Insufficient Verification of Data Authenticity
CWE-345
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
We track 338 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.4. 2 have been exploited in real attacks.
Latest Insufficient Verification of Data Authenticity vulnerabilities
- 8.7 High severity
stats: Insufficient Verification of Data Authenticity
stats is a macOS system monitor in for the menu bar. The Stats application is vulnerable to a local privilege escalation due to the insecure implementation of its XPC service. The application registers a Mach service under the name `eu.exelban.Stats.SMC.Helper
- 9.8 Critical severity
cph2_echarge_firmware: Insufficient Verification of Data Authenticity
Affected devices beacon to eCharge cloud infrastructure asking if there are any command they should run. This communication is established over an insecure channel since peer verification is disabled everywhere. Therefore, remote unauthenticated users suitably
- 7.8 High severity
Infotainment: Insufficient Verification of Data Authenticity
Visteon Infotainment VIP MCU Code Insufficient Validation of Data Authenticity Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Visteon Infotainment systems. An attacker mus
- 7.8 High severity
RSLogix 500®: Insufficient Verification of Data Authenticity
VULNERABILITY DETAILS Rockwell Automation used the latest versions of the CVSS scoring system to assess the following vulnerabilities. The following vulnerabilities were reported to us by Sharon Brizinov of Claroty Research - Team82. A feature in the affected
- 7.5 High severity
gradio: Insufficient Verification of Data Authenticity
Gradio is an open-source Python package designed for quick prototyping. This vulnerability is a **lack of integrity check** on the downloaded FRP client, which could potentially allow attackers to introduce malicious code. If an attacker gains access to the re
- 7.5 High severity
traefik: Insufficient Verification of Data Authenticity
Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a HTTP client, it shou
- 7.5 High severity
dns_server: Insufficient Verification of Data Authenticity
An issue was discovered in Technitium through 11.0.3. It enables attackers to conduct a DNS cache poisoning attack and inject fake responses within 1 second, which is impactful.
- 7.8 High severity
Chrome: Insufficient Verification of Data Authenticity
Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a crafted symbolic link. (Chromium security severity: Medium)
- 7.8 High severity
Chrome: Insufficient Verification of Data Authenticity
Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a crafted symbolic link. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Insufficient Verification of Data Authenticity
Insufficient data validation in Dawn in Google Chrome on Android prior to 127.0.6533.88 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
- 8.9 High severity
dnsjava: Insufficient Verification of Data Authenticity
dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. This vulnerability is fixed in 3.6.0.
- 8.8 High severity
Chrome: Insufficient Verification of Data Authenticity
Insufficient data validation in Updater in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High)
- 7.5 High severity
python-certifi: Insufficient Verification of Data Authenticity
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi
- 7.5 High severity
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Insufficient Verification of Data Authenticity
In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.
- 7.5 High severity
NJ Series CPU Unit: Insufficient Verification of Data Authenticity
Insufficient verification of data authenticity issue exists in NJ Series CPU Unit all versions and NX Series CPU Unit all versions. If a user program in the affected product is altered, the product may not be able to detect the alteration.
- 7.2 High severity
community: Insufficient Verification of Data Authenticity
Invision Community through 4.7.16 allows remote code execution via the applications/core/modules/admin/editor/toolbar.php IPS\core\modules\admin\editor\_toolbar::addPlugin() method. This method handles uploaded ZIP files that are extracted into the application
- 8.8 High severity
ID Charger Connect & Pro: Insufficient Verification of Data Authenticity
An attacker with access to the private network (the charger is connected to) or local access to the Ethernet-Interface can exploit a faulty implementation of the JWT-library in order to bypass the password authentication to the web configuration interface and
- 9.8 Critical severity
P3-550E: Improper Control of Generation of Code
A code injection vulnerability exists in the scan_lib.bin functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted scan_lib.bin can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
- 8.8 High severity
RAX30: Origin Validation Error
NETGEAR RAX30 lighttpd Misconfiguration Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30. Authentication is not required to exploit this vulnerability
- 7.3 High severity
Red Hat JBoss Enterprise Application Platform 8: Insufficient Verification of Data Authenticity
A flaw was found in Red Hat Enterprise Application Platform 8. When an OIDC app that serves multiple tenants attempts to access the second tenant, it should prompt the user to log in again since the second tenant is secured with a different OIDC configuration.
- 7.5 High severity
HarmonyOS: Insufficient Verification of Data Authenticity
Vulnerability of package name verification being bypassed in the Calendar app. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
astro-shield: Insufficient Verification of Data Authenticity
Astro-Shield is an integration to enhance website security with SubResource Integrity hashes, Content-Security-Policy headers, and other techniques. Versions from 1.2.0 to 1.3.1 of Astro-Shield allow bypass to the allow-lists for cross-origin resources by intr
- 7.3 High severity
querybook: Insufficient Verification of Data Authenticity
Querybook is a Big Data Querying UI, combining collocated table metadata and a simple notebook interface. Querybook's datadocs functionality works by using a Websocket Server. The client talks to this WSS whenever updating/deleting/reading any cells as well as
- 9.8 Critical severity
Firefox: Insufficient Verification of Data Authenticity
The `fetch()` API and navigation incorrectly shared the same cache, as the cache key did not include the optional headers `fetch()` may contain. Under the correct circumstances, an attacker may have been able to poison the local browser cache by priming it wit
- 7.8 High severity
moby: Origin Validation Error
Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBU
- 7.5 High severity
HarmonyOS: Insufficient Verification of Data Authenticity
Vulnerability of trust relationships being inaccurate in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentiality.
- 9.8 Critical severity
IntelliJ IDEA: Insufficient Verification of Data Authenticity
In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified in the project configuration
- 7.0 High severity
electron: Insufficient Verification of Data Authenticity
Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. This only impacts apps that have the `embeddedAsarIntegrityValidation` and `onlyLoadAppFromAsar` fuses enabled. Apps without these fuses enable
- 7.5 High severity
xml-security: Insufficient Verification of Data Authenticity
xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash value of the related XML-document matches a specific DigestValue-value, but also that the cryptographic signature on the
- 7.5 High severity
json-web-token: Insufficient Verification of Data Authenticity
joaquimserafim/json-web-token is a javascript library use to interact with JSON Web Tokens (JWT) which are a compact URL-safe means of representing claims to be transferred between two parties. Versions prior to 4.0.0 are vulnerable to a JWT algorithm confusio
- 8.8 High severity
vantage6: Insufficient Verification of Data Authenticity
vantage6 is a framework to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). In affected versions a node does not check if an image is allowed to run if a `parent_id` is set. A malicious party that
- 7.1 High severity
kyverno: Insufficient Verification of Data Authenticity
Kyverno is a policy engine designed for Kubernetes. An issue was found in Kyverno that allowed an attacker to control the digest of images used by Kyverno users. The issue would require the attacker to compromise the registry that the Kyverno users fetch their
- 8.8 High severity
PNV-A6081R: Improper Verification of Cryptographic Signature
Bashis, a Security Researcher at IPVM has found a flaw that allows for a remote code execution during the installation of Wave on the camera device. The Wave server application in camera device was vulnerable to command injection allowing an attacker to run ar
- 9.1 Critical severity
MELSEC-F Series FX3U-16MT/ES: Insufficient Verification of Data Authenticity
Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC-F Series CPU modules, MELSEC iQ-F Series, MELSEC iQ-R series CPU modules, MELSEC iQ-R series, MELSEC iQ-L series, MELSEC Q series, MELSEC-L series, Mitsubishi
- 8.8 High severity
Chrome: Insufficient Verification of Data Authenticity
Insufficient data validation in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
- 7.8 High severity
core: Improper Control of Generation of Code
Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. This enables all sorts of attacks, including arbitrary JavaScript execution, limited nati
- 9.0 Critical severity
core: Insufficient Verification of Data Authenticity
Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure53 detected `auth_callback=1`, which is leveraged by the WebSocket authentication logic in tandem with the `state` parameter. The state param
- 7.8 High severity
arduino-create-agent: Insufficient Verification of Data Authenticity
Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint `/v2/pkgs/tools/installed`. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration
- 7.5 High severity
Node: Insufficient Verification of Data Authenticity
When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts
- 7.8 High severity
BIG-IP Edge Client: Insufficient Verification of Data Authenticity
An insufficient verification of data vulnerability exists in BIG-IP Edge Client Installer on macOS that may allow an attacker elevation of privileges during the installation process. Note: Software versions which have reached End of Technical Support (EoTS) ar