Skip to content
OpenAdvisories

Weakness (CWE)

CWE-347: Improper Verification of Cryptographic Signature

Base Draft

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Source: MITRE CWE-347

All Critical High Medium Low Exploited only Public exploit

887 results · Feed

  • High 7.5
    CVE-2017-12974

    Improper Verification of Cryptographic Signature in Nimbus JOSE+JWT

    Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve, which allows attackers to conduct an Invalid Curve Attack in environments where the JCE provider lacks the applicable…

    com.nimbusds:nimbus-jose-jwt Maven
  • Medium 5.3
    CVE-2016-1494 Public exploit

    Python RSA allows attackers to spoof signatures

    The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.

    python-rsa rsa python-rsa Debian Ubuntu PyPI
  • Medium —
    CVE-2014-3577

    Improper Verification of Cryptographic Signature in org.apache.httpcomponents:httpclient

    org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of th…

    org.apache.httpcomponents:httpclient httpcomponents-client httpcomponents-client commons-httpclient Debian Ubuntu Maven
  • High 7.5
    CVE-2013-4346

    SimpleGeo python-oauth2 does not check the nonce allowing replay attacks

    The Server.verify_request function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay attacks via a signed URL.

    oauth2 PyPI
  • Medium 5.5
    CVE-2013-3900 Exploited Public exploit EPSS 45%

    WinVerifyTrust Signature Validation Vulnerability

    Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Wind…

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Jan 10, 2022
  • Critical 9.1
    CVE-2006-4339

    Openssl: openssl: signature forgery via improper pkcs-1 padding removal leading to certificate validation bypass

    A flaw was found in OpenSSL. When configured to use an RSA key with exponent 3, OpenSSL improperly removes PKCS-1 padding before generating a hash. This allows remote attackers to forge PKCS #1 v1.5 signatures. Consequently, OpenSSL may incorrectly verify X.5…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian
  • High 7.8
    CVE-2002-1796

    ChaiVM EZloader for HP color LaserJet 4500 and 4550 and HP LaserJet 4100 and 8150 does not properly verify JAR signatur…