CWE-345 · Insufficient Verification of Data Authenticity (page 7)
Page 7 of 8 — CVEs classified under CWE-345, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-18829 | High | 7.8 | 2019-12-17 | Barco ClickShare Button R9861500D01 devices before 1.10.0.13 have Missing Support for Integrity Check. The Barco signed 'Clickshare_For_Windows.exe' binary on… |
CVE-2019-18824 | Medium | 6.6 | 2019-12-17 | Barco ClickShare Button R9861500D01 devices before 1.10.0.13 have Missing Support for Integrity Check. The ClickShare Button does not verify the integrity of t… |
CVE-2019-5291 | Medium | 5.9 | 2019-12-13 | Some Huawei products have an insufficient verification of data authenticity vulnerability. A remote, unauthenticated attacker has to intercept specific packets… |
CVE-2013-2167 | Critical | 9.8 | 2019-12-10 | python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass |
CVE-2019-15971 | Medium | 4.3 | 2019-11-26 | A vulnerability in the MP3 detection engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker… |
CVE-2019-2289 | Critical | 9.8 | 2019-11-21 | Lack of integrity check allows MODEM to accept any NAS messages which can result into authentication bypass of NAS in Snapdragon Auto, Snapdragon Compute, Snap… |
CVE-2019-5246 | Medium | 6.2 | 2019-11-13 | Smartphones with software of ELLE-AL00B 9.1.0.109(C00E106R1P21), 9.1.0.113(C00E110R1P21), 9.1.0.125(C00E120R1P21), 9.1.0.135(C00E130R1P21), 9.1.0.153(C00E150R1… |
CVE-2019-5229 | Medium | 6.2 | 2019-11-12 | P30 smartphones with versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1) have an insufficient verification vulnerability. The system does not verify certai… |
CVE-2019-18835 | Critical | 9.8 | 2019-11-08 | Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /send_join, /send_leave, and /invite may not be correctly s… |
CVE-2019-8112 | High | 7.5 | 2019-11-05 | A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can bypass the email con… |
CVE-2019-3979 | High | 7.5 | 2019-10-29 | RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below are vulnerable to a DNS unrelated data attack. The router adds all A records to its DNS cache even… |
CVE-2019-6475 | Medium | 5.9 | 2019-10-17 | Mirror zones are a BIND feature allowing recursive servers to pre-cache zone data provided by other servers. A mirror zone is similar to a zone of type seconda… |
CVE-2019-15162 | Medium | 5.3 | 2019-10-03 | rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platforms provides details about why authentication failed, which might make it easier for attackers to… |
CVE-2019-10492 | High | 7.8 | 2019-09-30 | Boot image not getting verified by AVB in Snapdragon Auto, Snapdragon Mobile, Snapdragon Wearables in MDM9607, MSM8909W, Qualcomm 215, SD 210/SD 212/SD 205, SD… |
CVE-2019-11737 | Medium | 5.3 | 2019-09-27 | If a wildcard ('*') is specified for the host in Content Security Policy (CSP) directives, any port or path restriction of the directive will be ignored, leadi… |
CVE-2019-16398 | Medium | 6.8 | 2019-09-19 | On Keeper K5 20.1.0.25 and 20.1.0.63 devices, remote code execution can occur by inserting an SD card containing a file named zskj_script_run.sh that executes… |
CVE-2019-12620 | Medium | 5.3 | 2019-09-18 | A vulnerability in the statistics collection service of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to inject arbitrary values on… |
CVE-2019-5478 | Medium | 5.5 | 2019-09-03 | A weakness was found in Encrypt Only boot mode in Zynq UltraScale+ devices. This could lead to an adversary being able to modify the control fields of the boot… |
CVE-2019-6695 | Critical | 9.8 | 2019-08-23 | Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below may allow an attacker to implant third-par… |
CVE-2019-10943 | High | 7.5 | 2019-08-13 | A vulnerability has been identified in SIMATIC Drive Controller family (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (… |
CVE-2019-10181 | High | 8.1 | 2019-07-31 | It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verific… |
CVE-2019-13483 | High | 7.3 | 2019-07-25 | Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing. This allows attackers to forge tokens and bypa… |
CVE-2019-12804 | Medium | 5.5 | 2019-07-10 | In Hunesion i-oneNet version 3.0.7 ~ 3.0.53 and 4.0.4 ~ 4.0.16, due to the lack of update file integrity checking in the upgrade process, an attacker can craft… |
CVE-2019-1932 | Medium | 6.7 | 2019-07-06 | A vulnerability in Cisco Advanced Malware Protection (AMP) for Endpoints for Windows could allow an authenticated, local attacker with administrator privileges… |
CVE-2019-3875 | Medium | 6.5 | 2019-06-12 | A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL lis… |
CVE-2019-10157 | Medium | 4.7 | 2019-06-12 | It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . An… |
CVE-2019-1880 | Medium | 4.4 | 2019-06-05 | A vulnerability in the BIOS upgrade utility of Cisco Unified Computing System (UCS) C-Series Rack Servers could allow an authenticated, local attacker to insta… |
CVE-2019-5587 | Medium | 6.5 | 2019-06-04 | Lack of root file system integrity checking in Fortinet FortiOS VM application images all versions below 6.0.5 may allow attacker to implant malicious programs… |
CVE-2019-5431 | Medium | 5.4 | 2019-05-06 | This vulnerability was caused by an incomplete fix to CVE-2017-0911. Twitter Kit for iOS versions 3.0 to 3.4.0 is vulnerable to a callback verification flaw in… |
CVE-2019-3786 | High | 7.1 | 2019-04-24 | Cloud Foundry BOSH Backup and Restore CLI, all versions prior to 1.5.0, does not check the authenticity of backup scripts in BOSH. A remote authenticated malic… |
CVE-2019-11235 | Critical | 9.8 | 2019-04-22 | FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid p… |
CVE-2018-17287 | Medium | 4.9 | 2019-04-18 | In Kofax Front Office Server Administration Console 4.1.1.11.0.5212, some fields, such as passwords, are obfuscated in the front-end, but the cleartext value c… |
CVE-2018-19971 | Critical | 9.8 | 2019-04-16 | JFrog Artifactory Pro 6.5.9 has Incorrect Access Control. |
CVE-2019-0805 | High | 7.8 | 2019-04-09 | An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulne… |
CVE-2017-17023 | High | 8.1 | 2019-04-09 | The Sophos UTM VPN endpoint interacts with client software provided by NPC Engineering (www.ncp-e.com). The affected client software, "Sophos IPSec Client" 11… |
CVE-2015-3956 | Critical | 9.8 | 2019-03-25 | Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior acc… |
CVE-2019-1667 | Low | 3.3 | 2019-02-21 | A vulnerability in the Graphite interface of Cisco HyperFlex software could allow an authenticated, local attacker to write arbitrary data to the Graphite inte… |
CVE-2019-1000013 | High | 8.8 | 2019-02-04 | Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can result in Package modi… |
CVE-2019-1000012 | High | 8.8 | 2019-02-04 | Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in Package registry verification that can result in Package modificat… |
CVE-2019-7323 | High | 7.5 | 2019-02-04 | GUP (generic update process) in LightySoft LogMX before 7.4.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to… |
CVE-2019-3807 | Low | 3.7 | 2019-01-29 | An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authoritative servers w… |
CVE-2018-15801 | High | 7.4 | 2018-12-19 | Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation. In order to be impacted, the same pri… |
CVE-2018-7798 | High | 8.2 | 2018-11-02 | A Insufficient Verification of Data Authenticity (CWE-345) vulnerability exists in the Modicon M221, all versions, which could cause a change of IPv4 configura… |
CVE-2018-17938 | Medium | 5.3 | 2018-10-03 | Zimbra Collaboration before 8.8.10 GA allows text content spoofing via a loginErrorCode value. |
CVE-2018-10626 | Medium | 4.4 | 2018-08-10 | Medtronic MyCareLink Patient Monitor’s update service does not sufficiently verify the authenticity of the data uploaded. An attacker who obtains per-product… |
CVE-2018-10894 | Medium | 5.4 | 2018-08-01 | It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unautho… |
CVE-2017-3224 | High | 8.2 | 2018-07-24 | Open Shortest Path First (OSPF) protocol implementations may improperly determine Link State Advertisement (LSA) recency for LSAs with MaxSequenceNumber. Accor… |
CVE-2018-2434 | Medium | 4.3 | 2018-07-10 | A content spoofing vulnerability in the following components allows to render html pages containing arbitrary plain text content, which might fool an end user… |
CVE-2017-3198 | Critical | 9.8 | 2018-07-09 | GIGABYTE BRIX UEFI firmware does not cryptographically validate images prior to updating the system firmware. Additionally, the firmware updates are served ove… |
CVE-2018-12333 | High | 8.1 | 2018-06-17 | Insufficient Verification of Data Authenticity vulnerability in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to manipulate security relevant confi… |
CVE-2017-1405 | Medium | 4.4 | 2018-06-08 | IBM Security Identity Manager Virtual Appliance 7.0 processes patches, image backups and other updates without sufficiently verifying the origin and integrity… |
CVE-2018-6562 | High | 7.5 | 2018-05-18 | totemomail Encryption Gateway before 6.0_b567 allows remote attackers to obtain sensitive information about user sessions and encryption key material via a JSO… |
CVE-2018-7932 | High | 8.8 | 2018-04-24 | Huawei AppGallery versions before 8.0.4.301 has an arbitrary Javascript running vulnerability. An attacker may set up a malicious network environment and trick… |
CVE-2018-10080 | High | 8.6 | 2018-04-13 | Secutech RiS-11, RiS-22, and RiS-33 devices with firmware V5.07.52_es_FRI01 allow DNS settings changes via a goform/AdvSetDns?GO=wan_dns.asp request in conjunc… |
CVE-2017-2667 | High | 8.1 | 2018-03-12 | Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it by default. As a r… |
CVE-2017-1773 | Medium | 4.0 | 2018-01-31 | IBM DataPower Gateways 7.1, 7,2, 7.5, and 7.6 could allow an attacker using man-in-the-middle techniques to spoof DNS responses to perform DNS cache poisoning… |
CVE-2017-12740 | Medium | 5.9 | 2017-12-26 | Siemens LOGO! Soft Comfort (All versions before V8.2) lacks integrity verification of software packages downloaded via an unprotected communication channel. Th… |
CVE-2017-14091 | High | 7.5 | 2017-12-16 | A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which certain specific installations that utilize a uncommon feature - Other Update Sources… |
CVE-2017-2701 | Low | 3.3 | 2017-11-22 | Mate 9 with software MHA-AL00AC00B125 has a denial of service (DoS) vulnerability. An attacker tricks a user into installing a malicious application. Since the… |
CVE-2017-13083 | Medium | 5.3 | 2017-10-18 | Akeo Consulting Rufus prior to version 2.17.1187 does not adequately validate the integrity of updates downloaded over HTTP, allowing an attacker to easily con… |
CVE-2017-10624 | High | 7.5 | 2017-10-13 | Insufficient verification of node certificates in Juniper Networks Junos Space may allow a man-in-the-middle type of attacker to make unauthorized modification… |
CVE-2017-10862 | Medium | 5.3 | 2017-10-12 | jwt-scala 1.2.2 and earlier fails to verify token signatures correctly which may lead to an attacker being able to pass specially crafted JWT data as a correct… |
CVE-2015-9232 | Medium | 5.3 | 2017-09-20 | The Good for Enterprise application 3.0.0.415 for Android does not use signature protection for its Authentication Delegation API intent. Also, the Good Dynami… |
CVE-2017-12972 | High | 7.5 | 2017-08-20 | In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length values from bytes to bits, which allows attackers to conduct HMAC byp… |
CVE-2017-7674 | Medium | 4.3 | 2017-08-11 | The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating th… |
CVE-2017-11379 | High | 7.5 | 2017-08-01 | Configuration and database backup archives are not signed or validated in Trend Micro Deep Discovery Director 1.1. |
CVE-2017-11130 | High | 8.1 | 2017-08-01 | An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. The product's protocol o… |
CVE-2017-11103 | High | 8.1 | 2017-07-13 | Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in a way that violates… |
CVE-2017-11178 | High | 7.5 | 2017-07-12 | In FineCMS through 2017-07-11, application/core/controller/style.php allows remote attackers to write to arbitrary files via the contents and filename paramete… |
CVE-2017-3219 | High | 8.8 | 2017-06-21 | Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified using a server-provid… |
CVE-2017-3218 | High | 8.8 | 2017-06-21 | Samsung Magician 5.0 fails to validate TLS certificates for HTTPS software update traffic. Prior to version 5.0, Samsung Magician uses HTTP for software update… |
CVE-2017-9606 | High | 7.3 | 2017-06-15 | Infotecs ViPNet Client and Coordinator before 4.3.2-42442 allow local users to gain privileges by placing a Trojan horse ViPNet update file in the update folde… |
CVE-2017-0563 | High | 7.8 | 2017-04-07 | An elevation of privilege vulnerability in the HTC touchscreen driver could enable a local malicious application to execute arbitrary code within the context o… |
CVE-2016-3016 | Medium | 4.4 | 2017-02-01 | IBM Security Access Manager for Web processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code, whi… |
CVE-2016-9450 | High | 7.5 | 2016-11-25 | The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct c… |
CVE-2016-3677 | Medium | 6.5 | 2016-06-13 | The Huawei Wear App application before 15.0.0.307 for Android does not validate SSL certificates, which allows local users to have unspecified impact via unkno… |
CVE-2016-2309 | High | 7.2 | 2016-05-30 | iRZ RUH2 before 2b does not validate firmware patches, which allows remote authenticated users to modify data or cause a denial of service via unspecified vect… |
CVE-2016-4554 | High | 8.6 | 2016-05-10 | mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a cr… |
CVE-2016-4553 | High | 8.6 | 2016-05-10 | client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attacke… |
CVE-2016-2346 | High | 8.1 | 2016-04-25 | Allround Automations PL/SQL Developer 11 before 11.0.6 relies on unverified HTTP data for updates, which allows man-in-the-middle attackers to execute arbitrar… |
CVE-2016-3983 | High | 7.5 | 2016-04-08 | McAfee Advanced Threat Defense (ATD) before 3.4.8.178 might allow remote attackers to bypass malware detection by leveraging information about the parent proce… |
CVE-2015-6854 | Critical | 9.1 | 2016-03-24 | The non-Domino web agents in CA Single Sign-On (aka SSO, formerly SiteMinder) R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, and R12.5 before CR5 allow re… |
CVE-2015-6853 | Critical | 9.1 | 2016-03-24 | The Domino web agent in CA Single Sign-On (aka SSO, formerly SiteMinder) R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, R12.5 before CR5, R12.51 before CR… |
CVE-2016-1731 | Medium | 5.9 | 2016-03-14 | Apple Software Update before 2.2 on Windows does not use HTTPS, which makes it easier for man-in-the-middle attackers to spoof updates by modifying the client-… |
CVE-2016-0818 | Medium | 5.9 | 2016-03-12 | The caching functionality in the TrustManagerImpl class in TrustManagerImpl.java in Conscrypt in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x bef… |
CVE-2015-7539 | High | 7.5 | 2016-02-03 | The Plugins Manager in Jenkins before 1.640 and LTS before 1.625.2 does not verify checksums for plugin files referenced in update site data, which makes it ea… |
CVE-2016-1493 | High | 7.5 | 2016-01-29 | Intel Driver Update Utility before 2.4 retrieves driver updates in cleartext, which makes it easier for man-in-the-middle attackers to execute arbitrary code v… |
CVE-2015-8254 | Medium | 5.9 | 2015-12-27 | The Frontel protocol before 3 on RSI Video Technologies Videofied devices does not use integrity protection, which makes it easier for man-in-the-middle attack… |
CVE-2015-2908 | | 2015-08-23 | Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, do not validate firmware updates, which… | |
CVE-2015-3908 | | 2015-08-12 | Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 cert… | |
CVE-2015-4674 | | 2015-08-07 | The autoupdate implementation in TimeDoctor Pro 1.4.72.3 on Windows relies on unsigned installer files that are retrieved without use of SSL, which makes it ea… | |
CVE-2014-5406 | | 2015-07-06 | The Hospira LifeCare PCA Infusion System before 7.0 does not validate network traffic associated with sending a (1) drug library, (2) software update, or (3) c… | |
CVE-2013-7398 | | 2015-06-24 | main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match du… | |
CVE-2013-7397 | | 2015-06-24 | Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location ar… | |
CVE-2015-0251 | | 2015-04-08 | The mod_dav_svn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a cra… | |
CVE-2015-0259 | | 2015-04-01 | OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows rem… | |
CVE-2014-8165 | | 2015-02-19 | scripts/amsvis/powerpcAMS/amsnet.py in powerpc-utils-python uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via… | |
CVE-2014-9194 | | 2015-01-17 | Arbiter 1094B GPS Substation Clock allows remote attackers to cause a denial of service (disruption) via crafted radio transmissions that spoof GPS satellite b… | |
CVE-2014-4936 | | 2014-12-16 | The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.1012 and earlier allow… | |
CVE-2014-4883 | | 2014-11-28 | resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and source ports of DNS… |