CWE-345 · Insufficient Verification of Data Authenticity (page 5)
Page 5 of 8 — CVEs classified under CWE-345, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-28863 | Critical | 9.1 | 2023-04-18 | AMI MegaRAC SPx12 and SPx13 devices have Insufficient Verification of Data Authenticity. |
CVE-2023-27748 | Critical | 9.8 | 2023-04-13 | BlackVue DR750-2CH LTE v.1.012_2022.10.26 does not employ authenticity check for uploaded firmware. This can allow attackers to upload crafted firmware which c… |
CVE-2023-26467 | Medium | 5.4 | 2023-04-10 | A man in the middle can redirect traffic to a malicious server in a compromised configuration. |
CVE-2022-48431 | Medium | 4.5 | 2023-03-29 | In JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be imported without the “Trust Project” confirmation. |
CVE-2023-27979 | Medium | 6.5 | 2023-03-21 | A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could allow the renaming of files in the IGSS project re… |
CVE-2023-27977 | Medium | 6.5 | 2023-03-21 | A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause access to delete files in the IGSS project r… |
CVE-2023-27982 | High | 8.8 | 2023-03-21 | A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause manipulation of dashboard files in the IGSS… |
CVE-2023-0350 | Medium | 6.5 | 2023-03-13 | Akuvox E11 does not ensure that a file extension is associated with the file provided. This could allow an attacker to upload a file to the device by changing… |
CVE-2017-20180 | Medium | 4.6 | 2023-03-06 | A vulnerability classified as critical has been found in Zerocoin libzerocoin. Affected is the function CoinSpend::CoinSpend of the file CoinSpend.cpp of the c… |
CVE-2023-26481 | Critical | 9.1 | 2023-03-04 | authentik is an open-source Identity Provider. Due to an insufficient access check, a recovery flow link that is created by an admin (or sent via email by an a… |
CVE-2023-21441 | High | 7.4 | 2023-02-09 | Insufficient Verification of Data Authenticity vulnerability in Routine prior to versions 2.6.30.6 in Android Q(10), 3.1.21.10 in Android R(11) and 3.5.2.23 in… |
CVE-2023-23941 | High | 7.5 | 2023-02-03 | SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used (PayPal Plus, Smart Payment Buttons, SEPA, Pay L… |
CVE-2023-23940 | Medium | 6.4 | 2023-02-03 | OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_sig… |
CVE-2023-22315 | Medium | 6.7 | 2023-01-30 | Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior use a proprietary local area network (LAN) protocol that does not verify updates to the device. An a… |
CVE-2022-46370 | High | 7.3 | 2023-01-12 | Rumpus - FTP server version 9.0.7.1 Improper Token Verification– vulnerability may allow bypassing identity verification. |
CVE-2021-26403 | Medium | 6.5 | 2023-01-11 | Insufficient checks in SEV may lead to a malicious hypervisor disclosing the launch secret potentially resulting in compromise of VM confidentiality. |
CVE-2021-26396 | Medium | 4.4 | 2023-01-11 | Insufficient validation of address mapping to IO in ASP (AMD Secure Processor) may result in a loss of memory integrity in the SNP guest. |
CVE-2022-42267 | High | 7.0 | 2022-12-30 | NVIDIA GPU Display Driver for Windows contains a vulnerability where a regular user can cause an out-of-bounds read, which may lead to code execution, denial o… |
CVE-2022-3347 | High | 7.5 | 2022-12-28 | DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. Root… |
CVE-2022-3346 | Medium | 6.5 | 2022-12-28 | DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. The… |
CVE-2022-30260 | High | 7.8 | 2022-12-26 | Emerson DeltaV Distributed Control System (DCS) has insufficient verification of firmware integrity (an inadequate checksum approach, and no signature). This a… |
CVE-2022-36315 | Medium | 4.3 | 2022-12-22 | When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entries with incorrect, d… |
CVE-2022-34471 | Medium | 6.5 | 2022-12-22 | When downloading an update for an addon, the downloaded addon update's version was not verified to match the version selected from the manifest. If the manifes… |
CVE-2022-22757 | Medium | 6.5 | 2022-12-22 | Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user's browser to… |
CVE-2022-23556 | High | 7.0 | 2022-12-22 | CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the server is behind a reverse proxy. This… |
CVE-2022-46422 | Medium | 4.8 | 2022-12-20 | An issue in Netgear WNR2000 v1 1.2.3.7 and earlier allows authenticated attackers to cause a Denial of Service (DoS) via uploading a crafted firmware image dur… |
CVE-2022-46139 | Medium | 6.5 | 2022-12-20 | TP-Link TL-WR940N V4 3.16.9 and earlier allows authenticated attackers to cause a Denial of Service (DoS) via uploading a crafted firmware image during the fir… |
CVE-2022-38873 | High | 7.5 | 2022-12-20 | D-Link devices DAP-2310 v2.10rc036 and earlier, DAP-2330 v1.06rc020 and earlier, DAP-2360 v2.10rc050 and earlier, DAP-2553 v3.10rc031 and earlier, DAP-2660 v1… |
CVE-2022-26579 | Medium | 6.0 | 2022-12-16 | PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow a root privileged attacker to install unsigned packages. The attacker must have shell a… |
CVE-2022-41961 | Medium | 4.3 | 2022-12-16 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are subject to Ineffective user bans. The attacker could register multiple… |
CVE-2022-41960 | Medium | 4.3 | 2022-12-16 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3, are subject to Insufficient Verification of Data Authenticity, resulting in D… |
CVE-2022-46692 | Medium | 5.5 | 2022-12-15 | A logic issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, iOS 15.7.2 and iPadOS 15.7… |
CVE-2021-4226 | Critical | 9.8 | 2022-12-15 | RSFirewall tries to identify the original IP address by looking at different HTTP headers. A bypass is possible due to the way it is implemented. |
CVE-2022-37928 | High | 8.0 | 2022-12-12 | Insufficient Verification of Data Authenticity vulnerability in Hewlett Packard Enterprise HPE Nimble Storage Hybrid Flash Arrays and Nimble Storage Secondary… |
CVE-2022-39909 | High | 7.1 | 2022-12-08 | Insufficient verification of data authenticity vulnerability in Samsung Gear IconX PC Manager prior to version 2.1.221019.51 allows local attackers to create a… |
CVE-2022-23491 | Medium | 6.8 | 2022-12-07 | Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi… |
CVE-2022-31877 | High | 8.8 | 2022-11-28 | An issue in the component MSI.TerminalServer.exe of MSI Center v1.0.41.0 allows attackers to escalate privileges via a crafted TCP packet. |
CVE-2022-41156 | High | 7.8 | 2022-11-25 | Remote code execution vulnerability due to insufficient verification of URLs, etc. in OndiskPlayerAgent. A remote attacker could exploit the vulnerability to c… |
CVE-2022-36111 | Medium | 5.4 | 2022-11-23 | immudb is a database with built-in cryptographic proof and verification. In versions prior to 1.4.1, a malicious immudb server can provide a falsified proof th… |
CVE-2022-39199 | Medium | 5.8 | 2022-11-22 | immudb is a database with built-in cryptographic proof and verification. immudb client SDKs use server's UUID to distinguish between different server instance… |
CVE-2022-3703 | High | 7.6 | 2022-11-10 | All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s web portal is vulnerable to accepting malicious firmware packages that could provide… |
CVE-2022-0031 | Medium | 6.7 | 2022-11-09 | A local privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XSOAR engine software running on a Linux operating system allows a local attac… |
CVE-2022-27513 | High | 8.3 | 2022-11-08 | Remote desktop takeover via phishing |
CVE-2022-26122 | Medium | 4.7 | 2022-11-02 | An insufficient verification of data authenticity vulnerability [CWE-345] in FortiClient, FortiMail and FortiOS AV engines version 6.2.168 and below and versio… |
CVE-2022-34845 | Low | 2.7 | 2022-10-25 | A firmware update vulnerability exists in the sysupgrade functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network packet can lead to arbit… |
CVE-2022-36360 | High | 7.5 | 2022-10-11 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Affected devices load firmware updates without checking the au… |
CVE-2022-20396 | Medium | 5.5 | 2022-09-13 | In SettingsActivity.java, there is a possible way to make a device discoverable over Bluetooth, without permission or user interaction, due to a permissions by… |
CVE-2022-36130 | Critical | 9.9 | 2022-09-01 | HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct scopes, allowing potent… |
CVE-2022-38625 | High | 8.8 | 2022-08-29 | Patlite NH-FB v1.46 and below was discovered to contain insufficient firmware validation during the upgrade firmware file upload process. This vulnerability al… |
CVE-2022-2255 | High | 7.5 | 2022-08-25 | A vulnerability was found in mod_wsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-… |
CVE-2021-4122 | Medium | 4.3 | 2022-08-24 | It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical… |
CVE-2022-2793 | Medium | 5.9 | 2022-08-19 | Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-353 Missing Support for Integrity Check, and has no authentication or au… |
CVE-2022-2789 | Medium | 4.7 | 2022-08-19 | Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-345 Insufficient Verification of Data Authenticity, and can display logi… |
CVE-2022-28757 | High | 8.8 | 2022-08-18 | The Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with version 5.7.3 and before 5.11.6 contains a vulnerability in the auto update pr… |
CVE-2022-30262 | High | 7.8 | 2022-08-17 | The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity. They utilize the BSAP-IP protocol to transmit firmware updates… |
CVE-2020-1755 | Medium | 5.3 | 2022-08-16 | In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, X-Forwarded-For headers could be used to spoof a user's IP, in order to bypass remote address checks. |
CVE-2022-30264 | Critical | 9.8 | 2022-08-16 | The Emerson ROC and FloBoss RTU product lines through 2022-05-02 perform insecure filesystem operations. They utilize the ROC protocol (4000/TCP, 5000/TCP) for… |
CVE-2022-37008 | High | 7.5 | 2022-08-10 | The recovery module has a vulnerability of bypassing the verification of an update package before use. Successful exploitation of this vulnerability may affect… |
CVE-2022-30315 | Critical | 9.8 | 2022-07-28 | Honeywell Experion PKS Safety Manager (SM and FSC) through 2022-05-06 has Insufficient Verification of Data Authenticity. According to FSCT-2022-0053, there is… |
CVE-2022-30272 | High | 7.2 | 2022-07-26 | The Motorola ACE1000 RTU through 2022-05-02 mishandles firmware integrity. It utilizes either the STS software suite or ACE1000 Easy Configurator for performin… |
CVE-2022-30269 | High | 8.8 | 2022-07-26 | Motorola ACE1000 RTUs through 2022-05-02 mishandle application integrity. They allow for custom application installation via either STS software, the C toolkit… |
CVE-2022-30273 | Critical | 9.8 | 2022-07-26 | The Motorola MDLC protocol through 2022-05-02 mishandles message integrity. It supports three security modes: Plain, Legacy Encryption, and New Encryption. In… |
CVE-2022-29958 | Critical | 9.8 | 2022-07-26 | JTEKT TOYOPUC PLCs through 2022-04-29 do not ensure data integrity. They utilize the unauthenticated CMPLink/TCP protocol for engineering purposes, including d… |
CVE-2022-28370 | High | 7.5 | 2022-07-14 | On Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 devices, the RPC endpoint crtc_fw_upgrade provides a means of provisioning a firmware update for the de… |
CVE-2022-34763 | Medium | 5.9 | 2022-07-13 | A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could cause loading of unauthorized firmware images due to improper verific… |
CVE-2022-31598 | Medium | 5.4 | 2022-07-12 | Due to insufficient input validation, SAP Business Objects - version 420, allows an authenticated attacker to submit a malicious request through an allowed ope… |
CVE-2015-5236 | High | 7.5 | 2022-07-07 | It was discovered that the IcedTea-Web used codebase attribute of the <applet> tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) chec… |
CVE-2022-20829 | Critical | 9.1 | 2022-06-24 | A vulnerability in the packaging of Cisco Adaptive Security Device Manager (ASDM) images and the validation of those images by Cisco Adaptive Security Applianc… |
CVE-2022-31801 | Critical | 9.8 | 2022-06-21 | An unauthenticated, remote attacker could upload malicious logic to the devices based on ProConOS/ProConOS eCLR in order to gain full control over the device. |
CVE-2022-31800 | Critical | 9.8 | 2022-06-21 | An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device. |
CVE-2022-32252 | Medium | 6.5 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The application does not perform the integrity check of the update p… |
CVE-2022-31813 | Critical | 9.8 | 2022-06-09 | Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism… |
CVE-2022-28385 | Medium | 4.6 | 2022-06-08 | An issue was discovered in certain Verbatim drives through 2022-03-31. Due to missing integrity checks, an attacker can manipulate the content of the emulated… |
CVE-2022-29220 | Medium | 6.5 | 2022-05-31 | github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests (PRs). Prior to version 3.2.0, github-action-merge-… |
CVE-2021-26368 | Medium | 4.4 | 2022-05-12 | Insufficient check of the process type in Trusted OS (TOS) may allow an attacker with privileges to enable a lesser privileged process to unmap memory owned by… |
CVE-2021-27759 | Low | 2.3 | 2022-05-06 | This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. A… |
CVE-2022-24889 | Low | 2.4 | 2022-04-27 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 21.0.8, 22.2.4, and 23.0.1, it is possible t… |
CVE-2022-20795 | Medium | 5.8 | 2022-04-21 | A vulnerability in the implementation of the Datagram TLS (DTLS) protocol in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defens… |
CVE-2020-14122 | Medium | 5.5 | 2022-04-21 | Some Xiaomi phones have information leakage vulnerabilities, and some of them may be able to forge a specific identity due to the lack of parameter verificatio… |
CVE-2020-14116 | High | 7.5 | 2022-04-21 | An intent redirection vulnerability in the Mi Browser product. This vulnerability is caused by the Mi Browser does not verify the validity of the incoming data… |
CVE-2022-26516 | High | 8.4 | 2022-04-20 | Authorized users may install a maliciously modified package file when updating the device via the web user interface. The user may inadvertently use a package… |
CVE-2021-26625 | High | 8.8 | 2022-04-19 | Insufficient Verification of input Data leading to arbitrary file download and execute was discovered in Nexacro platform. This vulnerability is caused by an a… |
CVE-2022-20774 | Medium | 6.8 | 2022-04-06 | A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated… |
CVE-2022-26871 | Critical | 9.8 | 2022-03-29 | An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead… |
CVE-2021-4031 | High | 7.5 | 2022-03-18 | Syltek application before its 10.22.00 version, does not correctly check that a product ID has a valid payment associated to it. This could allow an attacker t… |
CVE-2021-39689 | Medium | 6.7 | 2022-03-16 | In multiple functions of odsign_main.cpp, there is a possible way to persist system attack due to a logic error in the code. This could lead to local escalatio… |
CVE-2020-14115 | Critical | 9.8 | 2022-03-10 | A command injection vulnerability exists in the Xiaomi Router AX3600. The vulnerability is caused by a lack of inspection for incoming data detection. Attacker… |
CVE-2020-14111 | High | 7.8 | 2022-03-10 | A command injection vulnerability exists in the Xiaomi Router AX3600. The vulnerability is caused by a lack of inspection for incoming data detection. Attacker… |
CVE-2022-0715 | Critical | 9.1 | 2022-03-09 | A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leaked and use… |
CVE-2021-24825 | Medium | 4.3 | 2022-03-07 | The Custom Content Shortcode WordPress plugin before 4.0.2 does not validate the data passed to its load shortcode, which could allow Contributor+ (v < 4.0.1)… |
CVE-2022-25262 | Critical | 9.8 | 2022-02-25 | In JetBrains Hub before 2022.1.14434, SAML request takeover was possible. |
CVE-2021-29655 | Critical | 9.8 | 2022-02-18 | Pexip Infinity Connect before 1.8.0 omits certain provisioning authenticity checks. Thus, untrusted code may execute. |
CVE-2021-44850 | Medium | 6.8 | 2022-02-10 | On Xilinx Zynq-7000 SoC devices, physical modification of an SD boot image allows for a buffer overflow attack in the ROM. Because the Zynq-7000's boot image h… |
CVE-2022-22567 | Medium | 4.7 | 2022-02-09 | Select Dell Client Commercial and Consumer platforms are vulnerable to an insufficient verification of data authenticity vulnerability. An authenticated malici… |
CVE-2022-22994 | High | 8.8 | 2022-01-28 | A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loading through an uns… |
CVE-2021-46559 | High | 7.5 | 2022-01-26 | The firmware on Moxa TN-5900 devices through 3.1 has a weak algorithm that allows an attacker to defeat an inspection mechanism for integrity protection. |
CVE-2020-10137 | Medium | 6.5 | 2022-01-10 | Z-Wave devices based on Silicon Labs 700 series chipsets using S2 do not adequately authenticate or encrypt FIND_NODE_IN_RANGE frames, allowing a remote, unaut… |
CVE-2021-36751 | Medium | 4.2 | 2022-01-02 | ENC DataVault 7.2.3 and before, and OEM versions, use an encryption algorithm that is vulnerable to data manipulation (without knowledge of the key). This is c… |
CVE-2020-7878 | Critical | 9.8 | 2021-12-28 | An arbitrary file download and execution vulnerability was found in the VideoOffice X2.9 and earlier versions (CVE-2020-7878). This issue is due to missing sup… |
CVE-2021-45419 | High | 8.8 | 2021-12-22 | Certain Starcharge products are affected by Improper Input Validation. The affected products include: Nova 360 Cabinet <= 1.3.0.0.7b102 - Fixed: Beta1.3.0.1.0… |