CWE-347 · Improper Verification of Cryptographic Signature (page 7)
Page 7 of 8 — CVEs classified under CWE-347, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-26244 | Medium | 6.8 | 2020-12-02 | Python oic is a Python OpenID Connect implementation. In Python oic before version 1.2.1, there are several related cryptographic issues affecting client imple… |
CVE-2020-29438 | Medium | 6.5 | 2020-11-30 | Tesla Model X vehicles before 2020-11-23 have key fobs that accept firmware updates without signature verification. This allows attackers to construct firmware… |
CVE-2020-8133 | Medium | 5.3 | 2020-11-09 | A wrong generation of the passphrase for the encrypted block in Nextcloud Server 19.0.1 allowed an attacker to overwrite blocks in a file. |
CVE-2020-24439 | Low | 2.8 | 2020-11-05 | Acrobat Reader DC for macOS versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a security fea… |
CVE-2020-24429 | High | 7.7 | 2020-11-05 | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) for macOS are affected by a signature ve… |
CVE-2020-28045 | High | 7.8 | 2020-11-02 | An unsigned-library issue was discovered in ProlinOS through 2.4.161.8859R. This OS requires installed applications and all system binaries to be signed either… |
CVE-2020-28042 | Medium | 5.3 | 2020-11-02 | ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes a valid minimum leng… |
CVE-2020-11488 | Medium | 6.7 | 2020-10-29 | NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contains a vulnerability i… |
CVE-2019-8901 | Medium | 6.5 | 2020-10-27 | This issue was addressed by verifying host keys when connecting to a previously-known SSH server. This issue is fixed in iOS 13.1 and iPadOS 13.1. An attacker… |
CVE-2020-15240 | High | 7.4 | 2020-10-21 | omniauth-auth0 (rubygems) versions >= 2.3.0 and < 2.4.1 improperly validate the JWT token signature when using the `jwt_validator.verify` method. Improper vali… |
CVE-2020-16922 | Medium | 5.3 | 2020-10-16 | <p>A spoofing vulnerability exists when Windows incorrectly validates file signatures. An attacker who successfully exploited this vulnerability could bypass s… |
CVE-2020-12676 | Critical | 9.1 | 2020-10-02 | FusionAuth fusionauth-samlv2 0.2.3 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka… |
CVE-2020-26540 | High | 7.5 | 2020-10-02 | An issue was discovered in Foxit Reader and PhantomPDF before 4.1 on macOS. Because the Hardened Runtime protection mechanism is not applied to code signing, c… |
CVE-2020-15216 | Medium | 5.3 | 2020-09-29 | In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypass signatu… |
CVE-2020-14365 | High | 7.1 | 2020-09-23 | A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf mo… |
CVE-2019-1736 | Medium | 6.6 | 2020-09-23 | A vulnerability in the firmware of the Cisco UCS C-Series Rack Servers could allow an authenticated, physical attacker to bypass Unified Extensible Firmware In… |
CVE-2020-25490 | High | 7.3 | 2020-09-17 | Lack of cryptographic signature verification in the Sqreen PHP agent daemon before 1.16.0 makes it easier for remote attackers to inject rules for execution in… |
CVE-2020-14515 | High | 7.5 | 2020-09-16 | CodeMeter (All versions prior to 6.90 when using CmActLicense update files with CmActLicense Firm Code) has an issue in the license-file signature checking mec… |
CVE-2020-10759 | Medium | 6.0 | 2020-09-15 | A PGP signature bypass flaw was found in fwupd (all versions), which could lead to the installation of unsigned firmware. As per upstream, a signature bypass i… |
CVE-2019-10562 | High | 7.8 | 2020-09-08 | u'Improper authentication and signature verification of debug polices in secure boot loader will allow unverified debug policies to be loaded into secure memor… |
CVE-2020-13593 | High | 8.8 | 2020-08-31 | The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation in Texas Instruments SimpleLink SIMPLELINK-CC2640R2-SDK through 2.2.3 allows the Diffie-H… |
CVE-2020-13101 | High | 7.5 | 2020-08-24 | In OASIS Digital Signature Services (DSS) 1.0, an attacker can control the validation outcome (i.e., trigger either a valid or invalid outcome for a valid or i… |
CVE-2020-10126 | High | 7.6 | 2020-08-21 | NCR SelfServ ATMs running APTRA XFS 05.01.00 do not properly validate softare updates for the bunch note acceptor (BNA), enabling an attacker with physical acc… |
CVE-2020-1464 | High | 7.8 | 2020-08-17 | A spoofing vulnerability exists when Windows incorrectly validates file signatures. An attacker who successfully exploited this vulnerability could bypass secu… |
CVE-2020-15827 | High | 7.5 | 2020-08-08 | In JetBrains ToolBox version 1.17 before 1.17.6856, the set of signature verifications omitted the jetbrains-toolbox.exe file. |
CVE-2020-15957 | High | 7.5 | 2020-07-30 | An issue was discovered in DP3T-Backend-SDK before 1.1.1 for Decentralised Privacy-Preserving Proximity Tracing (DP3T). When it is configured to check JWT befo… |
CVE-2020-15705 | Medium | 6.4 | 2020-07-29 | GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel sig… |
CVE-2020-10608 | High | 7.8 | 2020-07-24 | In OSIsoft PI System multiple products and versions, a local attacker can plant a binary and bypass a code integrity check for loading PI System libraries. Thi… |
CVE-2016-7064 | High | 7.5 | 2020-07-21 | A flaw was found in pritunl-client before version 1.0.1116.6. A lack of signature verification leads to sensitive information leakage |
CVE-2020-13845 | High | 7.5 | 2020-07-14 | Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value. Image integrity is not validated when an ECL policy is enforced. The fi… |
CVE-2020-15093 | High | 8.6 | 2020-07-09 | The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicat… |
CVE-2020-9226 | Medium | 5.5 | 2020-07-06 | HUAWEI P30 with versions earlier than 10.1.0.135(C00E135R2P11) have an improper signature verification vulnerability. The system does not improper check signat… |
CVE-2020-15091 | Medium | 6.5 | 2020-07-02 | TenderMint from version 0.33.0 and before version 0.33.6 allows block proposers to include signatures for the wrong block. This may happen naturally if you sta… |
CVE-2020-2021 | Critical | 10.0 | 2020-06-29 | When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), impro… |
CVE-2020-9047 | Medium | 6.8 | 2020-06-26 | A vulnerability exists that could allow the execution of unauthorized code or operating system commands on systems running exacqVision Web Service versions 20… |
CVE-2020-15302 | High | 7.5 | 2020-06-25 | In Argent RecoveryManager before 0xdc350d09f71c48c5D22fBE2741e4d6A03970E192, the executeRecovery function does not require any signatures in the zero-guardian… |
CVE-2020-14966 | High | 7.5 | 2020-06-22 | An issue was discovered in the jsrsasign package through 8.0.18 for Node.js. It allows a malleability in ECDSA signatures by not checking overflows in the leng… |
CVE-2020-14199 | Medium | 6.5 | 2020-06-16 | BIP-143 in the Bitcoin protocol specification mishandles the signing of a Segwit transaction, which allows attackers to trick a user into making two signatures… |
CVE-2020-13895 | High | 8.8 | 2020-06-07 | Crypt::Perl::ECDSA in the Crypt::Perl (aka p5-Crypt-Perl) module before 0.32 for Perl fails to verify correct ECDSA signatures when r and s are small and when… |
CVE-2019-20837 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.5. It allows signature validation bypass via a modified file or a file with non-standard signat… |
CVE-2019-20834 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF before 8.3.10. It allows signature validation bypass via a modified file or a file with non-standard signatures. |
CVE-2020-13810 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It allows signature validation bypass via a modified file or a file with non-standard sign… |
CVE-2020-13803 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF Mac and Foxit Reader for Mac before 4.0. It allows signature validation bypass via a modified file or a file with n… |
CVE-2020-3209 | Medium | 6.8 | 2020-06-03 | A vulnerability in software image verification in Cisco IOS XE Software could allow an unauthenticated, physical attacker to install and boot a malicious softw… |
CVE-2020-12607 | High | 7.5 | 2020-06-02 | An issue was discovered in fastecdsa before 2.1.2. When using the NIST P-256 curve in the ECDSA implementation, the point at infinity is mishandled. This means… |
CVE-2020-13415 | High | 7.5 | 2020-05-22 | An issue was discovered in Aviatrix Controller through 5.1. An attacker with any signed SAML assertion from the Identity Provider can establish a connection (e… |
CVE-2020-9753 | Critical | 9.1 | 2020-05-20 | Whale Browser Installer before 1.2.0.5 versions don't support signature verification for Flash installer. |
CVE-2020-12244 | High | 7.5 | 2020-05-19 | An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly va… |
CVE-2020-12046 | Medium | 5.7 | 2020-05-14 | Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC’s firmware files’ signatures are not verified upon firmware update. This allows an attacker to replace l… |
CVE-2020-12042 | Medium | 6.5 | 2020-05-14 | Opto 22 SoftPAC Project Version 9.6 and prior. Paths specified within the zip files used to update the SoftPAC firmware are not sanitized. As a result, an atta… |
CVE-2020-5407 | High | 8.8 | 2020-05-13 | Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using t… |
CVE-2020-12692 | Medium | 5.4 | 2020-05-07 | An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can s… |
CVE-2020-3308 | Medium | 4.9 | 2020-05-06 | A vulnerability in the Image Signature Verification feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker with… |
CVE-2020-11539 | High | 8.1 | 2020-04-22 | An issue was discovered on Tata Sonata Smart SF Rush 1.12 devices. It has been identified that the smart band has no pairing (mode 0 Bluetooth LE security leve… |
CVE-2019-10575 | High | 7.8 | 2020-04-16 | Wlan binary which is not signed with OEMs RoT is working on secure device without authentication failure in Snapdragon Compute, Snapdragon Consumer IOT, Snapdr… |
CVE-2020-1026 | Critical | 9.8 | 2020-04-15 | A Security Feature Bypass vulnerability exists in the MSR JavaScript Cryptography Library that is caused by multiple bugs in the library’s Elliptic Curve Cry… |
CVE-2020-8324 | Medium | 5.0 | 2020-04-14 | A vulnerability was reported in LenovoAppScenarioPluginSystem for Lenovo System Interface Foundation prior to version 1.2.184.31 that could allow unsigned DLL… |
CVE-2016-11044 | High | 7.8 | 2020-04-07 | An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) (with Fingerprint support) software. The check of an application's signature can b… |
CVE-2019-17561 | High | 7.5 | 2020-03-30 | The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apac… |
CVE-2015-7336 | High | 7.5 | 2020-03-27 | MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A vulnerability was reported (fixed and publicly disclosed in 2015) in Leno… |
CVE-2019-15796 | Medium | 4.7 | 2020-03-26 | Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache… |
CVE-2019-20597 | Critical | 9.1 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.1), O(8.x), and P(9.0) software. SPENgesture allows arbitrary applications to read or modify user-in… |
CVE-2020-2146 | High | 7.4 | 2020-03-09 | Jenkins Mac Plugin 1.1.0 and earlier does not validate SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks. |
CVE-2020-9283 | High | 7.5 | 2020-02-20 | golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A cli… |
CVE-2020-3138 | Medium | 6.7 | 2020-02-19 | A vulnerability in the upgrade component of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to install a mali… |
CVE-2020-6174 | Critical | 9.8 | 2020-02-05 | TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature. |
CVE-2020-7906 | High | 7.5 | 2020-01-30 | In JetBrains Rider versions 2019.3 EAP2 through 2019.3 EAP7, there were unsigned binaries provided by the Windows installer. This issue was fixed in release ve… |
CVE-2020-5390 | High | 7.5 | 2020-01-13 | PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Si… |
CVE-2019-14859 | Critical | 9.1 | 2020-01-02 | A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification… |
CVE-2019-19962 | High | 7.5 | 2019-12-25 | wolfSSL before 4.3.0 mishandles calls to wc_SignatureGenerateHash, leading to fault injection in RSA cryptography. |
CVE-2019-16732 | High | 8.1 | 2019-12-13 | Unencrypted HTTP communications for firmware upgrades in Petalk AI and PF-103 allow man-in-the-middle attackers to run arbitrary code as the root user. |
CVE-2012-2092 | Medium | 5.9 | 2019-12-06 | A Security Bypass vulnerability exists in Ubuntu Cobbler before 2,2,2 in the cobbler-ubuntu-import script due to an error when verifying the GPG signature. |
CVE-2019-16753 | High | 7.5 | 2019-12-04 | An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. The content to be signed is composed of a representation of string… |
CVE-2011-3374 | Low | 3.7 | 2019-11-26 | It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack. |
CVE-2014-3585 | Critical | 9.8 | 2019-11-22 | redhat-upgrade-tool: Does not check GPG signatures when upgrading versions |
CVE-2019-3465 | High | 8.8 | 2019-11-07 | Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML… |
CVE-2019-0071 | High | 7.8 | 2019-10-09 | Veriexec is a kernel-based file integrity subsystem in Junos OS that ensures only authorized binaries are able to be executed. Due to a flaw in specific versio… |
CVE-2019-16992 | High | 7.5 | 2019-09-30 | The Keybase app 2.13.2 for iOS provides potentially insufficient notice that it is employing a user's private key to sign a certain cryptocurrency attestation… |
CVE-2019-11755 | High | 7.5 | 2019-09-27 | A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer was shown as having a valid digital signature, although the sign… |
CVE-2019-12662 | Medium | 6.7 | 2019-09-25 | A vulnerability in Cisco NX-OS Software and Cisco IOS XE Software could allow an authenticated, local attacker with valid administrator or privilege level 15 c… |
CVE-2019-12649 | Medium | 6.7 | 2019-09-25 | A vulnerability in the Image Verification feature of Cisco IOS XE Software could allow an authenticated, local attacker to install and boot a malicious softwar… |
CVE-2019-3738 | Medium | 6.5 | 2019-09-18 | RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially… |
CVE-2019-15545 | High | 7.5 | 2019-08-26 | An issue was discovered in the libp2p-core crate before 0.8.1 for Rust. Attackers can spoof ed25519 signatures. |
CVE-2019-5592 | Medium | 5.9 | 2019-08-23 | Multiple padding oracle vulnerabilities (Zombie POODLE, GOLDENDOODLE, OpenSSL 0-length) in the CBC padding implementation of FortiOS IPS engine version 5.000 t… |
CVE-2019-9154 | High | 7.5 | 2019-08-22 | Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to pass off unsigned data as signed. |
CVE-2019-9153 | High | 7.5 | 2019-08-22 | Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standa… |
CVE-2019-10201 | High | 8.1 | 2019-08-14 | It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and remove… |
CVE-2019-5299 | High | 7.8 | 2019-08-13 | Huawei mobile phones Hima-AL00Bhave with Versions earlier than HMA-AL00C00B175 have a signature verification bypass vulnerability. Attackers can induce users t… |
CVE-2017-18407 | Medium | 4.8 | 2019-08-02 | cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download (SEC-279). |
CVE-2019-2278 | High | 7.8 | 2019-07-25 | User keystore signature is ignored in boot and can lead to bypass boot image signature verification in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mob… |
CVE-2019-1010161 | Critical | 9.8 | 2019-07-25 | perl-CRYPT-JWT 0.022 and earlier is affected by: Incorrect Access Control. The impact is: bypass authentication. The component is: JWT.pm for JWT security toke… |
CVE-2019-1010279 | High | 7.5 | 2019-07-18 | Open Information Security Foundation Suricata prior to version 4.1.3 is affected by: Denial of Service - TCP/HTTP detection bypass. The impact is: An attacker… |
CVE-2019-1010263 | Critical | 9.8 | 2019-07-17 | Perl Crypt::JWT prior to 0.023 is affected by: Incorrect Access Control. The impact is: allow attackers to bypass authentication by providing a token by crafti… |
CVE-2019-9149 | Medium | 6.5 | 2019-07-09 | Mailvelope prior to 3.3.0 allows private key operations without user interaction via its client-API. By modifying an URL parameter in Mailvelope, an attacker i… |
CVE-2019-13177 | Critical | 9.8 | 2019-07-02 | verification.py in django-rest-registration (aka Django REST Registration library) before 0.5.0 relies on a static string for signatures (i.e., the Django Sign… |
CVE-2019-10136 | Medium | 4.3 | 2019-07-02 | It was found that Spacewalk, all versions through 2.9, did not safely compute client token checksums. An attacker with a valid, but expired, authenticated set… |
CVE-2019-5300 | Medium | 6.7 | 2019-06-04 | There is a digital signature verification bypass vulnerability in AR1200, AR1200-S, AR150, AR160, AR200, AR2200, AR2200-S, AR3200, SRG1300, SRG2300 and SRG3300… |
CVE-2019-11841 | Medium | 5.9 | 2019-05-22 | A message-forgery issue was discovered in crypto/openpgp/clearsign/clearsign.go in supplementary Go cryptography libraries 2019-03-25. According to the OpenPGP… |
CVE-2019-12269 | High | 7.5 | 2019-05-21 | Enigmail before 2.0.11 allows PGP signature spoofing: for an inline PGP message, an attacker can cause the product to display a "correctly signed" message indi… |
CVE-2019-8338 | Medium | 5.9 | 2019-05-16 | The signature verification routine in the Airmail GPG-PGP Plugin, versions 1.0 (9) and earlier, does not verify the status of the signature at all, which allow… |