Skip to content
OpenAdvisories

Weakness (CWE)

CWE-354: Improper Validation of Integrity Check Value

Base Draft

The product does not validate or incorrectly validates the integrity check values or "checksums" of a message.

How to prevent it (1 mitigation)

  1. Implementation

    The protocol specification describes the algorithm used for calculating the checksum. It is then a matter of implementing the calculation and verifying that the calculated checksum and the received checksum match.

Source: MITRE CWE-354

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-118776 Public exploit

    Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption

    Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish(), CBC and ECB modes, PKCS#7 padding to process the relevant input or security decision. node…

    digitalbazaar forge node-forge node-node-forge Ubuntu npm
  • Medium 5.9
    CVE-2026-85243 Public exploit

    Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structure

    Improper Validation of Integrity Check Value vulnerability in Apache Camel Crypto PGP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. unmarshal() verified the modification detection code only when the message w…

    Apache Software Foundation Apache Camel
  • Medium 6.3
    CVE-2026-49230 Public exploit

    Apache APISIX: Authentication bypass in jwe-decrypt

    Improper Validation of Integrity Check Value vulnerability in Apache APISIX. The jwe-decrypt plugin under default configuration is vulnerable to authentication bypass.  This issue affects Apache APISIX: from 3.8.0 through 3.16.0. Users are recommended to upgr…

    Apache Software Foundation Apache APISIX
  • Critical 9.1
    CVE-2025-54887 Public exploit

    jwe: Missing AES-GCM authentication tag validation in encrypted JWEs

    jwe is a Ruby implementation of the RFC 7516 JSON Web Encryption (JWE) standard. In versions 1.1.0 and below, authentication tags of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbit…

    jwt ruby-jwe jwe RubyGems
  • High 8.0
    CVE-2024-52550 Public exploit

    Rebuilding a run with revoked script approval allowed by Jenkins Pipeline: Groovy Plugin

    Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build who…

    Jenkins Project Jenkins Pipeline: Groovy Plugin org.jenkins-ci.plugins.workflow:workflow-cps Web / CMS Maven
  • Medium 5.9
    CVE-2023-48795 Public exploit EPSS 94%

    Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

    The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…

    openssh lxd erlang openssh Debian Ubuntu Alpine PyPI Go crates.io