CWE-347 · Improper Verification of Cryptographic Signature (page 5)
Page 5 of 8 — CVEs classified under CWE-347, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-41337 | Medium | 6.1 | 2023-12-12 | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. In version 2.3.0-beta2 and prior, when h2o is configured to listen to multiple addresses or… |
CVE-2023-49079 | Critical | 9.3 | 2023-11-29 | Misskey is an open source, decentralized social media platform. Misskey's missing signature validation allows arbitrary users to impersonate any remote user. T… |
CVE-2023-20568 | Medium | 6.7 | 2023-11-14 | Improper signature verification of RadeonTM RX Vega M Graphics driver for Windows may allow an attacker with admin privileges to launch RadeonInstaller.exe wit… |
CVE-2023-20567 | Medium | 6.7 | 2023-11-14 | Improper signature verification of RadeonTM RX Vega M Graphics driver for Windows may allow an attacker with admin privileges to launch AMDSoftwareInstaller.ex… |
CVE-2023-5747 | High | 7.2 | 2023-11-13 | Bashis, a Security Researcher at IPVM has found a flaw that allows for a remote code execution during the installation of Wave on the camera device. The Wave s… |
CVE-2023-47122 | Medium | 4.2 | 2023-11-10 | Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via t… |
CVE-2023-34058 | High | 7.1 | 2023-10-27 | VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/… |
CVE-2023-46234 | Medium | 6.5 | 2023-10-26 | browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls… |
CVE-2023-28804 | High | 8.2 | 2023-10-23 | An Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows replacing binaries.This issue affects Linux Clien… |
CVE-2023-28796 | High | 7.1 | 2023-10-23 | Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Co… |
CVE-2023-46324 | High | 7.5 | 2023-10-23 | pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompr… |
CVE-2022-25333 | High | 8.2 | 2023-10-19 | The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) performs an RSA check implemented in mask ROM when loading a module throu… |
CVE-2023-43611 | High | 7.8 | 2023-10-10 | The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. This vulnerability is due… |
CVE-2023-43660 | Medium | 4.8 | 2023-09-27 | Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verification for a user can be bypassed by s… |
CVE-2023-42811 | Medium | 4.7 | 2023-09-22 | aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation of decrypt_in_place… |
CVE-2023-42806 | Medium | 6.5 | 2023-09-21 | Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, not signing and verifying `$\mathsf{cid}$` allows an attacker (which must be… |
CVE-2023-20236 | Medium | 6.7 | 2023-09-13 | A vulnerability in the iPXE boot function of Cisco IOS XR software could allow an authenticated, local attacker to install an unverified software image on an a… |
CVE-2023-20135 | Medium | 5.7 | 2023-09-13 | A vulnerability in Cisco IOS XR Software image verification checks could allow an authenticated, local attacker to execute arbitrary code on the underlying ope… |
CVE-2023-41764 | Medium | 5.5 | 2023-09-12 | Microsoft Office Spoofing Vulnerability |
CVE-2023-40727 | High | 7.8 | 2023-09-12 | A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application uses weak outdated application… |
CVE-2023-41744 | High | 7.8 | 2023-08-31 | Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Agent (macOS) before build 30600, Ac… |
CVE-2023-28801 | Critical | 9.6 | 2023-08-31 | An Improper Verification of Cryptographic Signature in the SAML authentication of the Zscaler Admin UI allows a Privilege Escalation.This issue affects Admin U… |
CVE-2023-36811 | Medium | 4.7 | 2023-08-30 | borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. A flaw in the cryptographic authentication scheme in borgbac… |
CVE-2023-20266 | Medium | 6.5 | 2023-08-30 | A vulnerability in Cisco Emergency Responder, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Editio… |
CVE-2023-41037 | Medium | 4.3 | 2023-08-29 | OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In affected versions OpenPGP Cleartext Signed Messages are cryptographically signed messages… |
CVE-2023-23773 | High | 7.2 | 2023-08-29 | Motorola EBTS/MBTS Base Radio fails to check firmware authenticity. The Motorola MBTS Base Radio lacks cryptographic signature validation for firmware update p… |
CVE-2023-23772 | High | 7.2 | 2023-08-29 | Motorola MBTS Site Controller fails to check firmware update authenticity. The Motorola MBTS Site Controller lacks cryptographic signature validation for firmw… |
CVE-2023-40178 | Medium | 5.3 | 2023-08-23 | Node-SAML is a SAML library not dependent on any frameworks that runs in Node. The lack of checking of current timestamp allows a LogoutRequest XML to be reuse… |
CVE-2021-43171 | Medium | 6.5 | 2023-08-22 | Improper verification of applications' cryptographic signatures in the /e/OS app store client App Lounge before 0.19q allows attackers in control of the applic… |
CVE-2023-39393 | High | 7.5 | 2023-08-13 | Vulnerability of insecure signatures in the ServiceWifiResources module. Successful exploitation of this vulnerability may cause ServiceWifiResources to be mal… |
CVE-2023-39392 | High | 7.5 | 2023-08-13 | Vulnerability of insecure signatures in the OsuLogin module. Successful exploitation of this vulnerability may cause OsuLogin to be maliciously modified and ov… |
CVE-2023-40012 | Medium | 5.9 | 2023-08-09 | uthenticode is a small cross-platform library for partially verifying Authenticode digital signatures. Versions of uthenticode prior to the 2.x series did not… |
CVE-2023-39969 | Critical | 9.0 | 2023-08-09 | uthenticode is a small cross-platform library for partially verifying Authenticode digital signatures. Version 1.0.9 of uthenticode hashed the entire file rath… |
CVE-2023-39211 | High | 8.8 | 2023-08-08 | Improper privilege management in Zoom Desktop Client for Windows and Zoom Rooms for Windows before 5.15.5 may allow an authenticated user to enable an informat… |
CVE-2023-38418 | High | 7.8 | 2023-08-02 | The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. Note: Software versions wh… |
CVE-2023-3347 | Medium | 5.9 | 2023-07-20 | A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required"… |
CVE-2023-33768 | Medium | 6.5 | 2023-07-13 | Incorrect signature verification of the firmware during the Device Firmware Update process of Belkin Wemo Smart Plug WSP080 v1.2 allows attackers to cause a De… |
CVE-2023-35373 | Medium | 5.3 | 2023-07-11 | Mono Authenticode Validation Spoofing Vulnerability |
CVE-2023-32449 | High | 7.2 | 2023-06-22 | Dell PowerStore versions prior to 3.5 contain an improper verification of cryptographic signature vulnerability. An attacker can trick a high privileged user… |
CVE-2023-34120 | High | 8.7 | 2023-06-13 | Improper privilege management in Zoom for Windows, Zoom Rooms for Windows, and Zoom VDI for Windows clients before 5.14.0 may allow an authenticated user to p… |
CVE-2023-28602 | Low | 2.8 | 2023-06-13 | Zoom for Windows clients prior to 5.13.5 contain an improper verification of cryptographic signature vulnerability. A malicious user may potentially downgrade… |
CVE-2023-33959 | High | 8.3 | 2023-06-06 | notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry can cause users to verify the wrong ar… |
CVE-2023-34205 | Critical | 9.1 | 2023-05-30 | In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML. Thus, signature validatio… |
CVE-2023-33185 | Medium | 4.6 | 2023-05-26 | Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library export… |
CVE-2022-4418 | High | 7.8 | 2023-05-18 | Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Cyber Protect Home Office (Windows)… |
CVE-2023-25934 | Medium | 5.9 | 2023-05-04 | DELL ECS prior to 3.8.0.2 contains an improper verification of cryptographic signature vulnerability. A network attacker with an ability to intercept the requ… |
CVE-2023-1204 | Medium | 4.3 | 2023-05-03 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all ver… |
CVE-2023-28228 | Medium | 5.5 | 2023-04-11 | Windows Spoofing Vulnerability |
CVE-2023-28226 | Medium | 5.3 | 2023-04-11 | Windows Enroll Engine Security Feature Bypass Vulnerability |
CVE-2023-28818 | Medium | 5.3 | 2023-03-24 | An issue was discovered in Veritas NetBackup IT Analytics 11 before 11.2.0. The application upgrade process included unsigned files that could be exploited and… |
CVE-2023-28610 | Critical | 9.8 | 2023-03-23 | The update process in OMICRON StationGuard and OMICRON StationScout before 2.21 can be exploited by providing a modified firmware update image. This allows a r… |
CVE-2023-28113 | Medium | 5.9 | 2023-03-16 | russh is a Rust SSH client and server library. Starting in version 0.34.0 and prior to versions 0.36.2 and 0.37.1, Diffie-Hellman key validation is insufficien… |
CVE-2022-20929 | High | 7.8 | 2023-03-10 | A vulnerability in the upgrade signature verification of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, local attacker to… |
CVE-2023-20940 | High | 7.8 | 2023-02-28 | In the Android operating system, there is a possible way to replace a boot partition due to improperly used crypto. This could lead to local escalation of priv… |
CVE-2021-43074 | Medium | 4.3 | 2023-02-16 | An improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versions, 6.1 all versions… |
CVE-2023-25718 | Critical | 9.8 | 2023-02-13 | In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without i… |
CVE-2021-36226 | Critical | 9.8 | 2023-02-06 | Western Digital My Cloud devices before OS5 do not use cryptographically signed Firmware upgrade files. |
CVE-2023-23940 | Medium | 6.4 | 2023-02-03 | OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_sig… |
CVE-2022-34459 | High | 7.8 | 2023-02-01 | Dell Command | Update, Dell Update, and Alienware Update versions prior to 4.7 contain a improper verification of cryptographic signature in get applicable dr… |
CVE-2023-23928 | Medium | 5.9 | 2023-02-01 | reason-jose is a JOSE implementation in ReasonML and OCaml.`Jose.Jws.validate` does not check HS256 signatures. This allows tampering of JWS header and payload… |
CVE-2022-23334 | Critical | 9.8 | 2023-01-30 | The Robot application in Ip-label Newtest before v8.5R0 was discovered to use weak signature checks on executed binaries, allowing attackers to have write acce… |
CVE-2023-22742 | Medium | 5.3 | 2023-01-20 | libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certi… |
CVE-2023-24025 | High | 7.5 | 2023-01-20 | CRYSTALS-DILITHIUM (in Post-Quantum Cryptography Selected Algorithms 2022) in PQClean d03da30 may allow universal forgeries of digital signatures via a templat… |
CVE-2020-22659 | High | 7.5 | 2023-01-20 | In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199… |
CVE-2020-22653 | Critical | 9.8 | 2023-01-20 | In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199… |
CVE-2022-46176 | Medium | 5.3 | 2023-01-11 | Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and depen… |
CVE-2020-36563 | Medium | 5.3 | 2022-12-28 | XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending… |
CVE-2022-23540 | Medium | 6.4 | 2022-12-22 | In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to def… |
CVE-2022-47549 | Medium | 6.4 | 2022-12-19 | An unprotected memory-access operation in optee_os in TrustedFirmware Open Portable Trusted Execution Environment (OP-TEE) before 3.20 allows a physically prox… |
CVE-2022-23507 | Medium | 5.4 | 2022-12-15 | Tendermint is a high-performance blockchain consensus engine for Byzantine fault tolerant applications. Versions prior to 0.28.0 contain a potential attack via… |
CVE-2021-26391 | High | 7.8 | 2022-11-09 | Insufficient verification of multiple header signatures while loading a Trusted Application (TA) may allow an attacker with privileges to gain code execution i… |
CVE-2022-41669 | High | 7.0 | 2022-11-04 | A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in the SGIUtility component that allows adversaries with local user privileges… |
CVE-2022-41666 | High | 7.0 | 2022-11-04 | A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that allows adversaries with local user privileges to load a malicious DLL whi… |
CVE-2022-42793 | Medium | 5.5 | 2022-11-01 | An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 16, iOS 15.7 and iPa… |
CVE-2022-39366 | Critical | 9.9 | 2022-10-28 | DataHub is an open-source metadata platform. Prior to version 0.8.45, the `StatelessTokenService` of the DataHub metadata service (GMS) does not verify the sig… |
CVE-2022-3322 | Medium | 6.7 | 2022-10-28 | Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client. Due to insufficient… |
CVE-2022-39300 | High | 7.7 | 2022-10-13 | node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml. A remote attacker may be able to bypass SAML authentication on a website usi… |
CVE-2022-31123 | Medium | 6.1 | 2022-10-13 | Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature… |
CVE-2022-39299 | High | 7.4 | 2022-10-12 | Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authenticati… |
CVE-2022-20944 | Medium | 6.1 | 2022-10-10 | A vulnerability in the software image verification functionality of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches could allow an unauthenticate… |
CVE-2022-42010 | Medium | 6.5 | 2022-10-10 | An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and… |
CVE-2022-39237 | Medium | 6.3 | 2022-10-06 | syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did… |
CVE-2022-41340 | High | 7.5 | 2022-09-24 | The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery. |
CVE-2022-36056 | Medium | 5.5 | 2022-09-14 | Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabili… |
CVE-2022-39200 | High | 7.3 | 2022-09-12 | Dendrite is a Matrix homeserver written in Go. In affected versions events retrieved from a remote homeserver using the `/get_missing_events` path did not have… |
CVE-2021-35113 | High | 7.3 | 2022-09-02 | Possible authentication bypass due to improper order of signature verification and hashing in the signature verification call in Snapdragon Auto, Snapdragon Co… |
CVE-2021-35097 | High | 7.3 | 2022-09-02 | Possible authentication bypass due to improper order of signature verification and hashing in the signature verification call in Snapdragon Auto, Snapdragon Co… |
CVE-2021-40326 | Medium | 5.5 | 2022-08-29 | Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, mishandle hidden and incremental data in signed documents. An attacker c… |
CVE-2021-3521 | Medium | 4.7 | 2022-08-22 | There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding s… |
CVE-2022-2790 | Medium | 5.9 | 2022-08-19 | Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-347 Improper Verification of Cryptographic Signature, and does not prope… |
CVE-2022-28752 | High | 8.8 | 2022-08-17 | Zoom Rooms for Conference Rooms for Windows versions before 5.11.0 are susceptible to a Local Privilege Escalation vulnerability. A local low-privileged malici… |
CVE-2022-28751 | High | 8.8 | 2022-08-17 | The Zoom Client for Meetings for MacOS (Standard and for IT Admin) before version 5.11.3 contains a vulnerability in the package signature validation during th… |
CVE-2022-28756 | High | 8.8 | 2022-08-15 | The Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with version 5.7.3 and before 5.11.5 contains a vulnerability in the auto update pr… |
CVE-2022-35930 | High | 7.1 | 2022-08-04 | PolicyController is a utility used to enforce supply chain policy in Kubernetes clusters. In versions prior to 0.2.1 PolicyController will report a false posit… |
CVE-2022-35929 | High | 7.1 | 2022-08-04 | cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. `cosign verif… |
CVE-2022-31207 | Critical | 9.8 | 2022-07-26 | The Omron SYSMAC Cx product family PLCs (CS series, CJ series, and CP series) through 2022-05-18 lack cryptographic authentication. They utilize the Omron FINS… |
CVE-2022-31206 | Critical | 9.8 | 2022-07-26 | The Omron SYSMAC Nx product family PLCs (NJ series, NY series, NX series, and PMAC series) through 2022-005-18 lack cryptographic authentication. These PLCs ar… |
CVE-2022-31172 | High | 7.5 | 2022-07-22 | OpenZeppelin Contracts is a library for smart contract development. Versions 4.1.0 until 4.7.1 are vulnerable to the SignatureChecker reverting. `SignatureChec… |
CVE-2022-31156 | Medium | 6.6 | 2022-07-14 | Gradle is a build tool. Dependency verification is a security feature in Gradle Build Tool that was introduced to allow validation of external dependencies eit… |
CVE-2020-35169 | Critical | 9.1 | 2022-07-11 | Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Improper Input Validation Vulne… |