Weakness (CWE)
CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Source: MITRE CWE-347
887 results · Feed
-
Low 3.4
Keycloak: impersonation via logout token exchange
A flaw was found in Keycloak. This issue occurs due to improperly enforcing token types when validating signatures locally. This could allow an authenticated attacker to exchange a logout token for an access token and possibly gain access to data outside of e…
-
Medium 6.8
An improper verification of cryptographic signature vulnerability [CWE-347] in FortiClient MacOS version 7.4.0, version…
-
Medium 5.3
Mutt: neomutt: in-reply-to email header field it not protected by cryptograpic signing
In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender.
-
Medium 6.5
Mutt: neomutt: to and cc email header fields are not protected by cryptographic signing
In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.
-
Critical 9.3CVE-2024-47073 Scanner template
Dataease arbitrary interface access vulnerability
DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions a the lack of signature verification of jwt tokens allows attackers to forge jwts which then allow a…
-
High 8.2
Permission control vulnerability in the hidebug module Impact: Successful exploitation of this vulnerability may affect…
-
Low 3.1
Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt
golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and …
-
Medium 6.3
Laravel Reverb has Missing API Signature Verification
Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. Prior to 1.4.0, there is an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scen…
-
Medium 5.9
Unauthorized Modifications of Firmware and Configuration
ABB is aware of privately reported vulnerabilities in the product versions referenced in this CVE. An attacker could exploit these vulnerabilities by sending a specially crafted firmware or configuration to the system node, causing the node to stop, become in…
-
High 8.7
Agent Dart missing certificate verification checks
Agent Dart is an agent library built for Internet Computer for Dart and Flutter apps. Prior to version 1.0.0-dev.29, certificate verification in `lib/agent/certificate.dart` does not occur properly. During the delegation verification in the `_checkDelegation`…
-
Critical 9.8
Improper signature verification of firmware upgrade files
The firmware upgrade function in the admin web interface of the Rittal IoT Interface & CMC III Processing Unit devices checks if the patch files are signed before executing the containing run.sh script. The signing process is kind of an HMAC with a long strin…
-
Medium 4.8
Valid ECDSA signatures erroneously rejected in Elliptic
The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of a…
-
High 7.2
CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that could compromise the Data Center Ex…
-
Critical 9.5CVE-2024-9487 EPSS 26%
An Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed when the encrypted assertions feature was enabled
An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed resulting in unauthorized provisioning of users and access to the instance. Exploitation required …
-
Critical 9.1
Elliptic's verify function omits uniqueness validation
The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.
-
Critical 9.3
XML Signature Bypass via differential XML parsing in ssoready
ssoready is a single sign on provider implemented via docker. Affected versions are vulnerable to XML signature bypass attacks. An attacker can carry out signature bypass if you have access to certain IDP-signed messages. The underlying mechanism exploits dif…
-
Medium 4.6
Alpine Halo9 Improper Verification of Cryptographic Signature Vulnerability
Alpine Halo9 Improper Verification of Cryptographic Signature Vulnerability. This vulnerability allows physically present attackers to bypass signature validation mechanism on affected installations of Alpine Halo9 devices. Authentication is not required to e…
-
High 8.8CVE-2024-7479 Public exploit
Improper signature verification of VPN driver installation in TeamViewer Remote Clients
Improper verification of cryptographic signature during installation of a VPN driver via the TeamViewer_service.exe component of TeamViewer Remote Clients prior version 15.58.4 for Windows allows an attacker with local unprivileged access on a Windows system …
-
High 8.8
Improper signature verification of Printer driver installation in TeamViewer Remote Clients
Improper verification of cryptographic signature during installation of a Printer driver via the TeamViewer_service.exe component of TeamViewer Remote Clients prior version 15.58.4 for Windows allows an attacker with local unprivileged access on a Windows sys…
-
High 7.7
Keycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloak
A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the…
-
Medium 5.3
Apache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cookie via Padding Oracle Attack
Padding Oracle vulnerability in Apache Druid extension, druid-pac4j. This could allow an attacker to manipulate a pac4j session cookie. This issue affects Apache Druid versions 0.18.0 through 30.0.0. Since the druid-pac4j extension is optional and disabled by…
-
High 7.8
Signatures in "repair mode" should not be trusted
Improper Digital Signature Invalidation vulnerability in Zip Repair Mode of The Document Foundation LibreOffice allows Signature forgery vulnerability in LibreOfficeThis issue affects LibreOffice: from 24.2 before < 24.2.5.
-
Medium 5.8CVE-2024-45607 EPSS 14%
whatsapp-api-js fails to validate message's signature
whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid. Incorrect Access Control, anyone using …
-
Critical 10.0
omniauth-saml vulnerable to Improper Verification of Cryptographic Signature
ruby-saml, the dependent SAML gem of omniauth-saml has a signature wrapping vulnerability in <= v1.12.0 and v1.13.0 to v1.16.0 , see https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2 As a result, omniauth-saml created a [new r…
-
Critical 10.0
The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector
The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by t…
-
Medium 5.3
Adyen APIs Library for Python timing attack vulnerability
Adyen has utility methods for validating notification HMAC signatures. The `is_valid_hmac` and `is_valid_hmac_notification` methods are vulnerable to a timing attack, you should compare the hash of the HMACs instead.
-
Medium 6.3
CVE-2024-38807: Signature Forgery Vulnerability in Spring Boot's Loader
Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in…
-
Critical 9.5
An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication w…
-
Medium 5.7
Signature validation error in DLL allows disabling anti-tampering protection
An Improper Validation of signature in Zscaler Client Connector on Windows allows an authenticated user to disable anti-tampering. This issue affects Client Connector on Windows <4.2.0.190.
-
Medium 6.4
Incorrect signature validation of package
The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locally executed. This affects Zscaler Client Connector on MacOS <4.2.
-
High 7.8
Signature validation issue leads to Anti-Tampering bypass
Anti-tampering can be disabled under certain conditions without signature validation. This affects Zscaler Client Connector <4.2.0.190 with anti-tampering enabled.
-
Medium 5.3CVE-2024-42461 Public exploit
Elliptic allows BER-encoded signatures
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.
-
Medium 5.3
Elliptic's EDDSA missing signature length check
In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended.
-
Medium 6.8
Cortex XDR Agent: Improper File Signature Verification Checks
An improper file signature check in Palo Alto Networks Cortex XDR agent may allow an attacker to bypass the Cortex XDR agent's executable blocking capabilities and run untrusted executables on the device. This issue can be leveraged to execute untrusted softw…
-
High 7.0
Windows Enroll Engine Security Feature Bypass Vulnerability
Windows Enroll Engine Security Feature Bypass Vulnerability
-
High 7.2
A firmware update vulnerability exists in the boa formUpload functionality of Realtek rtl819x Jungle SDK v3.4.11. A spe…
-
High 8.8
IBM WebSphere Application Server identity spoofing
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to identity spoofing by an authenticated user due to improper signature validation. IBM X-Force ID: 294721.
-
Medium 5.3
Improper verification of cryptographic signature issue exists in "FreeFrom - the nostr client" App versions prior to 1.…
-
Medium 5.4
Nextcloud user_oidc's ID4me does not validate signature or expiration
user_oidc app is an OpenID Connect user backend for Nextcloud. An attacker could potentially trick the app into accepting a request that is not signed by the correct server. It is recommended that the Nextcloud user_oidc app is upgraded to 1.3.5, 2.0.0, 3.0.0…
-
High 7.5
There is a possible escalation of privilege due to improperly used crypto. This could lead to remote escalation of priv…