Weakness (CWE)
CWE-345: Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Source: MITRE CWE-345
779 results · Feed
-
Critical 9.1
AMI MegaRAC SPx12 and SPx13 devices have Insufficient Verification of Data Authenticity.
-
Critical 9.8
BlackVue DR750-2CH LTE v.1.012_2022.10.26 does not employ authenticity check for uploaded firmware. This can allow atta…
-
High 8.1
A man in the middle can redirect traffic to a malicious server in a compromised configuration.
-
Medium 4.5
In JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be imported without the “Trust …
-
Medium 6.5
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could allow the …
-
High 8.8
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause mani…
-
Medium 6.5
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause acce…
-
Medium 4.6
Zerocoin libzerocoin Proof CoinSpend.cpp CoinSpend data authenticity
A vulnerability classified as critical has been found in Zerocoin libzerocoin. Affected is the function CoinSpend::CoinSpend of the file CoinSpend.cpp of the component Proof Handler. The manipulation leads to insufficient verification of data authenticity. Co…
-
Critical 9.1
Insufficient user check in FlowTokens by Email stage
authentik is an open-source Identity Provider. Due to an insufficient access check, a recovery flow link that is created by an admin (or sent via email by an admin) can be used to set the password for any arbitrary user. This attack is only possible if a reco…
-
High 7.4
Insufficient Verification of Data Authenticity vulnerability in Routine prior to versions 2.6.30.6 in Android Q(10), 3.…
-
High 7.5
SwagPayPal payment not sent to PayPal correctly
SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used (PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, Credit card), the amount and item list sent to PayPal may not be identical to the one i…
-
Medium 6.4
OpenZeppelin Contracts for Cairo is vulnerable to signature validation bypass
OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`. As a result, an…
-
Medium 6.7
Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior use a proprietary local area network (LAN) protocol that does…
-
High 7.3
Rumpus - FTP server Improper Token Verification
Rumpus - FTP server version 9.0.7.1 Improper Token Verification– vulnerability may allow bypassing identity verification.
-
Medium 6.5
Insufficient checks in SEV may lead to a malicious hypervisor disclosing the launch secret potentially resulting in com…
-
Medium 4.4
Insufficient validation of address mapping to IO in ASP (AMD Secure Processor) may result in a loss of memory integrity…
-
High 7.0
NVIDIA GPU Display Driver for Windows contains a vulnerability where a regular user can cause an out-of-bounds read, wh…
-
High 7.5
Incorrect validation of root DNSSEC public keys in github.com/peterzen/goresolver
DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. Root DNSSEC public keys are not validated, permitting an attacker to present a self-signed root key and …
-
Medium 6.5
Incorrect DNSSEC validation due to unchecked owner names in github.com/peterzen/goresolver
DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. The owner name of RRSIG RRs is not validated, permitting an attacker to present the RRSIG for an attacke…
-
High 7.0
CodeIgniter is vulnerable to IP address spoofing when using proxy
CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the server is behind a reverse proxy. This issue has been patched, please upgrade to version 4.2.11 or later, and configure `Config\App::$prox…
-
Medium 6.5
When downloading an update for an addon, the downloaded addon update's version was not verified to match the version se…
-
Medium 4.3
When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of pre…
-
Medium 6.5
Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to conne…
-
High 7.5
D-Link devices DAP-2310 v2.10rc036 and earlier, DAP-2330 v1.06rc020 and earlier, DAP-2360 v2.10rc050 and earlier, DAP-2…
-
Medium 6.5
TP-Link TL-WR940N V4 3.16.9 and earlier allows authenticated attackers to cause a Denial of Service (DoS) via uploading…
-
Medium 4.8
An issue in Netgear WNR2000 v1 1.2.3.7 and earlier allows authenticated attackers to cause a Denial of Service (DoS) vi…
-
Medium 4.3
BigBlueButton subject to Ineffective user bans
BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are subject to Ineffective user bans. The attacker could register multiple users, and join the meeting with one of them. When that user is banned, they could still join the me…
-
Medium 6.0
PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow a root privileged attacker to install unsigned …
-
Medium 4.3
BigBlueButton contains DoS via failed authToken validation
BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3, are subject to Insufficient Verification of Data Authenticity, resulting in Denial of Service. An attacker can make a Meteor call to `validateAuthToken` using a victim's userId,…
-
Critical 9.8
RSFirewall < 1.1.25 - IP Block Bypass
RSFirewall tries to identify the original IP address by looking at different HTTP headers. A bypass is possible due to the way it is implemented.
-
Medium 5.5
A logic issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for W…
-
High 7.1
Insufficient verification of data authenticity vulnerability in Samsung Gear IconX PC Manager prior to version 2.1.2210…
-
Medium 6.8
Removal of TrustCor root certificate
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process o…
-
High 8.8
An issue in the component MSI.TerminalServer.exe of MSI Center v1.0.41.0 allows attackers to escalate privileges via a …
-
High 7.8
OndiskPlayer Remote Code Execution Vulnerability
Remote code execution vulnerability due to insufficient verification of URLs, etc. in OndiskPlayerAgent. A remote attacker could exploit the vulnerability to cause remote code execution by causing an arbitrary user to download and execute malicious code.
-
Medium 5.4
immundb has insufficient verification of data authenticity
immudb is a database with built-in cryptographic proof and verification. In versions prior to 1.4.1, a malicious immudb server can provide a falsified proof that will be accepted by the client SDK signing a falsified transaction replacing the genuine one. Thi…
-
Medium 5.8
Lack of proper validation in immudb
immudb is a database with built-in cryptographic proof and verification. immudb client SDKs use server's UUID to distinguish between different server instance so that the client can connect to different immudb instances and keep the state for multiple servers…
-
High 7.6
ETIC Telecom Remote Access Server Insufficient Verification of Data Authenticity
All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s web portal is vulnerable to accepting malicious firmware packages that could provide a backdoor to an attacker and provide privilege escalation to the device.
-
Medium 6.7
Cortex XSOAR: Local Privilege Escalation (PE) Vulnerability in Cortex XSOAR Engine
A local privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XSOAR engine software running on a Linux operating system allows a local attacker with shell access to the engine to execute programs with elevated privileges.
-
High 8.3
Remote desktop takeover via phishing
Remote desktop takeover via phishing