CWE-347 · Improper Verification of Cryptographic Signature (page 8)
Page 8 of 8 — CVEs classified under CWE-347, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-1813 | Medium | 6.7 | 2019-05-15 | A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level crede… |
CVE-2019-1812 | Medium | 6.7 | 2019-05-15 | A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level crede… |
CVE-2019-1811 | Medium | 6.7 | 2019-05-15 | A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level crede… |
CVE-2019-1810 | Medium | 6.7 | 2019-05-15 | A vulnerability in the Image Signature Verification feature used in an NX-OS CLI command in Cisco Nexus 3000 Series and 9000 Series Switches could allow an aut… |
CVE-2019-1809 | Medium | 6.7 | 2019-05-15 | A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level crede… |
CVE-2019-1808 | Medium | 4.4 | 2019-05-15 | A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level crede… |
CVE-2019-1729 | Medium | 6.0 | 2019-05-15 | A vulnerability in the CLI implementation of a specific command used for image maintenance for Cisco NX-OS Software could allow an authenticated, local attacke… |
CVE-2019-1728 | Medium | 6.7 | 2019-05-15 | A vulnerability in the Secure Configuration Validation functionality of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attack… |
CVE-2018-18509 | Medium | 5.3 | 2019-04-26 | A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even if the shown message… |
CVE-2018-7340 | High | 7.5 | 2019-04-17 | Duo Network Gateway 1.2.9 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be… |
CVE-2019-6318 | Critical | 9.8 | 2019-04-11 | HP LaserJet Enterprise printers, HP PageWide Enterprise printers, HP LaserJet Managed printers, HP Officejet Enterprise printers have an insufficient solution… |
CVE-2018-5923 | Critical | 9.8 | 2019-03-27 | In HP LaserJet Enterprise, HP PageWide Enterprise, HP LaserJet Managed, and HP OfficeJet Enterprise Printers, solution application signature checking may allow… |
CVE-2018-3968 | High | 7.0 | 2019-03-21 | An exploitable vulnerability exists in the verified boot protection of the Das U-Boot from version 2013.07-rc1 to 2014.07-rc2. The affected versions lack prope… |
CVE-2019-1615 | Medium | 6.7 | 2019-03-11 | A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level crede… |
CVE-2018-15587 | Medium | 6.5 | 2019-02-11 | GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signat… |
CVE-2018-15586 | Medium | 6.5 | 2019-02-11 | Enigmail before 2.0.6 is prone to to OpenPGP signatures being spoofed for arbitrary messages using a PGP/INLINE signature wrapped within a specially crafted mu… |
CVE-2018-16042 | Medium | 6.5 | 2019-01-18 | Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017… |
CVE-2018-16557 | High | 8.2 | 2018-12-13 | A vulnerability has been identified in SIMATIC S7-400 CPU 412-1 DP V7 (All versions), SIMATIC S7-400 CPU 412-2 DP V7 (All versions), SIMATIC S7-400 CPU 414-… |
CVE-2018-18203 | Medium | 6.4 | 2018-11-28 | A vulnerability in the update mechanism of Subaru StarLink Harman head units 2017, 2018, and 2019 may give an attacker (with physical access to the vehicle's U… |
CVE-2018-1842 | Low | 3.6 | 2018-11-09 | IBM Cognos Analytics 11 Configuration tool, under certain circumstances, will bypass OIDC namespace signature verification on its id_token. IBM X-Force ID: 150… |
CVE-2018-16253 | Medium | 5.9 | 2018-11-07 | In sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature verification does not properly verify the ASN.1 metadata. Consequently… |
CVE-2018-16150 | Medium | 5.9 | 2018-11-07 | In sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature verification does not reject excess data after the hash value. Consequen… |
CVE-2018-16149 | Medium | 5.9 | 2018-11-07 | In sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature verification blindly trusts the declared lengths in the ASN.1 structure… |
CVE-2018-18653 | High | 7.8 | 2018-10-26 | The Linux kernel, as used in Ubuntu 18.10 and when booted with UEFI Secure Boot enabled, allows privileged local users to bypass intended Secure Boot restricti… |
CVE-2018-8955 | Critical | 9.8 | 2018-10-24 | The installer for BitDefender GravityZone relies on an encoded string in a filename to determine the URL for installation metadata, which allows remote attacke… |
CVE-2018-15374 | Medium | 6.7 | 2018-10-05 | A vulnerability in the Image Verification feature of Cisco IOS XE Software could allow an authenticated, local attacker to install a malicious software image o… |
CVE-2018-16152 | High | 7.5 | 2018-09-26 | In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not… |
CVE-2018-16151 | High | 7.5 | 2018-09-26 | In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not… |
CVE-2018-15836 | High | 7.5 | 2018-09-26 | In verify_signed_hash() in lib/liboswkeys/signatures.c in Openswan before 2.6.50.1, the RSA implementation does not verify the value of padding string during P… |
CVE-2018-16515 | High | 8.8 | 2018-09-18 | Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event… |
CVE-2018-7685 | High | 7.8 | 2018-08-31 | The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not disp… |
CVE-2018-0501 | Medium | 5.9 | 2018-08-21 | The mirror:// method implementation in Advanced Package Tool (APT) 1.6.x before 1.6.4 and 1.7.x before 1.7.0~alpha3 mishandles gpg signature verification for t… |
CVE-2018-5383 | Medium | 6.8 | 2018-08-07 | Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and iOS versions before 11.4, and Android versions before t… |
CVE-2018-5387 | High | 7.5 | 2018-07-24 | Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate t… |
CVE-2016-9604 | Medium | 4.4 | 2018-07-11 | It was discovered in the Linux kernel before 4.11-rc8 that root can gain direct access to an internal keyring, such as '.dns_resolver' in RHEL-7 or '.builtin_t… |
CVE-2017-3198 | Critical | 9.8 | 2018-07-09 | GIGABYTE BRIX UEFI firmware does not cryptographically validate images prior to updating the system firmware. Additionally, the firmware updates are served ove… |
CVE-2018-10988 | High | 7.8 | 2018-07-05 | An issue was discovered on Diqee Diqee360 devices. A firmware update process, integrated into the firmware, starts at boot and tries to find the update folder… |
CVE-2018-1000539 | Medium | 5.3 | 2018-06-26 | Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted… |
CVE-2018-12356 | Critical | 9.8 | 2018-06-15 | An issue was discovered in password-store.sh in pass in Simple Password Store 1.7.x before 1.7.2. The signature verification routine parses the output of GnuPG… |
CVE-2018-12019 | High | 7.5 | 2018-06-13 | The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of m… |
CVE-2018-10407 | Medium | 5.5 | 2018-06-13 | An issue was discovered in Carbon Black Cb Response. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing fu… |
CVE-2018-10470 | Medium | 5.3 | 2018-06-12 | Little Snitch versions 4.0 to 4.0.6 use the SecStaticCodeCheckValidityWithErrors() function without the kSecCSCheckAllArchitectures flag and therefore do not v… |
CVE-2017-16005 | High | 7.5 | 2018-06-04 | Http-signature is a "Reference implementation of Joyent's HTTP Signature Scheme". In versions <=0.9.11, http-signature signs only the header values, but not th… |
CVE-2016-1000342 | High | 7.5 | 2018-06-04 | In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject… |
CVE-2016-1000338 | High | 7.5 | 2018-06-01 | In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject ex… |
CVE-2018-3756 | High | 7.5 | 2018-06-01 | Hyperledger Iroha versions v1.0_beta and v1.0.0_beta-1 are vulnerable to transaction and block signature verification bypass in the transaction and block valid… |
CVE-2018-6664 | Medium | 5.8 | 2018-05-25 | Application Protections Bypass vulnerability in Microsoft Windows in McAfee Data Loss Prevention (DLP) Endpoint before 10.0.500 and DLP Endpoint before 11.0.40… |
CVE-2017-18146 | Critical | 9.8 | 2018-04-11 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9650, MSM8909W… |
CVE-2018-4111 | Medium | 5.9 | 2018-04-03 | An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the "Mail" component. It allows man-in-the-middle attac… |
CVE-2018-1000076 | Critical | 9.8 | 2018-03-13 | RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier… |
CVE-2018-7711 | High | 8.1 | 2018-03-05 | HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values in the signature validation utilities, allowing an… |
CVE-2018-7644 | High | 7.5 | 2018-03-05 | The XmlSecLibs library as used in the saml2 library in SimpleSAMLphp before 1.15.3 incorrectly verifies signatures on SAML assertions, allowing a remote attack… |
CVE-2018-0489 | Medium | 6.5 | 2018-02-27 | Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of use… |
CVE-2018-6459 | Medium | 5.3 | 2018-02-20 | The rsa_pss_params_parse function in libstrongswan/credentials/keys/signature_params.c in strongSwan 5.6.1 allows remote attackers to cause a denial of service… |
CVE-2017-18122 | High | 8.1 | 2018-02-02 | A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will regard as valid any u… |
CVE-2017-15090 | Medium | 5.9 | 2018-01-23 | An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been… |
CVE-2018-0486 | Medium | 6.5 | 2018-01-13 | Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user… |
CVE-2018-0114 | High | 7.5 | 2018-01-04 | A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is… |
CVE-2017-17848 | High | 7.5 | 2017-12-27 | An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signe… |
CVE-2017-17847 | High | 7.5 | 2017-12-27 | An issue was discovered in Enigmail before 1.9.9. Signature spoofing is possible because the UI does not properly distinguish between an attachment signature… |
CVE-2017-12333 | Medium | 6.7 | 2017-11-30 | A vulnerability in Cisco NX-OS System Software could allow an authenticated, local attacker to bypass signature verification when loading a software image. The… |
CVE-2017-12331 | Medium | 6.7 | 2017-11-30 | A vulnerability in Cisco NX-OS System Software could allow an authenticated, local attacker to bypass signature verification when loading a software patch. The… |
CVE-2017-8190 | Medium | 6.7 | 2017-11-22 | FusionSphere OpenStack V100R006C00SPC102(NFV)has an improper verification of cryptographic signature vulnerability. The software does not verify the cryptograp… |
CVE-2017-8177 | Medium | 5.3 | 2017-11-22 | Huawei APP HiWallet earlier than 5.0.3.100 versions do not support signature verification for APK file. An attacker could exploit this vulnerability to hijack… |
CVE-2017-11400 | Medium | 6.8 | 2017-11-20 | An issue has been discovered on the Belden Hirschmann Tofino Xenon Security Appliance before 03.2.00. An incomplete firmware signature allows a local attacker… |
CVE-2017-16853 | High | 8.1 | 2017-11-16 | The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure it… |
CVE-2017-16852 | High | 8.1 | 2017-11-16 | shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itse… |
CVE-2017-5066 | Medium | 6.5 | 2017-10-27 | Insufficient consistency checks in signature handling in the networking stack in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029… |
CVE-2017-13083 | Medium | 5.3 | 2017-10-18 | Akeo Consulting Rufus prior to version 2.17.1187 does not adequately validate the integrity of updates downloaded over HTTP, allowing an attacker to easily con… |
CVE-2017-12974 | High | 7.5 | 2017-08-20 | Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve, which allows atta… |
CVE-2017-10669 | Medium | 6.5 | 2017-06-30 | Signature Wrapping exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET). An attacker with access t… |
CVE-2014-9934 | High | 7.8 | 2017-05-16 | A PKCS#1 v1.5 signature verification routine in all Android releases from CAF using the Linux kernel may not check padding. |
CVE-2017-2423 | Critical | 9.8 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. The issue involves the "Security" component… |
CVE-2016-8021 | Medium | 5.0 | 2017-03-14 | Improper verification of cryptographic signature vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authentica… |
CVE-2017-6445 | High | 8.1 | 2017-03-05 | The auto-update feature of Open Embedded Linux Entertainment Center (OpenELEC) 6.0.3, 7.0.1, and 8.0.4 uses neither encrypted connections nor signed updates. A… |
CVE-2014-1498 | | 2014-03-19 | The crypto.generateCRMFRequest method in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not properly validate a certain key type, which allows remo… | |
CVE-2013-3900 | Medium | 5.5 | 2013-12-11 | Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to infor… |
CVE-2011-3965 | | 2012-02-09 | Google Chrome before 17.0.963.46 does not properly check signatures, which allows remote attackers to cause a denial of service (application crash) via unspeci… | |
CVE-2005-2182 | High | 7.5 | 2005-07-11 | Grandstream BudgeTone (BT) 100 Voice over IP (VoIP) phones do not properly check the Call-ID, branch, and tag values in a NOTIFY message to verify a subscripti… |
CVE-2005-2181 | High | 7.5 | 2005-07-11 | Cisco 7940/7960 Voice over IP (VoIP) phones do not properly check the Call-ID, branch, and tag values in a NOTIFY message to verify a subscription, which allow… |
CVE-2002-1796 | High | 7.8 | 2002-12-31 | ChaiVM EZloader for HP color LaserJet 4500 and 4550 and HP LaserJet 4100 and 8150 does not properly verify JAR signatures for new services, which allows local… |
CVE-2002-1706 | High | 7.5 | 2002-12-31 | Cisco IOS software 11.3 through 12.2 running on Cisco uBR7200 and uBR7100 series Universal Broadband Routers allows remote attackers to modify Data Over Cable… |