Skip to content
OpenAdvisories

Weakness (CWE)

CWE-345: Insufficient Verification of Data Authenticity

Class Draft Mapping discouraged

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Source: MITRE CWE-345

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.9
    CVE-2026-72815 Public exploit

    go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header

    go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rat…

    go-chi chi golang-github-go-chi-chi golang-github-go-chi-chi Debian Ubuntu Go
  • Medium 6.9
    CVE-2025-51471 Public exploit EPSS 19%

    Ollama vulnerable to Cross-Domain Token Exposure

    Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controls via a malicious realm value in a WWW-Authenticate header returned by the /api/pull endpoint.

    github.com/ollama/ollama Go
  • Medium 6.5
    CVE-2025-30144 Public exploit

    Fast-JWT Improperly Validates iss Claims

    fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 5.0.6, the fast-jwt library does not properly validate the iss claim based on the RFC 7519. The iss (issuer) claim validation within the fast-jwt library permits an array of strings as a val…

    nearform fast-jwt fast-jwt npm
  • Medium 6.5
    CVE-2024-53259 Public exploit

    quic-go affected by an ICMP Packet Too Large Injection Attack on Linux

    quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used IP_PMTUDISC_DO, the kernel would then return a "message too large" error on sendmsg, i.e. when quic-…

    quic-go quic-go github.com/quic-go/quic-go golang-github-lucas-clemente-quic-go Debian Ubuntu Go
  • Medium 6.8
    CVE-2024-23922 Public exploit

    Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability

    Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-AX5500 devices. Authentication is not required …

    Sony XAV-AX5500
  • Medium 5.9
    CVE-2023-48795 Public exploit EPSS 94%

    Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

    The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…

    openssh lxd erlang openssh Debian Ubuntu Alpine PyPI Go crates.io