Weakness (CWE)
CWE-345: Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Source: MITRE CWE-345
346 results · Clear filters · Feed
-
Medium 6.5
Apache InLong: General user Unauthorized access User Management
Insufficient Verification of Data Authenticity vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, General user can view all user data like Admin account. Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-…
-
Medium 5.0
A insufficient verification of data authenticity vulnerability [CWE-345] in FortiAnalyzer version 7.4.0 and below 7.2.3…
-
Medium 6.8CVE-2023-35719 EPSS 25%
ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability
ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of ManageEngine ADSelfSe…
-
Medium 5.2
Wireless Card Firmware Improperly Signed
The firmware update package for the wireless card is not properly signed and can be modified.
-
Medium 4.8
Jenkins SAML Single Sign On(SSO) Plugin missing hostname validation
Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections.
-
Medium 4.5
In JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be imported without the “Trust …
-
Medium 6.5
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could allow the …
-
Medium 6.5
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause acce…
-
Medium 4.6
Zerocoin libzerocoin Proof CoinSpend.cpp CoinSpend data authenticity
A vulnerability classified as critical has been found in Zerocoin libzerocoin. Affected is the function CoinSpend::CoinSpend of the file CoinSpend.cpp of the component Proof Handler. The manipulation leads to insufficient verification of data authenticity. Co…
-
Medium 6.4
OpenZeppelin Contracts for Cairo is vulnerable to signature validation bypass
OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`. As a result, an…
-
Medium 6.7
Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior use a proprietary local area network (LAN) protocol that does…
-
Medium 6.5
Insufficient checks in SEV may lead to a malicious hypervisor disclosing the launch secret potentially resulting in com…
-
Medium 4.4
Insufficient validation of address mapping to IO in ASP (AMD Secure Processor) may result in a loss of memory integrity…
-
Medium 6.5
Incorrect DNSSEC validation due to unchecked owner names in github.com/peterzen/goresolver
DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. The owner name of RRSIG RRs is not validated, permitting an attacker to present the RRSIG for an attacke…
-
Medium 6.5
When downloading an update for an addon, the downloaded addon update's version was not verified to match the version se…
-
Medium 4.3
When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of pre…
-
Medium 6.5
Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to conne…
-
Medium 6.5
TP-Link TL-WR940N V4 3.16.9 and earlier allows authenticated attackers to cause a Denial of Service (DoS) via uploading…
-
Medium 4.8
An issue in Netgear WNR2000 v1 1.2.3.7 and earlier allows authenticated attackers to cause a Denial of Service (DoS) vi…
-
Medium 4.3
BigBlueButton subject to Ineffective user bans
BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are subject to Ineffective user bans. The attacker could register multiple users, and join the meeting with one of them. When that user is banned, they could still join the me…
-
Medium 6.0
PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow a root privileged attacker to install unsigned …
-
Medium 4.3
BigBlueButton contains DoS via failed authToken validation
BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3, are subject to Insufficient Verification of Data Authenticity, resulting in Denial of Service. An attacker can make a Meteor call to `validateAuthToken` using a victim's userId,…
-
Medium 5.5
A logic issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for W…
-
Medium 6.8
Removal of TrustCor root certificate
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process o…
-
Medium 5.4
immundb has insufficient verification of data authenticity
immudb is a database with built-in cryptographic proof and verification. In versions prior to 1.4.1, a malicious immudb server can provide a falsified proof that will be accepted by the client SDK signing a falsified transaction replacing the genuine one. Thi…
-
Medium 5.8
Lack of proper validation in immudb
immudb is a database with built-in cryptographic proof and verification. immudb client SDKs use server's UUID to distinguish between different server instance so that the client can connect to different immudb instances and keep the state for multiple servers…
-
Medium 6.7
Cortex XSOAR: Local Privilege Escalation (PE) Vulnerability in Cortex XSOAR Engine
A local privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XSOAR engine software running on a Linux operating system allows a local attacker with shell access to the engine to execute programs with elevated privileges.
-
Medium 6.7
A firmware update vulnerability exists in the sysupgrade functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-…
-
Medium 4.7
Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-345 Insufficient Verification of…
-
Medium 5.9
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could cause loading of unauthorized…
-
Medium 6.5
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The application does not per…
-
Medium 5.8
Cisco Adaptive Security Appliance and Cisco Firepower Threat Defense Software AnyConnect SSL VPN Denial of Service Vulnerability
A vulnerability in the implementation of the Datagram TLS (DTLS) protocol in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause high CPU utilization, resu…
-
Medium 6.8
Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of the web-bas…
-
Medium 4.7
Select Dell Client Commercial and Consumer platforms are vulnerable to an insufficient verification of data authenticit…
-
Medium 6.5
An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ b…
-
Medium 4.4
File reference keys leads to incorrect hashes on HMAC algorithms
JWT is a library to work with JSON Web Token and JSON Web Signature. Prior to versions 3.4.6, 4.0.4, and 4.1.5, users of HMAC-based algorithms (HS256, HS384, and HS512) combined with `Lcobucci\JWT\Signer\Key\LocalFileReference` as key are having their tokens …
-
Medium 5.6
Improperly Implemented path matching for in-toto-golang
in-toto-golang is a go implementation of the in-toto framework to protect software supply chain integrity. In affected versions authenticated attackers posing as functionaries (i.e., within a trusted set of users for a layout) are able to create attestations …
-
Medium 6.5
Insufficient Verification of Data Authenticity in Enbra EWM (replay attack)
Enbra EWM 1.7.29 does not check for or detect replay attacks sent by wireless M-Bus Security mode 5 devices. Instead timestamps of the sensor are replaced by the time of the readout even if the data is a replay of earlier data.
-
Medium 5.5
Denial of Service in SheetJS Pro
SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (CPU consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js.
-
Medium 6.5
Dell EMC PowerFlex, v3.5.x contain a Cross-Site WebSocket Hijacking Vulnerability in the Presentation Server/WebUI. An …