CWE-345 · Insufficient Verification of Data Authenticity (page 5)
Page 5 of 9 — CVEs classified under CWE-345, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-43108 | Medium | 5.3 | 2024-09-26 | The goTenna Pro ATAK Plugin uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. This leaves mess… |
CVE-2024-23922 | Medium | 6.8 | 2024-09-23 | Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute… |
CVE-2024-45410 | Critical | 9.8 | 2024-09-19 | Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-… |
CVE-2022-4533 | Medium | 5.3 | 2024-09-19 | The Limit Login Attempts Plus plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.1.0. This is due to insufficient re… |
CVE-2023-28457 | High | 7.5 | 2024-09-18 | An issue was discovered in Technitium through 11.0.3. It enables attackers to conduct a DNS cache poisoning attack and inject fake responses within 1 second, w… |
CVE-2024-42483 | Medium | 6.5 | 2024-09-12 | ESP-NOW Component provides a connectionless Wi-Fi communication protocol. An replay attacks vulnerability was discovered in the implementation of the ESP-NOW b… |
CVE-2024-25584 | Medium | 5.3 | 2024-09-06 | Dovecot accepts dot LF DOT LF symbol as end of DATA command. RFC requires that it should always be CR LF DOT CR LF. This causes Dovecot to convert single mail… |
CVE-2022-4539 | Medium | 5.3 | 2024-08-31 | The Web Application Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1.2. This is due to insufficient res… |
CVE-2024-7980 | High | 7.8 | 2024-08-21 | Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a cra… |
CVE-2024-7979 | High | 7.8 | 2024-08-21 | Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a cra… |
CVE-2024-38198 | High | 7.5 | 2024-08-13 | Windows Print Spooler Elevation of Privilege Vulnerability |
CVE-2024-37968 | High | 7.5 | 2024-08-13 | Windows DNS Spoofing Vulnerability |
CVE-2023-28865 | Medium | 6.6 | 2024-08-08 | Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR15, 4.0.0 SR05, 4.1.0 SR03, and 4.2.0 SR02 fails to validate the directory contents of certain dire… |
CVE-2024-7256 | High | 8.8 | 2024-08-01 | Insufficient data validation in Dawn in Google Chrome on Android prior to 127.0.6533.88 allowed a remote attacker to execute arbitrary code via a crafted HTML… |
CVE-2024-38432 | Medium | 5.5 | 2024-07-30 | Matrix Tafnit v8 - CWE-646: Reliance on File Name or Extension of Externally-Supplied File |
CVE-2024-25638 | High | 8.9 | 2024-07-22 | dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs… |
CVE-2024-40644 | Medium | 6.8 | 2024-07-18 | gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. `gix-path` can be tricked into running another `git.exe` placed in an untrusted locat… |
CVE-2024-3173 | High | 8.8 | 2024-07-16 | Insufficient data validation in Updater in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to perform OS-level privilege escalation via a malici… |
CVE-2024-39689 | High | 7.5 | 2024-07-05 | Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi… |
CVE-2024-37370 | High | 7.5 | 2024-06-28 | In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped… |
CVE-2024-33687 | High | 7.5 | 2024-06-24 | Insufficient verification of data authenticity issue exists in NJ Series CPU Unit all versions and NX Series CPU Unit all versions. If a user program in the af… |
CVE-2022-44593 | Low | 3.7 | 2024-06-21 | Use of Less Trusted Source vulnerability in SolidWP Solid Security allows HTTP DoS.This issue affects Solid Security: from n/a through 9.3.1. |
CVE-2024-5458 | Medium | 5.3 | 2024-06-09 | In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating… |
CVE-2024-30162 | High | 7.2 | 2024-06-07 | Invision Community through 4.7.16 allows remote code execution via the applications/core/modules/admin/editor/toolbar.php IPS\core\modules\admin\editor\_toolba… |
CVE-2024-5684 | Medium | 6.3 | 2024-06-06 | An attacker with access to the private network (the charger is connected to) or local access to the Ethernet-Interface can exploit a faulty implementation of t… |
CVE-2024-3049 | Medium | 5.9 | 2024-06-06 | A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcry_md_get_algo_dlen(), it may allow an invalid HMAC to be accep… |
CVE-2024-2382 | Medium | 5.3 | 2024-06-04 | The Authorize.net Payment Gateway For WooCommerce plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 8.0. This is due t… |
CVE-2024-1718 | Medium | 5.3 | 2024-06-04 | The Claudio Sanches – Checkout Cielo for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient payment valida… |
CVE-2024-23601 | Critical | 9.8 | 2024-05-28 | A code injection vulnerability exists in the scan_lib.bin functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted scan_lib.bin can lead to arbi… |
CVE-2024-31341 | Medium | 5.3 | 2024-05-17 | Insufficient Verification of Data Authenticity vulnerability in Cozmoslabs Profile Builder allows Functionality Bypass.This issue affects Profile Builder: from… |
CVE-2023-6323 | Medium | 4.3 | 2024-05-15 | ThroughTek Kalay SDK does not verify the authenticity of received messages, allowing an attacker to impersonate an authoritative server. |
CVE-2024-35175 | Medium | 5.3 | 2024-05-14 | sshpiper is a reverse proxy for sshd. Starting in version 1.0.50 and prior to version 1.3.0, the way the proxy protocol listener is implemented in sshpiper can… |
CVE-2023-45586 | Medium | 5.0 | 2024-05-14 | An insufficient verification of data authenticity vulnerability [CWE-345] in Fortinet FortiOS SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 th… |
CVE-2024-33494 | Medium | 6.5 | 2024-05-14 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (… |
CVE-2024-34354 | Medium | 6.5 | 2024-05-14 | CMSaaSStarter is a SaaS template/boilerplate built with SvelteKit, Tailwind, and Supabase. Any forks of the CMSaaSStarter template before commit 7904d416d2c72e… |
CVE-2023-27360 | High | 8.8 | 2024-05-03 | NETGEAR RAX30 lighttpd Misconfiguration Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on… |
CVE-2023-6236 | High | 7.3 | 2024-04-10 | A flaw was found in Red Hat Enterprise Application Platform 8. When an OIDC app that serves multiple tenants attempts to access the second tenant, it should pr… |
CVE-2023-52546 | High | 7.5 | 2024-04-08 | Vulnerability of package name verification being bypassed in the Calendar app. Impact: Successful exploitation of this vulnerability may affect service confide… |
CVE-2024-30250 | High | 7.5 | 2024-04-04 | Astro-Shield is an integration to enhance website security with SubResource Integrity hashes, Content-Security-Policy headers, and other techniques. Versions f… |
CVE-2023-35764 | Medium | 5.3 | 2024-04-03 | Insufficient verification of data authenticity issue in Survey Maker prior to 3.6.4 allows a remote unauthenticated attacker to spoof an IP address when postin… |
CVE-2024-2384 | Medium | 4.3 | 2024-03-20 | The WooCommerce POS plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 1.4.11. This is due to the plugin not pr… |
CVE-2024-27773 | High | 8.8 | 2024-03-18 | Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-348: Use of Less Trusted Source may allow RCE |
CVE-2024-28251 | Medium | 5.6 | 2024-03-14 | Querybook is a Big Data Querying UI, combining collocated table metadata and a simple notebook interface. Querybook's datadocs functionality works by using a W… |
CVE-2024-1321 | Medium | 5.3 | 2024-03-13 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 3.4.2. This i… |
CVE-2024-27305 | Medium | 5.3 | 2024-03-12 | aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vuln… |
CVE-2024-1554 | Critical | 9.8 | 2024-02-20 | The `fetch()` API and navigation incorrectly shared the same cache, as the cache key did not include the optional headers `fetch()` may contain. Under the cor… |
CVE-2023-20570 | Low | 3.3 | 2024-02-13 | Insufficient verification of data authenticity in the configuration state machine may allow a local attacker to potentially load arbitrary bitstreams. |
CVE-2023-32329 | Medium | 6.2 | 2024-02-03 | IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10… |
CVE-2024-24557 | Medium | 6.9 | 2024-02-01 | Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image… |
CVE-2023-52109 | High | 7.5 | 2024-01-16 | Vulnerability of trust relationships being inaccurate in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentialit… |
CVE-2023-51766 | Medium | 5.3 | 2023-12-24 | Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e… |
CVE-2023-51765 | Medium | 5.3 | 2023-12-24 | sendmail through 8.17.2 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages… |
CVE-2023-51764 | Medium | 5.3 | 2023-12-24 | Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (o… |
CVE-2023-51655 | Medium | 6.3 | 2023-12-21 | In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified in the project con… |
CVE-2023-45292 | Medium | 5.3 | 2023-12-11 | When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the… |
CVE-2023-44402 | Medium | 6.1 | 2023-12-01 | Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. This only impacts apps that have the `embe… |
CVE-2023-49087 | Medium | 6.8 | 2023-11-30 | xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash value of the relate… |
CVE-2023-48238 | High | 7.5 | 2023-11-17 | joaquimserafim/json-web-token is a javascript library use to interact with JSON Web Tokens (JWT) which are a compact URL-safe means of representing claims to b… |
CVE-2023-47631 | High | 7.2 | 2023-11-14 | vantage6 is a framework to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). In affected version… |
CVE-2023-47630 | High | 7.1 | 2023-11-14 | Kyverno is a policy engine designed for Kubernetes. An issue was found in Kyverno that allowed an attacker to control the digest of images used by Kyverno user… |
CVE-2023-46445 | Medium | 5.9 | 2023-11-14 | An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack, aka a "Rogue Extension Neg… |
CVE-2023-42816 | Medium | 6.1 | 2023-11-13 | Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. T… |
CVE-2023-5747 | High | 7.2 | 2023-11-13 | Bashis, a Security Researcher at IPVM has found a flaw that allows for a remote code execution during the installation of Wave on the camera device. The Wave s… |
CVE-2023-5548 | Low | 3.3 | 2023-11-09 | Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection. |
CVE-2023-4699 | Critical | 10.0 | 2023-11-06 | Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC-F Series CPU modules, MELSEC iQ-F Series, MELSEC iQ-R seri… |
CVE-2023-5482 | High | 8.8 | 2023-11-01 | Insufficient data validation in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform out of bounds memory access via a crafted HTM… |
CVE-2023-41898 | High | 8.6 | 2023-10-19 | Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in… |
CVE-2023-41896 | High | 7.1 | 2023-10-19 | Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure53 detected `auth_callback=1`, which is… |
CVE-2023-43800 | High | 7.3 | 2023-10-18 | Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint `/v2/pkgs/tools/installed`. A user who has the abi… |
CVE-2023-38552 | High | 7.5 | 2023-10-18 | When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged… |
CVE-2023-43666 | Medium | 6.5 | 2023-10-16 | Insufficient Verification of Data Authenticity vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, General user can vi… |
CVE-2023-42782 | Medium | 5.3 | 2023-10-10 | A insufficient verification of data authenticity vulnerability [CWE-345] in FortiAnalyzer version 7.4.0 and below 7.2.3 allows a remote unauthenticated attacke… |
CVE-2023-5450 | High | 7.3 | 2023-10-10 | An insufficient verification of data vulnerability exists in BIG-IP Edge Client Installer on macOS that may allow an attacker elevation of privileges during t… |
CVE-2023-5366 | High | 7.1 | 2023-10-06 | A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This issue may allow a lo… |
CVE-2023-39347 | High | 7.6 | 2023-09-27 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to update pod labels can cause Cilium t… |
CVE-2015-8371 | High | 8.8 | 2023-09-21 | Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-controlled code entering a server-side b… |
CVE-2023-43636 | High | 8.8 | 2023-09-20 | In EVE OS, the “measured boot” mechanism prevents a compromised device from accessing the encrypted data located in the vault. As per the “measured boot” d… |
CVE-2023-26141 | High | 7.5 | 2023-09-14 | Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker… |
CVE-2023-20236 | Medium | 6.7 | 2023-09-13 | A vulnerability in the iPXE boot function of Cisco IOS XR software could allow an authenticated, local attacker to install an unverified software image on an a… |
CVE-2023-4589 | Critical | 9.1 | 2023-09-06 | Insufficient verification of data authenticity vulnerability in Delinea Secret Server, in its v10.9.000002 version. An attacker with an administrator account c… |
CVE-2023-35719 | Medium | 6.8 | 2023-09-06 | ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability. This vulnerability allows physi… |
CVE-2023-35906 | Medium | 5.3 | 2023-09-05 | IBM Aspera Faspex 5.0.5 could allow a remote attacked to bypass IP restrictions due to improper access controls. IBM X-Force ID: 259649. |
CVE-2023-41045 | Low | 3.7 | 2023-08-31 | Graylog is a free and open log management platform. Graylog makes use of only one single source port for DNS queries. Graylog binds a single socket for outgoin… |
CVE-2023-38831 | High | 7.8 | 2023-08-23 | RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because… |
CVE-2023-22955 | High | 7.8 | 2023-08-11 | An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. The validation of firmware images only consists of simple checksum checks for differ… |
CVE-2023-36541 | High | 8.0 | 2023-08-08 | Insufficient verification of data authenticity in Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of priv… |
CVE-2023-4177 | Low | 2.6 | 2023-08-06 | A vulnerability was found in EmpowerID up to 7.205.0.0. It has been rated as problematic. This issue affects some unknown processing of the component Multi-Fac… |
CVE-2023-36139 | Critical | 9.8 | 2023-08-04 | In PHPJabbers Cleaning Business Software 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers… |
CVE-2023-36134 | Critical | 9.8 | 2023-08-04 | In PHP Jabbers Class Scheduling System 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers t… |
CVE-2023-3749 | High | 7.1 | 2023-08-03 | A local user could edit the VideoEdge configuration file and interfere with VideoEdge operation. |
CVE-2023-36858 | High | 7.1 | 2023-08-02 | An insufficient verification of data vulnerability exists in BIG-IP Edge Client for Windows and macOS that may allow an attacker to modify its configured serv… |
CVE-2023-2314 | Medium | 6.5 | 2023-07-29 | Insufficient data validation in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a crafted HTML… |
CVE-2023-37920 | High | 7.5 | 2023-07-25 | Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi… |
CVE-2023-30562 | Medium | 6.7 | 2023-07-13 | A GRE dataset file within Systems Manager can be tampered with and distributed to PCUs. |
CVE-2023-30559 | Medium | 5.2 | 2023-07-13 | The firmware update package for the wireless card is not properly signed and can be modified. |
CVE-2023-25178 | Critical | 9.8 | 2023-07-13 | Controller may be loaded with malicious firmware which could enable remote code execution. See Honeywell Security Notification for recommendations on upgrading… |
CVE-2023-37264 | Low | 3.7 | 2023-07-07 | Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, wh… |
CVE-2023-3325 | High | 8.1 | 2023-06-20 | The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the use of an insufficiently unique cryptographic signature on the 'cmsc_ad… |
CVE-2023-30759 | High | 7.8 | 2023-06-19 | The driver installation package created by Printer Driver Packager NX v1.0.02 to v1.1.25 fails to detect its modification and may spawn an unexpected process w… |
CVE-2023-2897 | Low | 3.7 | 2023-06-09 | The Brizy Page Builder plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.4.18. This is due to an implicit trust of… |