CWE-347 · Improper Verification of Cryptographic Signature (page 6)
Page 6 of 8 — CVEs classified under CWE-347, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-25898 | High | 7.7 | 2022-07-01 | The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding s… |
CVE-2022-1739 | Medium | 6.8 | 2022-06-24 | The tested version of Dominion Voting Systems ImageCast X does not validate application signatures to a trusted root certificate. Use of a trusted root certifi… |
CVE-2022-31053 | Critical | 9.8 | 2022-06-13 | Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that… |
CVE-2022-26510 | Medium | 6.5 | 2022-05-12 | A firmware update vulnerability exists in the iburn firmware checks functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted HTTP request can… |
CVE-2022-24884 | Critical | 10.0 | 2022-05-06 | ecdsautils is a tiny collection of programs used for ECDSA (keygen, sign, verify). `ecdsa_verify_[prepare_]legacy()` does not check whether the signature value… |
CVE-2021-22573 | High | 8.7 | 2022-05-03 | The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from v… |
CVE-2020-25166 | High | 7.6 | 2022-04-14 | An improper verification of the cryptographic signature of firmware updates of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data mod… |
CVE-2021-32977 | High | 7.2 | 2022-04-04 | AVEVA System Platform versions 2017 through 2020 R2 P01 does not verify, or incorrectly verifies, the cryptographic signature for data. |
CVE-2021-30066 | Medium | 6.8 | 2022-04-03 | On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an arbitrary firmwa… |
CVE-2015-3298 | High | 8.8 | 2022-03-30 | Yubico ykneo-openpgp before 1.0.10 has a typo in which an invalid PIN can be used. When first powered up, a signature will be issued even though the PIN has no… |
CVE-2022-24773 | Medium | 5.3 | 2022-03-18 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verifi… |
CVE-2022-24772 | High | 7.5 | 2022-03-18 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verifi… |
CVE-2022-24771 | High | 7.5 | 2022-03-18 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verifi… |
CVE-2022-24759 | High | 8.1 | 2022-03-17 | `@chainsafe/libp2p-noise` contains TypeScript implementation of noise protocol, an encryption protocol used in libp2p. `@chainsafe/libp2p-noise` before 4.1.2 a… |
CVE-2022-23610 | Critical | 9.1 | 2022-03-16 | wire-server provides back end services for Wire, an open source messenger. In versions of wire-server prior to the 2022-01-27 release, it was possible to craft… |
CVE-2021-20319 | High | 7.8 | 2022-03-04 | An improper signature verification vulnerability was found in coreos-installer. A specially crafted gzip installation image can bypass the image signature veri… |
CVE-2021-43393 | Medium | 6.2 | 2022-03-04 | STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to abuse signature verification. This is associated with the ECDSA signa… |
CVE-2021-43392 | Medium | 6.2 | 2022-03-04 | STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to obtain information on cryptographic secrets. This is associated with… |
CVE-2021-25636 | High | 7.5 | 2022-02-24 | LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since… |
CVE-2022-23655 | Medium | 4.8 | 2022-02-24 | Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS did not validate gateway server signatures. As a r… |
CVE-2021-40045 | Medium | 5.5 | 2022-02-09 | There is a vulnerability of signature verification mechanism failure in system upgrade through recovery mode.Successful exploitation of this vulnerability may… |
CVE-2022-24115 | High | 7.8 | 2022-02-04 | Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Cyber Protect Home Office (macOS) be… |
CVE-2022-21134 | High | 7.5 | 2022-01-28 | A firmware update vulnerability exists in the "update" firmware checks functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTT… |
CVE-2021-44878 | High | 7.5 | 2022-01-06 | If an OpenID Connect provider supports the "none" algorithm (i.e., tokens with no signature), pac4j v5.3.0 (and prior) does not refuse it without an explicit c… |
CVE-2021-20156 | Medium | 6.5 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 contains an improper access control configuration that could allow for a malicious firmware update. It is possible t… |
CVE-2020-16156 | High | 7.8 | 2021-12-13 | CPAN 2.28 allows Signature Verification Bypass. |
CVE-2020-16154 | High | 7.8 | 2021-12-13 | The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass. |
CVE-2021-0152 | Medium | 5.5 | 2021-11-17 | Improper verification of cryptographic signature in the installer for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products in Windows 10 ma… |
CVE-2021-34420 | Medium | 4.7 | 2021-11-11 | The Zoom Client for Meetings for Windows installer before version 5.5.4 does not properly verify the signature of files with .msi, .ps1, and .bat extensions. T… |
CVE-2021-43572 | Critical | 9.8 | 2021-11-09 | The verify function in the Stark Bank Python ECDSA library (aka starkbank-escada or ecdsa-python) before 2.0.1 fails to check that the signature is non-zero, w… |
CVE-2021-43571 | Critical | 9.8 | 2021-11-09 | The verify function in the Stark Bank Node.js ECDSA library (ecdsa-node) 1.1.2 fails to check that the signature is non-zero, which allows attackers to forge s… |
CVE-2021-43570 | Critical | 9.8 | 2021-11-09 | The verify function in the Stark Bank Java ECDSA library (ecdsa-java) 1.0.0 fails to check that the signature is non-zero, which allows attackers to forge sign… |
CVE-2021-43569 | Critical | 9.8 | 2021-11-09 | The verify function in the Stark Bank .NET ECDSA library (ecdsa-dotnet) 1.3.1 fails to check that the signature is non-zero, which allows attackers to forge si… |
CVE-2021-43568 | Critical | 9.8 | 2021-11-09 | The verify function in the Stark Bank Elixir ECDSA library (ecdsa-elixir) 1.0.0 fails to check that the signature is non-zero, which allows attackers to forge… |
CVE-2021-39909 | Medium | 5.3 | 2021-11-05 | Lack of email address ownership verification in the CODEOWNERS feature in all versions of GitLab EE starting from 11.3 before 14.2.6, all versions starting fro… |
CVE-2021-37127 | High | 7.2 | 2021-10-27 | There is a signature management vulnerability in some huawei products. An attacker can forge signature and bypass the signature check. During firmware update p… |
CVE-2021-41832 | High | 7.5 | 2021-10-11 | It is possible for an attacker to manipulate documents to appear to be signed by a trusted source. All versions of Apache OpenOffice up to 4.1.10 are affected… |
CVE-2021-41831 | Medium | 5.3 | 2021-10-11 | It is possible for an attacker to manipulate the timestamp of signed documents. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised… |
CVE-2021-41830 | High | 7.5 | 2021-10-11 | It is possible for an attacker to manipulate signed documents and macros to appear to come from a trusted source. All versions of Apache OpenOffice up to 4.1.1… |
CVE-2021-29108 | High | 8.8 | 2021-10-01 | There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authe… |
CVE-2021-37927 | Critical | 9.8 | 2021-09-22 | Zoho ManageEngine ADManager Plus version 7110 and prior allows account takeover via SSO. |
CVE-2021-31847 | High | 8.2 | 2021-09-22 | Improper access control vulnerability in the repair process for McAfee Agent for Windows prior to 5.7.4 could allow a local attacker to perform a DLL preloadin… |
CVE-2021-31841 | High | 8.2 | 2021-09-22 | A DLL sideloading vulnerability in McAfee Agent for Windows prior to 5.7.4 could allow a local user to perform a DLL sideloading attack with an unsigned DLL wi… |
CVE-2021-34709 | Medium | 6.0 | 2021-09-09 | Multiple vulnerabilities in image verification checks of Cisco Network Convergence System (NCS) 540 Series Routers, only when running Cisco IOS XR NCS540L soft… |
CVE-2021-34708 | Medium | 6.0 | 2021-09-09 | Multiple vulnerabilities in image verification checks of Cisco Network Convergence System (NCS) 540 Series Routers, only when running Cisco IOS XR NCS540L soft… |
CVE-2021-3051 | High | 8.1 | 2021-09-08 | An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR SAML authentication that enables an unauthenticated network-based atta… |
CVE-2021-1849 | High | 7.5 | 2021-09-08 | An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvO… |
CVE-2021-33885 | Critical | 10.0 | 2021-08-25 | An Insufficient Verification of Data Authenticity vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to send the… |
CVE-2021-34433 | High | 7.5 | 2021-08-20 | In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally succeeds without veri… |
CVE-2021-34715 | Medium | 4.7 | 2021-08-18 | A vulnerability in the image verification function of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authentica… |
CVE-2021-3633 | High | 7.3 | 2021-08-17 | A DLL preloading vulnerability was reported in Lenovo Driver Management prior to version 2.9.0719.1104 that could allow privilege escalation. |
CVE-2021-36277 | High | 7.8 | 2021-08-09 | Dell Command | Update, Dell Update, and Alienware Update versions before 4.3 contains an Improper Verification of Cryptographic Signature Vulnerability. A loca… |
CVE-2021-38195 | Critical | 9.8 | 2021-08-08 | An issue was discovered in the libsecp256k1 crate before 0.5.0 for Rust. It can verify an invalid signature because it allows the R or S parameter to be larger… |
CVE-2021-3680 | Medium | 4.9 | 2021-08-04 | showdoc is vulnerable to Missing Cryptographic Step |
CVE-2021-37160 | Critical | 9.8 | 2021-08-02 | A firmware validation issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Soft… |
CVE-2021-22708 | High | 7.2 | 2021-07-21 | A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlin… |
CVE-2021-26100 | Medium | 5.9 | 2021-07-09 | A missing cryptographic step in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an unauthenticated attacker who intercepts the encryp… |
CVE-2021-24020 | High | 7.5 | 2021-07-09 | A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthen… |
CVE-2021-35039 | High | 7.8 | 2021-07-07 | kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kern… |
CVE-2021-32738 | Medium | 6.5 | 2021-07-02 | js-stellar-sdk is a Javascript library for communicating with a Stellar Horizon server. The `Utils.readChallengeTx` function used in SEP-10 Stellar Web Authent… |
CVE-2021-23993 | Medium | 6.5 | 2021-06-24 | An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker creates a crafted OpenPGP key with a sub… |
CVE-2021-23992 | Medium | 4.3 | 2021-06-24 | Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may create a crafted version of an OpenPGP key… |
CVE-2021-32685 | Critical | 9.8 | 2021-06-16 | tEnvoy contains the PGP, NaCl, and PBKDF2 in node.js and the browser (hashing, random, encryption, decryption, signatures, conversions), used by TogaTech.org… |
CVE-2021-3196 | High | 8.8 | 2021-06-09 | An issue was discovered in Hitachi ID Bravura Security Fabric 11.0.0 through 11.1.3, 12.0.0 through 12.0.2, and 12.1.0. When using federated identity managemen… |
CVE-2021-29500 | High | 7.5 | 2021-06-04 | bubble fireworks is an open source java package relating to Spring Framework. In bubble fireworks before version 2021.BUILD-SNAPSHOT there is a vulnerability i… |
CVE-2021-33054 | High | 7.5 | 2021-06-04 | SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to th… |
CVE-2021-28091 | High | 7.5 | 2021-06-04 | Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. |
CVE-2021-22735 | High | 7.2 | 2021-05-26 | Improper Verification of Cryptographic Signature vulnerability exists inhomeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could allow remote code ex… |
CVE-2021-22734 | High | 7.2 | 2021-05-26 | Improper Verification of Cryptographic Signature vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause remote code e… |
CVE-2021-20487 | Critical | 9.1 | 2021-05-26 | IBM Power9 Self Boot Engine(SBE) could allow a privileged user to inject malicious code and compromise the integrity of the host firmware bypassing the host fi… |
CVE-2021-22160 | Critical | 9.8 | 2021-05-26 | If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorith… |
CVE-2021-3445 | High | 7.5 | 2021-05-19 | A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can… |
CVE-2021-3421 | Medium | 5.5 | 2021-05-19 | A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package… |
CVE-2021-29455 | High | 7.5 | 2021-04-19 | Grassroot Platform is an application to make it faster, cheaper and easier to persistently organize and mobilize people in low-income communities. Grassroot Pl… |
CVE-2021-29451 | Critical | 9.1 | 2021-04-16 | Portofino is an open source web development framework. Portofino before version 5.2.1 did not properly verify the signature of JSON Web Tokens. This allows for… |
CVE-2021-21405 | Medium | 5.9 | 2021-04-15 | Lotus is an Implementation of the Filecoin protocol written in Go. BLS signature validation in lotus uses blst library method VerifyCompressed. This method acc… |
CVE-2021-30246 | Critical | 9.1 | 2021-04-07 | In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known pr… |
CVE-2020-36285 | High | 7.5 | 2021-04-06 | Union Pay up to 3.3.12, for iOS mobile apps, contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attackers to shop for f… |
CVE-2020-36284 | High | 7.5 | 2021-04-06 | Union Pay up to 3.4.93.4.9, for android, contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attackers to shop for free… |
CVE-2020-23533 | High | 7.5 | 2021-04-06 | Union Pay up to 1.2.0, for web based versions contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attackers to shop for… |
CVE-2021-30130 | High | 7.5 | 2021-04-06 | phpseclib before 2.0.31 and 3.x before 3.0.7 mishandles RSA PKCS#1 v1.5 signature verification. |
CVE-2021-1376 | Medium | 6.7 | 2021-03-24 | Multiple vulnerabilities in the fast reload feature of Cisco IOS XE Software running on Cisco Catalyst 3850, Cisco Catalyst 9300, and Cisco Catalyst 9300L Seri… |
CVE-2021-1375 | Medium | 6.7 | 2021-03-24 | Multiple vulnerabilities in the fast reload feature of Cisco IOS XE Software running on Cisco Catalyst 3850, Cisco Catalyst 9300, and Cisco Catalyst 9300L Seri… |
CVE-2021-1453 | Medium | 6.8 | 2021-03-24 | A vulnerability in the software image verification functionality of Cisco IOS XE Software for the Cisco Catalyst 9000 Family of switches could allow an unauthe… |
CVE-2020-23967 | High | 7.8 | 2021-03-08 | Dr.Web Security Space versions 11 and 12 allow elevation of privilege for local users without administrative privileges to NT AUTHORITY\SYSTEM due to insuffici… |
CVE-2021-3406 | Critical | 9.8 | 2021-02-25 | A flaw was found in keylime 5.8.1 and older. The issue in the Keylime agent and registrar code invalidates the cryptographic chain of trust from the Endorsemen… |
CVE-2021-1366 | High | 7.8 | 2021-02-17 | A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local atta… |
CVE-2021-3033 | Critical | 9.1 | 2021-02-10 | An improper verification of cryptographic signature vulnerability exists in the Palo Alto Networks Prisma Cloud Compute console. This vulnerability enables an… |
CVE-2021-1244 | Medium | 6.7 | 2021-02-04 | Multiple vulnerabilities in Cisco Network Convergence System (NCS) 540 Series Routers, only when running Cisco IOS XR NCS540L software images, and Cisco IOS XR… |
CVE-2021-1136 | Medium | 6.7 | 2021-02-04 | Multiple vulnerabilities in Cisco Network Convergence System (NCS) 540 Series Routers, only when running Cisco IOS XR NCS540L software images, and Cisco IOS XR… |
CVE-2020-27540 | Critical | 9.8 | 2021-01-26 | Bash injection vulnerability and bypass of signature verification in Rostelecom CS-C2SHW 5.0.082.1. The camera reads firmware update configuration from SD card… |
CVE-2021-21239 | Medium | 6.5 | 2021-01-21 | PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability… |
CVE-2021-21238 | Medium | 6.5 | 2021-01-21 | PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability… |
CVE-2018-18689 | Medium | 5.3 | 2021-01-07 | The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently… |
CVE-2018-18688 | Medium | 5.3 | 2021-01-07 | The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently… |
CVE-2020-26290 | Critical | 9.3 | 2020-12-28 | Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveragin… |
CVE-2020-11093 | High | 7.5 | 2020-12-24 | Hyperledger Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In Hyperledger Indy before version 1.12.4, there… |
CVE-2020-28086 | High | 7.5 | 2020-12-09 | pass through 1.7.3 has a possibility of using a password for an unintended resource. For exploitation to occur, the user must do a git pull, decrypt a password… |
CVE-2020-26122 | High | 7.2 | 2020-12-07 | Inspur NF5266M5 through 3.21.2 and other server M5 devices allow remote code execution via administrator privileges. The Baseboard Management Controller (BMC)… |
CVE-2020-26244 | Medium | 6.8 | 2020-12-02 | Python oic is a Python OpenID Connect implementation. In Python oic before version 1.2.1, there are several related cryptographic issues affecting client imple… |