Weakness (CWE)
CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Source: MITRE CWE-347
372 results · Clear filters · Feed
-
High 8.2
Flawed SK_LOAD module authenticity check in Texas Instruments OMAP L138
The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) performs an RSA check implemented in mask ROM when loading a module through the SK_LOAD routine. However, only the module header authenticity is validated. An adversary can …
-
High 7.8
BIG-IP Edge Client for macOS vulnerability
The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. This vulnerability is due to an incomplete fix for CVE-2023-38418. Note: Software versions which have reached End of Technical…
-
High 7.8
A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected ap…
-
High 7.8
Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acro…
-
High 7.2
Motorola EBTS/MBTS Base Radio fails to check firmware authenticity. The Motorola MBTS Base Radio lacks cryptographic si…
-
High 7.2
Motorola MBTS Site Controller fails to check firmware update authenticity. The Motorola MBTS Site Controller lacks cryp…
-
High 8.8
Improper privilege management in Zoom Desktop Client for Windows and Zoom Rooms for Windows before 5.15.5 may allow an …
-
High 7.8
BIG-IP Edge Client for macOS vulnerability
The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
-
High 7.2
Dell PowerStore versions prior to 3.5 contain an improper verification of cryptographic signature vulnerability. An att…
-
High 8.7
Improper privilege management in Zoom for Windows, Zoom Rooms for Windows, and Zoom VDI for Windows clients before 5.14…
-
High 8.4
Verification bypass can cause users into verifying the wrong artifact
notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry can cause users to verify the wrong artifact. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation-g…
-
High 7.8
Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acro…
-
High 7.8
A vulnerability in the upgrade signature verification of Cisco Enterprise NFV Infrastructure Software (NFVIS) could all…
-
High 7.8
In the Android operating system, there is a possible way to replace a boot partition due to improperly used crypto. Thi…
-
High 7.8
Dell Command | Update, Dell Update, and Alienware Update versions prior to 4.7 contain a improper verification of crypt…
-
High 7.5
In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n…
-
High 7.5
CRYSTALS-DILITHIUM (in Post-Quantum Cryptography Selected Algorithms 2022) in PQClean d03da30 may allow universal forge…
-
High 7.5
Incorrect validation of root DNSSEC public keys in github.com/peterzen/goresolver
DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. Root DNSSEC public keys are not validated, permitting an attacker to present a self-signed root key and …
-
High 7.8
Insufficient verification of multiple header signatures while loading a Trusted Application (TA) may allow an attacker …
-
High 7.0
A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in the SGIUtility component that allow…
-
High 7.0
A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that allows adversaries with local use…
-
High 7.7
Signature bypass via multiple root elements in node-SAML
node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary ID…
-
High 7.4CVE-2022-39299 Public exploit
Signature bypass via multiple root elements in Passport-SAML
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession…
-
High 7.5
secp256k1-js implements ECDSA without required r and s validation, leading to signature forgery
The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery.
-
High 7.3
Signature checks not applied to some retrieved missing events
Dendrite is a Matrix homeserver written in Go. In affected versions events retrieved from a remote homeserver using the `/get_missing_events` path did not have their signatures verified correctly. This could potentially allow a remote homeserver to provide in…
-
High 8.8
Local Privilege Escalation in the Zoom Rooms for Windows Client
Zoom Rooms for Conference Rooms for Windows versions before 5.11.0 are susceptible to a Local Privilege Escalation vulnerability. A local low-privileged malicious user could exploit this vulnerability to escalate their privileges to the SYSTEM user.
-
High 8.8
Local Privilege Escalation in Zoom Client for Meetings for MacOS
The Zoom Client for Meetings for MacOS (Standard and for IT Admin) before version 5.11.3 contains a vulnerability in the package signature validation during the update process. A local low-privileged user could exploit this vulnerability to escalate their pri…
-
High 8.8
Local Privilege Escalation in Auto Updater for Zoom Client for Meetings for macOS
The Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with version 5.7.3 and before 5.11.5 contains a vulnerability in the auto update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to …
-
High 7.1
Ability to bypass attestation verification in sigstore PolicyController
PolicyController is a utility used to enforce supply chain policy in Kubernetes clusters. In versions prior to 0.2.1 PolicyController will report a false positive, resulting in an admission when it should not be admitted when there is at least one attestation…
-
High 7.1
False positive signature verification in cosign
cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. `cosign verify-attestation` used with the `--type` flag will report a false positive verification when there is a…
-
High 7.5
OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers
OpenZeppelin Contracts is a library for smart contract development. Versions 4.1.0 until 4.7.1 are vulnerable to the SignatureChecker reverting. `SignatureChecker.isValidSignatureNow` is not expected to revert. However, an incorrect assumption about Solidity …
-
High 7.7
Improper Verification of Cryptographic Signature
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. Workaround: Val…
-
High 8.7
Incorrect signature verification on Google-oauth-java-client
The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from valid provider, not from someone else. An attacker can provide a compromised token with custom payloa…
-
High 7.6
B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus
An improper verification of the cryptographic signature of firmware updates of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers to generate valid firmware updates with arbitr…
-
High 7.2
AVEVA System Platform Improper Verification of Cryptographic Signature
AVEVA System Platform versions 2017 through 2020 R2 P01 does not verify, or incorrectly verifies, the cryptographic signature for data.
-
High 8.8
SaltStack Improper Verification of Cryptographic Signature
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.
-
High 7.5
Improper Verification of Cryptographic Signature in `node-forge`
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. …
-
High 7.5
Improper Verification of Cryptographic Signature in node-forge
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structur…
-
High 8.1
Failure to validate signature during handshake in @chainsafe/libp2p-noise
`@chainsafe/libp2p-noise` contains TypeScript implementation of noise protocol, an encryption protocol used in libp2p. `@chainsafe/libp2p-noise` before 4.1.2 and 5.0.3 does not correctly validate signatures during the handshake process. This may allow a man-i…
-
High 7.8
coreos-installer improperly verifies GPG signature when decompressing gzipped artifact
An improper signature verification vulnerability was found in coreos-installer. A specially crafted gzip installation image can bypass the image signature verification and as a consequence can lead to the installation of unsigned content. An attacker able to …