Skip to content
OpenAdvisories

Weakness (CWE)

CWE-347: Improper Verification of Cryptographic Signature

Base Draft

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Source: MITRE CWE-347

All Critical High Medium Low Exploited only Public exploit

47 results · Clear filters · Feed

  • Critical 10.0
    CVE-2020-2021 Exploited · Ransomware Public exploit

    PAN-OS: Authentication Bypass in SAML Authentication

    When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-base…

    Palo Alto Networks PAN-OS Network devices
    KEV Mar 25, 2022
  • Medium 6.8
    CVE-2020-9047 Public exploit

    exacqVision Software - Improper Verification of Cryptographic Signature

    A vulnerability exists that could allow the execution of unauthorized code or operating system commands on systems running exacqVision Web Service versions 20.06.3.0 and prior and exacqVision Enterprise Manager versions 20.06.4.0 and prior. An attacker with a…

    Johnson Controls exacqVision Web Service versions 20.03.2.0 and prior exacqVision Enterprise Manager versions 20.03.3.0 and prior
  • High 7.5
    CVE-2020-9283 Public exploit EPSS 21%

    Improper Verification of Cryptographic Signature in golang.org/x/crypto

    golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.

    golang.org/x/crypto golang-go.crypto golang-go.crypto mongo-tools Debian Ubuntu Go
  • High 7.5
    CVE-2019-9153 Public exploit

    Message Signature Bypass in openpgp

    Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature.

    openpgp npm
  • High 7.5
    CVE-2018-0114 Public exploit EPSS 43%

    Cisco node-jose improper validation of JWT signature

    A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature (J…

    node-jose npm
  • Medium 5.3
    CVE-2016-1494 Public exploit

    Python RSA allows attackers to spoof signatures

    The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.

    python-rsa rsa python-rsa Debian Ubuntu PyPI
  • Medium 5.5
    CVE-2013-3900 Exploited Public exploit EPSS 45%

    WinVerifyTrust Signature Validation Vulnerability

    Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Wind…

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Jan 10, 2022