Weakness (CWE)
CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Source: MITRE CWE-347
372 results · Clear filters · Feed
-
High 7.8
Improper signature verification in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Se…
-
High 8.7
Algorithm Confusion Vulnerability in cjwt
cjwt is a C JSON Web Token (JWT) Implementation. Algorithm confusion occurs when a system improperly verifies the type of signature used, allowing attackers to exploit the lack of distinction between signing methods. If the system doesn't differentiate betwee…
-
High 7.1
A library injection vulnerability exists in Microsoft Excel 16.83 for macOS. A specially crafted library can leverage E…
-
High 7.1
A library injection vulnerability exists in Microsoft Outlook 16.83.3 for macOS. A specially crafted library can levera…
-
High 7.1
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. A speciall…
-
High 7.1
A library injection vulnerability exists in Microsoft Word 16.83 for macOS. A specially crafted library can leverage Wo…
-
High 7.1
A library injection vulnerability exists in Microsoft OneNote 16.83 for macOS. A specially crafted library can leverage…
-
High 7.1
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.2…
-
High 7.1
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work…
-
High 7.1
A library injection vulnerability exists in Microsoft PowerPoint 16.83 for macOS. A specially crafted library can lever…
-
High 8.8
Dell RecoverPoint for Virtual Machines 6.0.x contains an OS Command injection vulnerability. A low privileged remote at…
-
High 8.5
Insufficient Integrity Verification Vulnerability in TP-Link Archer C50
This vulnerability exists in the TP-Link Archer C50 due to improper signature verification mechanism in the firmware upgrade process at its web interface. An attacker with administrative privileges within the router’s Wi-Fi range could exploit this vulnerabil…
-
High 7.8
Dell NetWorker Management Console, version(s) 19.11, contain(s) an Improper Verification of Cryptographic Signature vul…
-
High 8.2
Permission control vulnerability in the hidebug module Impact: Successful exploitation of this vulnerability may affect…
-
High 8.7
Agent Dart missing certificate verification checks
Agent Dart is an agent library built for Internet Computer for Dart and Flutter apps. Prior to version 1.0.0-dev.29, certificate verification in `lib/agent/certificate.dart` does not occur properly. During the delegation verification in the `_checkDelegation`…
-
High 7.2
CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that could compromise the Data Center Ex…
-
High 8.8CVE-2024-7479 Public exploit
Improper signature verification of VPN driver installation in TeamViewer Remote Clients
Improper verification of cryptographic signature during installation of a VPN driver via the TeamViewer_service.exe component of TeamViewer Remote Clients prior version 15.58.4 for Windows allows an attacker with local unprivileged access on a Windows system …
-
High 8.8
Improper signature verification of Printer driver installation in TeamViewer Remote Clients
Improper verification of cryptographic signature during installation of a Printer driver via the TeamViewer_service.exe component of TeamViewer Remote Clients prior version 15.58.4 for Windows allows an attacker with local unprivileged access on a Windows sys…
-
High 7.7
Keycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloak
A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the…
-
High 7.8
Signatures in "repair mode" should not be trusted
Improper Digital Signature Invalidation vulnerability in Zip Repair Mode of The Document Foundation LibreOffice allows Signature forgery vulnerability in LibreOfficeThis issue affects LibreOffice: from 24.2 before < 24.2.5.
-
High 7.8
Signature validation issue leads to Anti-Tampering bypass
Anti-tampering can be disabled under certain conditions without signature validation. This affects Zscaler Client Connector <4.2.0.190 with anti-tampering enabled.
-
High 7.0
Windows Enroll Engine Security Feature Bypass Vulnerability
Windows Enroll Engine Security Feature Bypass Vulnerability
-
High 7.2
A firmware update vulnerability exists in the boa formUpload functionality of Realtek rtl819x Jungle SDK v3.4.11. A spe…
-
High 8.8
IBM WebSphere Application Server identity spoofing
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to identity spoofing by an authenticated user due to improper signature validation. IBM X-Force ID: 294721.
-
High 7.5
There is a possible escalation of privilege due to improperly used crypto. This could lead to remote escalation of priv…
-
High 7.5
Authlib has algorithm confusion with asymmetric public keys
lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asymmetric public key. (This is similar to CVE-2022-29217 and CVE-2024-33663.)
-
High 7.8
Parallels Desktop Updater Improper Verification of Cryptographic Signature Local Privilege Escalation Vulnerability
Parallels Desktop Updater Improper Verification of Cryptographic Signature Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain…
-
High 7.5
Insecure MacOS code sign check fallback
A fallback mechanism in code sign checking on macOS may allow arbitrary code execution. This issue affects Zscaler Client Connector on MacOS prior to 4.2.
-
High 7.4
Secure Boot Security Feature Bypass Vulnerability
Secure Boot Security Feature Bypass Vulnerability
-
High 8.1
An issue in D-Link COVR 1100, 1102, 1103 AC1200 Dual-Band Whole-Home Mesh Wi-Fi System (Hardware Rev B1) truncates Wire…
-
High 7.8
Improper validation of update packages
Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on Unix allows File Manipulation through Snow Update Packages.This issue affects Inventory Agent: through 7.3.1.
-
High 7.8
Improper validation of update packages
Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on MacOS, Snow Software Inventory Agent on Windows, Snow Software Inventory Agent on Linux allows File Manipulation through Snow Update Packages.This issue affects…
-
High 7.5
Gnutls: rejects certificate chain with distributed trust
A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote cli…
-
High 7.3
Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged …
-
High 7.3
Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged …
-
High 7.3
Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged …
-
High 7.2
Command injection via wave install file
Bashis, a Security Researcher at IPVM has found a flaw that allows for a remote code execution during the installation of Wave on the camera device. The Wave server application in camera device was vulnerable to command injection allowing an attacker to run a…
-
High 7.1
VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operat…
-
High 8.2
Linux ZCC allows unsigned updates, allowing elevated Code Execution
An Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows replacing binaries.This issue affects Linux Client Connector: before 1.4.0.105
-
High 7.5
free5GC udm vulnerable to Invalid Curve Attack
pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompressed public key that has not been validated. An attacker can send arbitrary SUCIs to the UDM, which…