CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- totolinkA Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R ...9.1 Critical
- eclipse foundation iofogEclipse ioFog operator WebSocket accepts an unverified JWT9.8 Critical
- eugeny russhA russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request2.3 Low
- ibm db2 genius hubIBM Db2 Genius Hub Improper verification of cryptographic signature5.1 Medium
- authlib joserfcjoserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json9.1 Critical
- flexpriceFlexPrice through 2.1.38 QuickBooks Webhook Signature Verification Bypass8.2 High
- adobe c2pa, c2pa tool, c2pa-web +3 more +5 moreCAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)7.5 High
- adobe c2pa, c2pa tool, c2pa-web +3 more +5 moreCAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)7.5 High
- adobe c2pa, c2pa tool, c2pa-web +3 more +5 moreCAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)7.5 High
- adobe c2pa, c2pa tool, c2pa-web +3 more +5 moreCAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)5.3 Medium
- adobe c2pa, c2pa tool, c2pa-web +3 more +5 moreCAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)7.5 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +5 more +7 moreWindows Audio Service Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2012 +12 more +14 moreActive Directory Federation Services (AD FS) Spoofing Vulnerability9.1 Critical
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +3 more +5 moreMicrosoft Exchange Server Elevation of Privilege Vulnerability7.5 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2012 +12 more +14 moreRole: DNS Server Tampering Vulnerability5.5 Medium
- microsoft windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 +10 more +12 moreWindows Schannel Spoofing Vulnerability9.0 Critical
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows Update Stack Spoofing Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 11 version 24h2 +20 more +22 moreWindows Key Distribution Center Elevation of Privilege Vulnerability7.8 High
- microsoft sharepoint server subscription edition, sharepoint server +1 moreMicrosoft Office SharePoint Elevation of Privilege Vulnerability8.1 High
- h3c hdm family-a g5H3C G3/G5 HDM Firmware Verification Key Replacement3.1 Low
- d-link dcs-930lD-Link DCS-930L Emergency HTTP Recovery Server bootloader_region.bin mpfd_decode signature verification9.4 Critical
- microsoft .net, .net 10.0 runtime, .net 11.0 runtime +4 more +6 more.NET Security Feature Bypass Vulnerability8.8 High
- progress software corporation marklogic serverImproper authentication in Progress MarkLogic Server SAML processing7.5 High
- digidoc android, ios, digidoc4 +1 more +3 moreDigiDoc improper signature verification7.5 High
- hyper-mcp-rs hyper-mcphyper-mcp through 0.8.3 Improper Signature Verification of OCI WebAssembly Plugins8.3 High
- docker desktopDocker Desktop for Windows installer failed to verify external packages8.2 High
- sipay electronic money and payment services inc. prestashop virtual pos modulePayment Validation Bypass in Sipay Electronic Money's SanalPos PrestaShop9.8 Critical
- sipay electronic money and payment services inc. opencart virtual pos modulePayment Validation Bypass in Sipay Electronic Money's OpenCart 3.x9.8 Critical
- unknown super paymentsSuper Payments < 1.43.1 - Unauthenticated Payment Confirmation Forgery via Webhook Signature5.3 Medium
- nearform fast-jwtfast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery7.4 High
- nearform fast-jwtfast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion9.8 Critical
- nearform fast-jwtfast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set7.4 High
- ibm guardium data protectionIBM Guardium Data Protection Signature Verification Bypass7.8 High
- ibm datapower gateway 10.5.0, datapower gateway, datapower gateway 10.6.0 +2 more +4 moreIBM DataPower Gateway Improper Verification of Cryptographic Signature8.1 High
- ibm datapower gateway 10.5.0, datapower gateway, datapower gateway 10.6.0 +2 more +4 moreIBM DataPower Gateway Improper Verification of Cryptographic Signature7.4 High
- cisco license on-premCisco License On-Prem Security Hardening Release10.0 Critical
- hewlett packard enterprise (hpe) clearpass policy manager (cppm)Authenticated Local Missing Integrity Verification Vulnerability leads to Local Privilege Escalation in the ClearPass Policy Manager Windows Client Software7.8 High
- qualcomm ar8035 firmware, cologne firmware, cq2390m firmware +290 more +292 moreImproper Verification of Cryptographic Signature in Boot7.1 High
- progress software progress® telerik® fiddler® classicWeak Executable Signature Verification Vulnerability in Progress® Telerik® Fiddler® Classic7.9 High
- No product listedAn issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of...7.8 High
- invariant-systems-ai aiirinvariant-systems-ai aiir Policy Gate signature verification6.9 Medium
- openidentityplatform openamOpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession2.3 Low
- legion of the bouncy castle inc. bc-javaBLS12-381 key validation accepts a public key built on a foreign curve7.1 High
- legion of the bouncy castle inc. bc-javaOpenPGP data signature accepted from a signing subkey without cross-certification8.2 High
- moxa mgate mb3170 series, mgate mb3270 series +1 moreAn improper verification of cryptographic signature vulnerability exists in protocol gateways...8.6 High
- bouncycastle bc-csharpAttribute certificate path validation does not verify the attribute certificate's signature8.7 High
- thales sconnectSConnect: Native Host Unauthenticated Remote Code Execution Vulnerability9.4 Critical
- apache software foundation apisixApache APISIX: unauthenticated impersonation issue in saml-auth6.4 Medium
- n8n-io n8nn8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification6.9 Medium
- quenary tugtainerTugtainer: OIDC id_token claims accepted without signature/audience/expiry verification8.1 High
- Show moreLoading…