CWE-347 · Improper Verification of Cryptographic Signature (page 4)
Page 4 of 8 — CVEs classified under CWE-347, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-25574 | Critical | 10.0 | 2025-02-25 | `jupyterhub-ltiauthenticator` is a JupyterHub authenticator for learning tools interoperability (LTI). LTI13Authenticator that was introduced in `jupyterhub-lt… |
CVE-2024-10237 | High | 7.2 | 2025-02-04 | There is a vulnerability in the BMC firmware image authentication design at Supermicro MBD-X12DPG-OA6 . An attacker can modify the firmware to bypass BMC i… |
CVE-2024-56161 | High | 7.2 | 2025-02-03 | Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode… |
CVE-2025-24800 | | 2025-01-28 | Hyperbridge is a hyper-scalable coprocessor for verifiable, cross-chain interoperability. A critical vulnerability was discovered in the ismp-grandpa crate, th… | |
CVE-2025-23369 | High | 8.8 | 2025-01-21 | An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed signature spoofing for unauthorized i… |
CVE-2025-23206 | High | 8.1 | 2025-01-17 | The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS Cl… |
CVE-2024-13172 | High | 7.8 | 2025-01-14 | Improper signature verification in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenti… |
CVE-2024-7344 | High | 8.2 | 2025-01-14 | Howyar UEFI Application "Reloader" (32-bit and 64-bit) is vulnerable to execution of unsigned software in a hardcoded path. |
CVE-2024-54150 | Critical | 9.1 | 2024-12-19 | cjwt is a C JSON Web Token (JWT) Implementation. Algorithm confusion occurs when a system improperly verifies the type of signature used, allowing attackers to… |
CVE-2024-43106 | High | 7.1 | 2024-12-18 | A library injection vulnerability exists in Microsoft Excel 16.83 for macOS. A specially crafted library can leverage Excel's access privileges, leading to a p… |
CVE-2024-42220 | High | 7.1 | 2024-12-18 | A library injection vulnerability exists in Microsoft Outlook 16.83.3 for macOS. A specially crafted library can leverage Outlook's access privileges, leading… |
CVE-2024-42004 | High | 7.1 | 2024-12-18 | A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. A specially crafted library can leverage Teams's a… |
CVE-2024-41165 | High | 7.1 | 2024-12-18 | A library injection vulnerability exists in Microsoft Word 16.83 for macOS. A specially crafted library can leverage Word's access privileges, leading to a per… |
CVE-2024-41159 | High | 7.1 | 2024-12-18 | A library injection vulnerability exists in Microsoft OneNote 16.83 for macOS. A specially crafted library can leverage OneNote's access privileges, leading to… |
CVE-2024-41145 | High | 7.1 | 2024-12-18 | A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. A specially crafted… |
CVE-2024-41138 | High | 7.1 | 2024-12-18 | A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work or school) 24046.2813.2770.1094 for mac… |
CVE-2024-39804 | High | 7.1 | 2024-12-18 | A library injection vulnerability exists in Microsoft PowerPoint 16.83 for macOS. A specially crafted library can leverage PowerPoint's access privileges, lead… |
CVE-2024-22461 | High | 8.8 | 2024-12-13 | Dell RecoverPoint for Virtual Machines 6.0.x contains an OS Command injection vulnerability. A low privileged remote attacker could potentially exploit this vu… |
CVE-2024-54126 | | 2024-12-05 | This vulnerability exists in the TP-Link Archer C50 due to improper signature verification mechanism in the firmware upgrade process at its web interface. An a… | |
CVE-2024-47476 | High | 7.8 | 2024-12-03 | Dell NetWorker Management Console, version(s) 19.11, contain(s) an Improper Verification of Cryptographic Signature vulnerability. An unauthenticated attacker… |
CVE-2024-49413 | High | 7.1 | 2024-12-03 | Improper Verification of Cryptographic Signature in SmartSwitch prior to SMR Dec-2024 Release 1 allows local attackers to install malicious applications. |
CVE-2024-52958 | High | 7.2 | 2024-11-27 | A improper verification of cryptographic signature vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remo… |
CVE-2024-53267 | Medium | 5.5 | 2024-11-26 | sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a valid… |
CVE-2024-11696 | Medium | 5.4 | 2024-11-26 | The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an i… |
CVE-2021-1461 | Medium | 4.9 | 2024-11-18 | A vulnerability in the Image Signature Verification feature of Cisco SD-WAN Software could allow an authenticated, remote attacker with Administrator-leve… |
CVE-2024-40592 | High | 7.5 | 2024-11-12 | An improper verification of cryptographic signature vulnerability [CWE-347] in FortiClient MacOS version 7.4.0, version 7.2.4 and below, version 7.0.10 and bel… |
CVE-2024-49394 | Medium | 5.3 | 2024-11-12 | In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed em… |
CVE-2024-49393 | Medium | 6.5 | 2024-11-12 | In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their… |
CVE-2024-47073 | Critical | 9.1 | 2024-11-07 | DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions… |
CVE-2024-51526 | High | 8.2 | 2024-11-05 | Permission control vulnerability in the hidebug module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-50347 | | 2024-10-31 | Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. Prior to 1.4.0, there is an issue where verification signatures f… | |
CVE-2024-8036 | Medium | 5.9 | 2024-10-25 | ABB is aware of privately reported vulnerabilities in the product versions referenced in this CVE. An attacker could exploit these vulnerabilities by sending a… |
CVE-2024-48948 | Medium | 4.8 | 2024-10-15 | The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading… |
CVE-2024-47943 | Critical | 9.8 | 2024-10-15 | The firmware upgrade function in the admin web interface of the Rittal IoT Interface & CMC III Processing Unit devices checks if the patch files are signed be… |
CVE-2024-8531 | High | 7.2 | 2024-10-11 | CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that could compromise the Data Center Expert software when an upgrade bundle is… |
CVE-2024-9487 | Critical | 9.1 | 2024-10-10 | An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypasse… |
CVE-2024-48949 | Critical | 9.1 | 2024-10-10 | The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" v… |
CVE-2024-47832 | Critical | 9.8 | 2024-10-09 | ssoready is a single sign on provider implemented via docker. Affected versions are vulnerable to XML signature bypass attacks. An attacker can carry out signa… |
CVE-2024-23960 | Medium | 4.6 | 2024-09-28 | Alpine Halo9 Improper Verification of Cryptographic Signature Vulnerability. This vulnerability allows physically present attackers to bypass signature validat… |
CVE-2024-7481 | High | 8.8 | 2024-09-25 | Improper verification of cryptographic signature during installation of a Printer driver via the TeamViewer_service.exe component of TeamViewer Remote Clients… |
CVE-2024-7479 | High | 8.8 | 2024-09-25 | Improper verification of cryptographic signature during installation of a VPN driver via the TeamViewer_service.exe component of TeamViewer Remote Clients prio… |
CVE-2024-8698 | High | 7.7 | 2024-09-19 | A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is… |
CVE-2024-7788 | High | 7.8 | 2024-09-17 | Improper Digital Signature Invalidation vulnerability in Zip Repair Mode of The Document Foundation LibreOffice allows Signature forgery vulnerability in Libr… |
CVE-2024-45607 | Medium | 5.8 | 2024-09-12 | whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRe… |
CVE-2024-45409 | Critical | 10.0 | 2024-09-10 | The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signa… |
CVE-2024-38807 | Medium | 6.3 | 2024-08-23 | Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be… |
CVE-2024-6800 | Critical | 9.8 | 2024-08-20 | An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers utilizin… |
CVE-2024-23460 | Medium | 6.4 | 2024-08-06 | The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locally executed. This aff… |
CVE-2024-23456 | High | 7.8 | 2024-08-06 | Anti-tampering can be disabled under certain conditions without signature validation. This affects Zscaler Client Connector <4.2.0.190 with anti-tampering enab… |
CVE-2023-28806 | Medium | 5.7 | 2024-08-06 | An Improper Validation of signature in Zscaler Client Connector on Windows allows an authenticated user to disable anti-tampering. This issue affects Client Co… |
CVE-2024-42461 | Critical | 9.1 | 2024-08-02 | In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed. |
CVE-2024-42459 | Medium | 5.3 | 2024-08-02 | In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes ca… |
CVE-2024-41258 | Medium | 5.3 | 2024-07-31 | An issue was discovered in filestash v0.4. The usage of the ssh.InsecureIgnoreHostKey() disables host key verification, possibly allowing attackers to obtain s… |
CVE-2024-41254 | Medium | 5.3 | 2024-07-31 | An issue was discovered in litestream v0.3.13. The usage of the ssh.InsecureIgnoreHostKey() disables host key verification, possibly allowing attackers to obta… |
CVE-2024-5912 | | 2024-07-10 | An improper file signature check in Palo Alto Networks Cortex XDR agent may allow an attacker to bypass the Cortex XDR agent's executable blocking capabilities… | |
CVE-2024-38069 | High | 7.0 | 2024-07-09 | Windows Enroll Engine Security Feature Bypass Vulnerability |
CVE-2024-6580 | Medium | 6.5 | 2024-07-08 | The /n software IPWorks SSH library SFTPServer component can be induced to make unintended filesystem or network path requests when loading a SSH public key or… |
CVE-2023-34435 | High | 7.2 | 2024-07-08 | A firmware update vulnerability exists in the boa formUpload functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted network packets can lead… |
CVE-2024-20892 | Medium | 6.5 | 2024-07-02 | Improper verification of signature in FilterProvider prior to SMR Jul-2024 Release 1 allows local attackers to execute privileged behaviors. User interaction i… |
CVE-2024-37532 | High | 8.8 | 2024-06-20 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to identity spoofing by an authenticated user due to improper signature validation. IBM X-Force ID… |
CVE-2024-36277 | Medium | 5.3 | 2024-06-17 | Improper verification of cryptographic signature issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. The affected ap… |
CVE-2024-21988 | Medium | 5.3 | 2024-06-14 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.7.0.9 and 11.8.0.5 are susceptible to disclosure of sensitive information via complex MiTM a… |
CVE-2024-37886 | Medium | 5.4 | 2024-06-14 | user_oidc app is an OpenID Connect user backend for Nextcloud. An attacker could potentially trick the app into accepting a request that is not signed by the c… |
CVE-2024-32911 | Critical | 9.8 | 2024-06-13 | There is a possible escalation of privilege due to improperly used crypto. This could lead to remote escalation of privilege with no additional execution privi… |
CVE-2024-37568 | High | 7.5 | 2024-06-09 | lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is a… |
CVE-2024-2451 | Medium | 6.4 | 2024-05-28 | Improper fingerprint validation in the TeamViewer Client (Full & Host) prior Version 15.54 for Windows and macOS allows an attacker with administrative user ri… |
CVE-2024-1721 | | 2024-05-21 | Improper Verification of Cryptographic Signature vulnerability in HYPR Passwordless on Windows allows Malicious Software Update.This issue affects HYPR Passwor… | |
CVE-2024-27244 | Medium | 6.7 | 2024-05-15 | Insufficient verification of data authenticity in the installer for Zoom Workplace VDI App for Windows may allow an authenticated user to conduct an escalatio… |
CVE-2024-34358 | Medium | 5.3 | 2024-05-14 | TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1… |
CVE-2023-50228 | High | 7.8 | 2024-05-03 | Parallels Desktop Updater Improper Verification of Cryptographic Signature Local Privilege Escalation Vulnerability. This vulnerability allows local attackers… |
CVE-2024-32962 | Critical | 10.0 | 2024-05-02 | xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default configuration does not check authorization of the s… |
CVE-2024-23480 | High | 7.5 | 2024-05-01 | A fallback mechanism in code sign checking on macOS may allow arbitrary code execution. This issue affects Zscaler Client Connector on MacOS prior to 4.2. |
CVE-2024-27247 | Medium | 5.5 | 2024-04-09 | Improper privilege management in the installer for Zoom Desktop Client for macOS before version 5.17.10 may allow a privileged user to conduct an escalation of… |
CVE-2024-24694 | Medium | 5.9 | 2024-04-09 | Improper privilege management in the installer for Zoom Desktop Client for Windows before version 5.17.10 may allow an authenticated user to conduct an escalat… |
CVE-2024-26228 | High | 7.8 | 2024-04-09 | Windows Cryptographic Services Security Feature Bypass Vulnerability |
CVE-2024-26194 | High | 7.4 | 2024-04-09 | Secure Boot Security Feature Bypass Vulnerability |
CVE-2023-52538 | Critical | 9.1 | 2024-04-08 | Vulnerability of package name verification being bypassed in the HwIms module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52043 | High | 8.1 | 2024-04-03 | An issue in D-Link COVR 1100, 1102, 1103 AC1200 Dual-Band Whole-Home Mesh Wi-Fi System (Hardware Rev B1) truncates Wireless Access Point Passwords (WPA-PSK) al… |
CVE-2024-2307 | Medium | 6.1 | 2024-03-19 | A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to… |
CVE-2018-25099 | Critical | 9.8 | 2024-03-18 | In the CryptX module before 0.062 for Perl, gcm_decrypt_verify() and chacha20poly1305_decrypt_verify() do not verify the tag. |
CVE-2024-21491 | Medium | 5.9 | 2024-02-13 | Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths… |
CVE-2024-1150 | High | 7.8 | 2024-02-08 | Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on Unix allows File Manipulation through Snow Update Packages.T… |
CVE-2024-1149 | High | 7.8 | 2024-02-08 | Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on MacOS, Snow Software Inventory Agent on Windows, Snow Softwa… |
CVE-2024-21917 | Critical | 9.8 | 2024-01-31 | A vulnerability exists in Rockwell Automation FactoryTalk® Service Platform that allows a malicious user to obtain the service token and use it for authenticat… |
CVE-2024-21383 | Low | 3.3 | 2024-01-26 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-23680 | Medium | 5.3 | 2024-01-19 | AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and less than 1.9.0 incorrectly validates some invalid ECDSA signatures. |
CVE-2023-44077 | Critical | 9.8 | 2024-01-17 | Studio Network Solutions ShareBrowser before 7.0 on macOS mishandles signature verification, aka PMP-2636. |
CVE-2024-0567 | High | 7.5 | 2024-01-16 | A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating… |
CVE-2023-2030 | Low | 3.5 | 2024-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions from 12.2 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which an attac… |
CVE-2016-20021 | Critical | 9.8 | 2024-01-12 | In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform… |
CVE-2024-21669 | Critical | 9.9 | 2024-01-11 | Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and services running in non-mobile environments… |
CVE-2023-5347 | Critical | 9.8 | 2024-01-09 | An Improper Verification of Cryptographic Signature vulnerability in the update process of Korenix JetNet Series allows replacing the whole operating system in… |
CVE-2022-3864 | Medium | 4.5 | 2024-01-04 | A vulnerability exists in the Relion update package signature validation. A tampered update package could cause the IED to restart. After restart the device i… |
CVE-2023-23436 | High | 7.3 | 2023-12-29 | Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct syste… |
CVE-2023-23435 | Medium | 4.0 | 2023-12-29 | Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct syste… |
CVE-2023-23433 | Medium | 4.0 | 2023-12-29 | Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct syste… |
CVE-2023-23432 | High | 7.3 | 2023-12-29 | Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct syste… |
CVE-2023-23431 | High | 7.3 | 2023-12-29 | Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct syste… |
CVE-2023-50714 | Medium | 6.8 | 2023-12-22 | yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2… |
CVE-2023-49646 | Medium | 6.4 | 2023-12-13 | Improper authentication in some Zoom clients before version 5.16.5 may allow an authenticated user to conduct a denial of service via network access. |