CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedAn issue in OpenDDS 3.33.x allows a local attacker to cause a denial of service via the verify...6.6 Medium
- nordic semiconductor asa nrf54h20nRF54H20: MCUBoot can be tricked to executing unauthenticated code7.5 High
- No product listedMojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor9.8 Critical
- mikrotik routerosTLS server impersonation possible in Mikrotik RouterOS6.3 Medium
- mikrotik routerosSSH user impersonation possible in Mikrotik RouterOS9.2 Critical
- snowflake connector for python, go driver, jdbc driver +3 more +5 moreImproper OCSP response validation in Snowflake drivers7.4 High
- No product listedTrueview T18161 S 6.0.23.4 contains an improper verification in MQTT command processing. An...7.4 High
- microsoft copilot studioCopilot Studio Elevation of Privilege Vulnerability9.3 Critical
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 7 +4 more +6 moreJwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification5.9 Medium
- hickory-dns hickory-resolverhickory-resolver before 0.26.2 DNSSEC Validation Bypass8.7 High
- hickory-dnsHickory DNS through 0.25.0-alpha.3 DNSSEC Validation Bypass via RRSIG Signer's Name8.7 High
- siemens mendix saml (mendix 10 compatible), mendix saml (mendix 11 compatible), mendix saml (mendix 9.24 compatible) +2 moreA vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.3)...8.8 High
- drupal monobank payment apiMonobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-1303.7 Low
- eclipse foundation aeriosIn the current development version of Eclipse aeriOS, which has not yet had an official release,...9.0 Critical
- hewlett packard enterprise (hpe) aos-cx, hpe arubaos-cx +1 moreAuthenticated Signature Verification Bypass Leading to Arbitrary Code Execution in AOS-CX7.9 High
- google androidIn multiple locations, there is a possible improper encryption key validation due to a logic...7.8 High
- phison electronics corporation ps3111-s11 controller firmwarePhison PS3111-S11 Controller Firmware Signature Verification Bypass9.3 Critical
- wwbn avideoAVideo Unauthenticated Stream Credential Disclosure via Forgeable Token9.2 Critical
- erlef oidccEncrypted ID token or JARM response accepted without a nested signature in erlef oidcc7.6 High
- pac4jpac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token8.6 High
- omnivore-app omnivoreOmnivore before android-0.227.0 Authentication Bypass via Apple Sign-in9.3 Critical
aiirPyPIAIIR verification and policy gates could report success without enforcing the control (fail-open)6.9 Medium- wpmudev wpmu dev dashboardWPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion9.8 Critical
- cephCeph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation8.1 High
- jahlives openssl encryptopenssl_encrypt before 1.4.9 Integrity Bypass via Added Files9.3 Critical
- jahlives openssl encryptopenssl_encrypt before 1.4.9 Plugin Signing Trust Anchor Enrollment Bypass9.3 Critical
- jahlives openssl encryptopenssl_encrypt before 1.4.9 Arbitrary Code Execution via unsigned plugin9.3 Critical
- jahlives openssl encryptopenssl_encrypt before 1.4.9 GPG Signature Verification Bypass9.3 Critical
- jahlives openssl encryptopenssl_encrypt before 1.4.9 Authentication Bypass via Recovery Slot Removal9.3 Critical
- watchguard agentWatchGuard Agent improper authentication allows unauthenticated remote code execution9.3 Critical
- hp inc omen gaming hubOMEN Gaming Hub – Potential Escalation of Privilege & Information Disclosure8.2 High
- apache cloudstackApache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP8.1 High
- microsoft azure data factoryAzure Data Factory Elevation of Privilege Vulnerability9.3 Critical
- appwrite templatesAppwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent6.9 Medium
- node-opcuanode-opcua: Missing nonce verification in UserNameIdentityToken authentication7.7 High
- rdk rdk-b webuiRDK-B WebUI improper cryptographic signature verification vulnerability9.8 Critical
- freebsdMissing MAC validation in wg(4) packet decryption7.5 High
libnet-oauth-perlDebian,perl-Net-OAuthMageia +1 moreNet::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify9.8 Critical- No product listedThe Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of...6.4 Medium
- No product listedThe Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker...6.8 Medium
- otalio ship property management systemMissing JSON Web Token signature validation in Otalio Ship Property Management System8.1 High
- No product listedVerification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1...9.8 Critical
gitlab.com/uniget-org/cliGouniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set7.8 High- jahlives openssl encryptopenssl_encrypt before 1.4.0 Authentication Bypass via AES-CTR Fallback9.3 Critical
- @fastify/jwt, fastify fastify\/jwt +1 more@fastify/jwt vulnerable to authorization bypass via global secret overriding the per-request key8.1 High
- redhat quay, red hat openshift update service, quay 3 +2 moreQuay: stripe webhook accepts forged events without signature verification in quay5.9 Medium
- pax technology q80PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability7.5 High
- golang.org/x/mod golang.org/x/mod/sumdb/tlog, go toolchain cmd/go +1 moreFix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog8.4 High
- golang.org/x/mod golang.org/x/mod/sumdb, go toolchain cmd/go +1 moreIgnore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb7.5 High
- miniorange headless single sign onWordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerability9.8 Critical
- Show moreLoading…