2, net\ +1 moreNet::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature9.8 Critical
- timlegge net::saml2, net\ +1 moreNet::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured7.5 High
- latvijas valsts radio un televīzijas centrs (lvrtc) eparakstītājs 3.0eParakstītājs 3.0 for Windows – remote code execution via unauthenticated auto-update7.3 High
- bouncycastle bouncy castle for java lts, bc-java, legion of the bouncy castle inc. bc-lts-java +2 moreRSA PKCS#1 verification skips last two hash bytes in NULL-omitted path8.7 High
- bouncycastle bcpkix-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +2 more +4 moreCMS verifySignatures returns true for SignedData with zero signers8.7 High
- bouncycastle bcpg-fips, legion of the bouncy castle inc. bc-fja, bouncycastle bc-java +2 moreOpenPGP inline-signature policy failures silently ignored8.7 High
- hashgraph guardianGuardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation8.2 High
- thumborThumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature8.2 High
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreControllerAgent does not perform validation of firmware9.3 Critical
- google chromeCryptographic Flaw in WebAppInstalls in Google Chrome on Android prior to 151.0.7922.72 allowed a...6.1 Medium
- autel maxicharger ac elite homeAutel MaxiCharger AC Elite Home Software Update Improper Verification of Cryptographic Signature Arbitrary Code Execution Vulnerability6.4 Medium
- apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 moreApache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)9.8 Critical
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsTOTP two-factor authentication bypass vulnerability4.8 Medium
- jfrog artifactoryPotential privilege escalation to JFrog administrator privileges8.8 High
- ocaml mirage-cryptoAn issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM...6.2 Medium
- lenze c430, c520, c550 +2 more +4 moreSSH Enablement Signature Verification Bypass8.5 High
- med-united epa4allepa4all Security Incident: Implement keystore based on Telematik TSL, implement hostname check and certificate check for lib-vau9.1 Critical
- powerdns recursorWildcard CNAME proof validation bypass3.7 Low
- ritou oidc::liteOIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify7.5 High
- isc bind, bind 9 +1 moreIncorrect acceptance of NSEC3 records6.8 Medium
- jovancoding network-aiNetwork-AI before 5.13.4 Cryptographic Signature Verification Bypass8.8 High
- janssenproject jansJanssen Project: JWE Request Object Signature Verification Bypass in jans-auth-server5.3 Medium
- microsoft o365-moodlemoodle-local_o365: Authentication bypass via unverified JWT signature in Teams SSO endpoint9.3 Critical
- cyberlord92 saml single sign on – sso loginSAML Single Sign On <= 5.4.3 - Unauthenticated Authentication Bypass via 'SAMLResponse' Parameter Signature Algorithm Confusion9.8 Critical
- dataeaseDataEase: Unauthorized Command Execution Vulnerability9.5 Critical
- mervinpraison praisonaiPraisonAI before 4.6.78 Missing Webhook Signature Verification8.8 High
- tenable agent, nessus agent +1 moreTenable Agent Path Traversal Leading to Remote Code Execution9.3 Critical
- Show moreLoading…