Skip to content
OpenAdvisories

Weakness (CWE)

CWE-347: Improper Verification of Cryptographic Signature

Base Draft

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Source: MITRE CWE-347

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 4.6
    CVE-2025-47827 Exploited Public exploit

    In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptograp…

    KEV Oct 14, 2025
  • Medium 5.3
    CVE-2024-42461 Public exploit

    Elliptic allows BER-encoded signatures

    In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.

    elliptic node-elliptic node-elliptic Debian Ubuntu npm
  • Medium 6.5
    CVE-2021-21239 Public exploit

    Open default xmlsec1 key-type preference

    PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. Users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML d…

    IdentityPython pysaml2 python-pysaml2 pysaml2 Debian Ubuntu Alpine PyPI
  • Medium —
    CVE-2020-28042 Public exploit

    Signature validation bypass in ServiceStack

    ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes a valid minimum length for a signature.

    ServiceStack NuGet
  • Medium 6.8
    CVE-2020-9047 Public exploit

    exacqVision Software - Improper Verification of Cryptographic Signature

    A vulnerability exists that could allow the execution of unauthorized code or operating system commands on systems running exacqVision Web Service versions 20.06.3.0 and prior and exacqVision Enterprise Manager versions 20.06.4.0 and prior. An attacker with a…

    Johnson Controls exacqVision Enterprise Manager versions 20.03.3.0 and prior exacqVision Web Service versions 20.03.2.0 and prior
  • Medium 5.3
    CVE-2016-1494 Public exploit

    Python RSA allows attackers to spoof signatures

    The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.

    rsa python-rsa python-rsa Debian Ubuntu PyPI
  • Medium 5.5
    CVE-2013-3900 Exploited Public exploit EPSS 45%

    WinVerifyTrust Signature Validation Vulnerability

    Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Wind…

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Jan 10, 2022