CWE-345 · Insufficient Verification of Data Authenticity (page 6)
Page 6 of 8 — CVEs classified under CWE-345, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-37188 | High | 8.8 | 2021-12-10 | An issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker may load customized firmware (because the bootloader does not v… |
CVE-2021-26103 | Medium | 6.3 | 2021-12-08 | An insufficient verification of data authenticity vulnerability (CWE-345) in the user interface of FortiProxy verison 2.0.3 and below, 1.2.11 and below and For… |
CVE-2019-8921 | Medium | 6.5 | 2021-11-29 | An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ by the SDP implementation. By crafting a… |
CVE-2021-26315 | High | 7.8 | 2021-11-16 | When the AMD Platform Security Processor (PSP) boot rom loads, authenticates, and subsequently decrypts an encrypted FW, due to insufficient verification of th… |
CVE-2021-43616 | Critical | 9.0 | 2021-11-13 | The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json… |
CVE-2020-23906 | Medium | 5.5 | 2021-11-10 | FFmpeg N-98388-g76a3ee996b allows attackers to cause a denial of service (DoS) via a crafted audio file due to insufficient verification of data authenticity. |
CVE-2021-41203 | High | 7.8 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions an attacker can trigger undefined behavior, integer overflows, segfaults and `… |
CVE-2021-22460 | Medium | 5.5 | 2021-10-28 | A component of the HarmonyOS has a Insufficient Verification of Data Authenticity vulnerability. Local attackers may exploit this vulnerability to bypass the c… |
CVE-2021-26610 | High | 7.2 | 2021-10-27 | The move_uploaded_file function in godomall5 does not perform an integrity check of extension or authority when user upload file. This vulnerability allows an… |
CVE-2021-38396 | Medium | 6.5 | 2021-10-04 | The programmer installation utility does not perform a cryptographic authenticity or integrity checks of the software on the flash drive. An attacker could lev… |
CVE-2021-22947 | Medium | 5.9 | 2021-09-29 | When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and sen… |
CVE-2021-41106 | Medium | 4.4 | 2021-09-28 | JWT is a library to work with JSON Web Token and JSON Web Signature. Prior to versions 3.4.6, 4.0.4, and 4.1.5, users of HMAC-based algorithms (HS256, HS384, a… |
CVE-2021-41087 | Medium | 5.6 | 2021-09-21 | in-toto-golang is a go implementation of the in-toto framework to protect software supply chain integrity. In affected versions authenticated attackers posing… |
CVE-2021-34572 | Medium | 6.5 | 2021-09-16 | Enbra EWM 1.7.29 does not check for or detect replay attacks sent by wireless M-Bus Security mode 5 devices. Instead timestamps of the sensor are replaced by t… |
CVE-2021-26608 | High | 8.8 | 2021-09-09 | An arbitrary file download and execution vulnerability was found in the HShell.dll of handysoft Co., Ltd groupware ActiveX module. This issue is due to missing… |
CVE-2020-24672 | Critical | 9.8 | 2021-09-08 | A vulnerability in Base Software for SoftControl allows an attacker to insert and run arbitrary code in a computer running the affected product. This issue aff… |
CVE-2020-19769 | High | 7.5 | 2021-09-07 | A lack of target address verification in the BurnMe() function of Rob The Bank 1.0 allows attackers to steal tokens from victim users via a crafted script. |
CVE-2020-19768 | High | 7.5 | 2021-09-07 | A lack of target address verification in the selfdestructs() function of ICOVO 1.0 allows attackers to steal tokens from victim users via a crafted script. |
CVE-2021-40491 | Medium | 6.5 | 2021-09-03 | The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they match the server address. This is simi… |
CVE-2021-37421 | Critical | 9.8 | 2021-08-30 | Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass. |
CVE-2021-1586 | High | 8.6 | 2021-08-25 | A vulnerability in the Multi-Pod or Multi-Site network configurations for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) m… |
CVE-2021-39158 | High | 8.8 | 2021-08-23 | NVCaffe's python required dependencies list used to contain `gfortran`version prior to 0.17.4, entry which does not exist in the repository pypi.org. An attack… |
CVE-2021-38597 | Medium | 5.9 | 2021-08-12 | wolfSSL before 4.8.1 incorrectly skips OCSP verification in certain situations of irrelevant response data that contains the NoCheck extension. |
CVE-2021-21739 | Medium | 4.6 | 2021-08-05 | A ZTE's product of the transport network access layer has a security vulnerability. Because the system does not sufficiently verify the data reliability, attac… |
CVE-2021-22419 | Medium | 5.5 | 2021-08-03 | A component of the HarmonyOS has a Insufficient Verification of Data Authenticity vulnerability. Local attackers may exploit this vulnerability to cause persis… |
CVE-2021-21588 | Medium | 6.5 | 2021-07-12 | Dell EMC PowerFlex, v3.5.x contain a Cross-Site WebSocket Hijacking Vulnerability in the Presentation Server/WebUI. An unauthenticated attacker could potential… |
CVE-2021-36367 | High | 8.1 | 2021-07-09 | PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a substantive authentication response. This makes it easier for an attac… |
CVE-2021-29963 | Medium | 4.3 | 2021-06-24 | Address bar search suggestions in private browsing mode were re-using session data from normal mode. *This bug only affects Firefox for Android. Other operatin… |
CVE-2021-23998 | Medium | 6.5 | 2021-06-24 | Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page. This vulnerability affects Firefox E… |
CVE-2021-33887 | Medium | 6.8 | 2021-06-15 | Insufficient verification of data authenticity in Peloton TTR01 up to and including PTV55G allows an attacker with physical access to boot into a modified kern… |
CVE-2021-33712 | High | 8.8 | 2021-06-08 | A vulnerability has been identified in Mendix SAML Module (All versions < V2.1.2). The configuration of the SAML module does not properly check various restric… |
CVE-2021-33840 | High | 7.5 | 2021-06-04 | The server in Luca through 1.1.14 allows remote attackers to cause a denial of service (insertion of many fake records related to COVID-19) because Phone Numbe… |
CVE-2021-32665 | High | 8.8 | 2021-06-03 | wire-ios is the iOS version of Wire, an open-source secure messaging app. wire-ios versions 3.8.0 and earlier have a bug in which a conversation could be incor… |
CVE-2021-28678 | Medium | 5.5 | 2021-06-02 | An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. T… |
CVE-2021-20267 | High | 7.1 | 2021-05-28 | A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance conne… |
CVE-2020-28900 | Critical | 9.8 | 2021-05-24 | Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of Privileges or Code E… |
CVE-2021-22339 | Medium | 6.5 | 2021-05-20 | There is a denial of service vulnerability in some versions of ManageOne. In specific scenarios, due to the insufficient verification of the parameter, an atta… |
CVE-2020-24395 | Medium | 6.8 | 2021-05-20 | The USB firmware update script of homee Brain Cube v2 (2.28.2 and 2.28.4) devices allows an attacker with physical access to install compromised firmware. This… |
CVE-2021-30005 | High | 7.8 | 2021-05-11 | In JetBrains PyCharm before 2020.3.4, local code execution was possible because of insufficient checks when getting the project from VCS. |
CVE-2021-29239 | High | 7.8 | 2021-05-03 | CODESYS Development System 3 before 3.5.17.0 displays or executes malicious documents or files embedded in libraries without first checking their validity. |
CVE-2021-31783 | High | 7.5 | 2021-04-26 | show_default.php in the LocalFilesEditor extension before 11.4.0.1 for Piwigo allows Local File Inclusion because the file parameter is not validated with a pr… |
CVE-2021-29462 | High | 7.6 | 2021-04-20 | The Portable SDK for UPnP Devices is an SDK for development of UPnP device and control point applications. The server part of pupnp (libupnp) appears to be vul… |
CVE-2021-20271 | High | 7.0 | 2021-03-26 | A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemin… |
CVE-2021-1403 | High | 7.4 | 2021-03-24 | A vulnerability in the web UI feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site WebSocket hijacking (CSW… |
CVE-2021-21320 | Low | 2.6 | 2021-03-02 | matrix-react-sdk is an npm package which is a Matrix SDK for React Javascript. In matrix-react-sdk before version 3.15.0, the user content sandbox can be abuse… |
CVE-2021-3349 | Low | 3.3 | 2021-02-01 | GNOME Evolution through 3.38.3 produces a "Valid signature" message for an unknown identifier on a previously trusted key because Evolution does not retrieve e… |
CVE-2020-26547 | Critical | 9.8 | 2021-02-01 | Monal before 4.9 does not implement proper sender verification on MAM and Message Carbon (XEP-0280) results. This allows a remote attacker (able to send stanza… |
CVE-2020-9141 | Critical | 9.1 | 2021-01-13 | There is a improper privilege management vulnerability in some Huawei smartphone. Successful exploitation of this vulnerability can cause information disclosur… |
CVE-2020-16122 | High | 8.2 | 2020-11-07 | PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individua… |
CVE-2020-27670 | High | 7.8 | 2020-10-22 | An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain p… |
CVE-2020-15262 | Low | 3.7 | 2020-10-19 | In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and ther… |
CVE-2020-1677 | High | 7.2 | 2020-10-16 | When SAML authentication is enabled, Juniper Networks Mist Cloud UI might incorrectly handle child elements in SAML responses, allowing a remote attacker to mo… |
CVE-2020-9885 | Medium | 5.5 | 2020-10-16 | An issue existed in the handling of iMessage tapbacks. The issue was resolved with additional verification. This issue is fixed in iOS 13.6 and iPadOS 13.6, ma… |
CVE-2020-26893 | High | 7.8 | 2020-10-16 | An issue was discovered in ClamXAV 3 before 3.1.1. A malicious actor could use a properly signed copy of ClamXAV 2 (running with an injected malicious dylib) t… |
CVE-2020-9230 | Medium | 6.5 | 2020-10-12 | WS5800-10 version 10.0.3.25 has a denial of service vulnerability. Due to improper verification of specific message, an attacker may exploit this vulnerability… |
CVE-2020-15222 | High | 8.1 | 2020-09-24 | In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.31.0, when using "private_key_jwt" authentication the uniqueness o… |
CVE-2019-16007 | High | 7.1 | 2020-09-23 | A vulnerability in the inter-service communication of Cisco AnyConnect Secure Mobility Client for Android could allow an unauthenticated, local attacker to per… |
CVE-2019-16000 | Medium | 4.4 | 2020-09-23 | A vulnerability in the automatic update process of Cisco Umbrella Roaming Client for Windows could allow an authenticated, local attacker to install arbitrary… |
CVE-2020-24045 | High | 7.2 | 2020-09-17 | A sandbox escape issue was discovered in TitanHQ SpamTitan Gateway 7.07. It limits the admin user to a restricted shell, allowing execution of a small number o… |
CVE-2020-15163 | High | 8.7 | 2020-09-09 | Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which faile… |
CVE-2020-11493 | High | 8.1 | 2020-09-04 | In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can obtain sensitive information about an uninitialized object because of… |
CVE-2020-25019 | High | 7.5 | 2020-08-29 | jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0 calls the Electron shell.openExternal function without verifying that the URL is for an http or http… |
CVE-2020-16250 | High | 8.2 | 2020-08-26 | HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed… |
CVE-2020-13178 | Medium | 6.7 | 2020-08-11 | A function in the Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows prior to version 20.04.1 does not properly validate the signature of… |
CVE-2020-11985 | Medium | 5.3 | 2020-08-07 | IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an atta… |
CVE-2020-15899 | High | 7.5 | 2020-07-28 | Grin 3.0.0 before 4.0.0 has insufficient validation of data related to Mimblewimble. |
CVE-2020-15699 | Medium | 5.3 | 2020-07-15 | An issue was discovered in Joomla! through 3.9.19. Missing validation checks on the usergroups table object can result in a broken site configuration. |
CVE-2020-12406 | High | 8.8 | 2020-07-09 | Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash. We presume that with enough effort that it… |
CVE-2020-12119 | High | 8.1 | 2020-07-02 | Ledger Live before 2.7.0 does not handle Bitcoin's Replace-By-Fee (RBF). It increases the user's balance with the value of an unconfirmed transaction as soon a… |
CVE-2019-19160 | Medium | 5.7 | 2020-06-29 | Reportexpress ProPlus contains a vulnerability that could allow an arbitrary code execution by inserted VBscript into the configure file(rxp). |
CVE-2020-5964 | High | 7.8 | 2020-06-25 | NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the service host component, in which the application resources integrity check may… |
CVE-2020-13272 | High | 7.5 | 2020-06-19 | OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow |
CVE-2020-13265 | Medium | 4.3 | 2020-06-19 | User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification |
CVE-2020-14453 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.21.0. Socket read operations are not appropriately restricted, which allows attackers to cause a denial o… |
CVE-2020-11614 | High | 8.1 | 2020-06-11 | Mids' Reborn Hero Designer 2.6.0.7 downloads the update manifest, as well as update files, over cleartext HTTP. Additionally, the application does not perform… |
CVE-2020-6090 | High | 7.2 | 2020-06-11 | An exploitable code execution vulnerability exists in the Web-Based Management (WBM) functionality of WAGO PFC 200 03.03.10(15). A specially crafted series of… |
CVE-2020-3220 | Medium | 6.8 | 2020-06-03 | A vulnerability in the hardware crypto driver of Cisco IOS XE Software for Cisco 4300 Series Integrated Services Routers and Cisco Catalyst 9800-L Wireless Con… |
CVE-2020-10751 | Medium | 6.1 | 2020-05-26 | A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single… |
CVE-2020-6081 | High | 8.8 | 2020-05-07 | An exploitable code execution vulnerability exists in the PLC_Task functionality of 3S-Smart Software Solutions GmbH CODESYS Runtime 3.5.14.30. A specially cra… |
CVE-2020-7487 | Critical | 9.8 | 2020-04-22 | A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists which could allow the attacker to execute malicious code on the Modicon M218, M2… |
CVE-2019-11480 | High | 8.4 | 2020-04-14 | The pc-kernel snap build process hardcoded the --allow-insecure-repositories and --allow-unauthenticated apt options when creating the build chroot environment… |
CVE-2020-6443 | High | 8.8 | 2020-04-13 | Insufficient data validation in developer tools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker who had convinced the user to use devtools to… |
CVE-2019-1866 | Low | 3.1 | 2020-04-13 | Cisco Webex Business Suite before 39.1.0 contains a vulnerability that could allow an unauthenticated, remote attacker to affect the integrity of the applicati… |
CVE-2020-10266 | High | 8.1 | 2020-04-06 | UR+ (Universal Robots+) is a platform of hardware and software component sellers, for Universal Robots robots. When installing any of these components in the r… |
CVE-2019-18905 | Medium | 4.8 | 2020-04-03 | A Insufficient Verification of Data Authenticity vulnerability in autoyast2 of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows remote a… |
CVE-2020-11470 | Low | 3.3 | 2020-04-01 | Zoom Client for Meetings through 4.6.8 on macOS has the disable-library-validation entitlement, which allows a local process (with the user's privileges) to ob… |
CVE-2020-10831 | High | 7.5 | 2020-03-24 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Attackers can trigger an update to arbitrary touch-screen firmware… |
CVE-2019-20530 | Critical | 9.8 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.1), O(8.x), P(9.0), and Q(10.0) software. Arbitrary code execution is possible on the lock screen. T… |
CVE-2020-7982 | High | 8.1 | 2020-03-16 | An issue was discovered in OpenWrt 18.06.0 to 18.06.6 and 19.07.0, and LEDE 17.01.0 to 17.01.7. A bug in the fork of the opkg package manager before 2020-01-25… |
CVE-2019-17654 | High | 8.8 | 2020-03-15 | An Insufficient Verification of Data Authenticity vulnerability in FortiManager 6.2.1, 6.2.0, 6.0.6 and below may allow an unauthenticated attacker to perform… |
CVE-2019-5161 | Critical | 9.1 | 2020-03-11 | An exploitable remote code execution vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 versions 03.02.02(14), 03.01.07(13), and 03.00… |
CVE-2019-17636 | High | 8.1 | 2020-03-10 | In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/mini-browser" on npmjs… |
CVE-2020-8660 | Medium | 5.3 | 2020-03-04 | CNCF Envoy through 1.13.0 TLS inspector bypass. TLS inspector could have been bypassed (not recognized as a TLS client) by a client using only TLS 1.3. Because… |
CVE-2020-3174 | Medium | 4.7 | 2020-02-26 | A vulnerability in the anycast gateway feature of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a device to learn invalid Add… |
CVE-2019-17228 | Medium | 6.5 | 2020-02-24 | includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress allows unau… |
CVE-2019-12510 | Critical | 9.1 | 2020-02-24 | In NETGEAR Nighthawk X10-R900 prior to 1.0.4.26, an attacker may bypass all authentication checks on the device's "NETGEAR Genie" SOAP API ("/soap/server_sa")… |
CVE-2016-1000004 | Critical | 9.8 | 2020-02-19 | Insufficient type checks were employed prior to casting input data in SimpleXMLElement_exportNode and simplexml_import_dom. This issue affects HHVM versions pr… |
CVE-2019-5613 | Critical | 9.8 | 2020-02-18 | In FreeBSD 12.0-RELEASE before 12.0-RELEASE-p13, a missing check in the ipsec packet processor allows reinjection of an old packet to be accepted by the ipsec… |
CVE-2019-15613 | High | 8.0 | 2020-02-04 | A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes. |
CVE-2019-20057 | Low | 3.7 | 2019-12-29 | com.proxyman.NSProxy.HelperTool in Privileged Helper Tool in Proxyman for macOS 1.11.0 and earlier allows an attacker to change the System Proxy and redirect a… |