Insufficient Verification of Data Authenticity
CWE-345
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
We track 338 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.4. 2 have been exploited in real attacks.
Latest Insufficient Verification of Data Authenticity vulnerabilities
- 9.0 Critical severity
cilium: Insufficient Verification of Data Authenticity
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to update pod labels can cause Cilium to apply incorrect network policies. This issue arises due to the fact that on pod update, Cilium inco
- 8.8 High severity
EVE OS: Insufficient Verification of Data Authenticity
In EVE OS, the “measured boot” mechanism prevents a compromised device from accessing the encrypted data located in the vault. As per the “measured boot” design, the PCR values calculated at different stages of the boot process will change if any of their resp
- 7.8 High severity
Cisco IOS XR Software: Insufficient Verification of Data Authenticity
A vulnerability in the iPXE boot function of Cisco IOS XR software could allow an authenticated, local attacker to install an unverified software image on an affected device. This vulnerability is due to insufficient image verification. An attacker could explo
- 7.2 High severity
Secret Server: Insufficient Verification of Data Authenticity
Insufficient verification of data authenticity vulnerability in Delinea Secret Server, in its v10.9.000002 version. An attacker with an administrator account could perform software updates without proper integrity verification mechanisms. In this scenario, the
- 7.8 High severity
RARLAB WinRAR Code Execution Exploited
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has th
- 7.8 High severity
voip_phones: Insufficient Verification of Data Authenticity
An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. The validation of firmware images only consists of simple checksum checks for different firmware components. Thus, by knowing how to calculate and where to store the required checksums
- 8.8 High severity
Zoom Desktop Client for Windows: Insufficient Verification of Data Authenticity
Insufficient verification of data authenticity in Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of privilege via network access.
- 9.8 Critical severity
Cleaning Business Software: Insufficient Verification of Data Authenticity
In PHPJabbers Cleaning Business Software 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.
- 9.8 Critical severity
Class Scheduling System: Insufficient Verification of Data Authenticity
In PHP Jabbers Class Scheduling System 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.
- 9.8 Critical severity
python-certifi: Insufficient Verification of Data Authenticity
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were
- 9.8 Critical severity
C300: Insufficient Verification of Data Authenticity
Controller may be loaded with malicious firmware which could enable remote code execution. See Honeywell Security Notification for recommendations on upgrading and versioning.
- 9.8 Critical severity
CMS Commander – Manage Multiple Sites: Insufficient Entropy
The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the use of an insufficiently unique cryptographic signature on the 'cmsc_add_site' function in versions up to, and including, 2.287. This makes it possible for unauthenticated
- 7.8 High severity
Printer Driver Packager NX: Insufficient Verification of Data Authenticity
The driver installation package created by Printer Driver Packager NX v1.0.02 to v1.1.25 fails to detect its modification and may spawn an unexpected process with the administrative privilege. If a non-administrative user modifies the driver installation packa
- 7.8 High severity
WebAccess/SCADA: Insufficient Verification of Data Authenticity
If an attacker can trick an authenticated user into loading a maliciously crafted .zip file onto Advantech WebAccess version 8.4.5, a web shell could be used to give the attacker full control of the SCADA server.
- 9.8 Critical severity
HQT401: Improper Authentication
Insufficient authentication in the MQTT backend (broker) allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles using the HopeChart HQT-401 telematics unit. Other models are possibly affected too. Multiple vulnerabi
- 9.8 Critical severity
Wordapp: Insufficient Verification of Data Authenticity
The Wordapp plugin for WordPress is vulnerable to authorization bypass due to an use of insufficiently unique cryptographic signature on the 'wa_pdx_op_config_set' function in versions up to, and including, 1.6.0. This makes it possible for unauthenticated att
- 9.8 Critical severity
OvrC Cloud: Insufficient Verification of Data Authenticity
Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly. The device only calculates the MD5 hash of the firmware and does not check using a private-public key mechanism. The lack of complete PKI system firmware signature cou
- 7.2 High severity
Alternergy Power Control Software: Insufficient Verification of Data Authenticity
Altenergy Power Control Software C1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the component /models/management_model.php.
- 9.8 Critical severity
Dr750-2ch Lte Firmware: Insufficient Verification of Data Authenticity
BlackVue DR750-2CH LTE v.1.012_2022.10.26 does not employ authenticity check for uploaded firmware. This can allow attackers to upload crafted firmware which contains backdoors and enables arbitrary code execution.
- 8.8 High severity
IGSS Data Server(IGSSdataServer.exe): Insufficient Verification of Data Authenticity
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause manipulation of dashboard files in the IGSS project report directory, when an attacker sends specific crafted messages to the Data Server TCP por
- 7.5 High severity
SwagPayPal: Insufficient Verification of Data Authenticity
SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used (PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, Credit card), the amount and item list sent to PayPal may not be identical to the one in
- 7.8 High severity
Wattbox WB-300-IP-3: Insufficient Verification of Data Authenticity
Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior use a proprietary local area network (LAN) protocol that does not verify updates to the device. An attacker could upload a malformed update file to the device and execute arbitrary code.
- 7.8 High severity
NVIDIA GPU Display Driver for Windows: Out-of-bounds Read
NVIDIA GPU Display Driver for Windows contains a vulnerability where a regular user can cause an out-of-bounds read, which may lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.
- 7.5 High severity
github.com/peterzen/goresolver: Insufficient Verification of Data Authenticity
DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. Root DNSSEC public keys are not validated, permitting an attacker to present a self-signed root key and d
- 7.8 High severity
Deltav Distributed Control System Sq…: Insufficient Verification of Data Authenticity
Emerson DeltaV Distributed Control System (DCS) has insufficient verification of firmware integrity (an inadequate checksum approach, and no signature). This affects versions before 14.3 of DeltaV M-series, DeltaV S-series, DeltaV P-series, DeltaV SIS, and Del
- 7.5 High severity
CodeIgniter4: Insufficient Verification of Data Authenticity
CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the server is behind a reverse proxy. This issue has been patched, please upgrade to version 4.2.11 or later, and configure `Config\App::$proxy
- 7.5 High severity
Dap-2310 Firmware: Insufficient Verification of Data Authenticity
D-Link devices DAP-2310 v2.10rc036 and earlier, DAP-2330 v1.06rc020 and earlier, DAP-2360 v2.10rc050 and earlier, DAP-2553 v3.10rc031 and earlier, DAP-2660 v1.15rc093 and earlier, DAP-2690 v3.20rc106 and earlier, DAP-2695 v1.20rc119_beta31 and earlier, DAP-332
- 7.5 High severity
python-certifi: Insufficient Verification of Data Authenticity
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of
- 7.8 High severity
OndiskPlayerAgent: Insufficient Verification of Data Authenticity
Remote code execution vulnerability due to insufficient verification of URLs, etc. in OndiskPlayerAgent. A remote attacker could exploit the vulnerability to cause remote code execution by causing an arbitrary user to download and execute malicious code.
- 10.0 Critical severity
Remote Access Server (RAS): Insufficient Verification of Data Authenticity
All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s web portal is vulnerable to accepting malicious firmware packages that could provide a backdoor to an attacker and provide privilege escalation to the device.
- 8.6 High severity
Fortinet AV Engine, FortiMail, FortiOS…: Insufficient Verification of Data Authenticity
An insufficient verification of data authenticity vulnerability [CWE-345] in FortiClient, FortiMail and FortiOS AV engines version 6.2.168 and below and version 6.4.274 and below may allow an attacker to bypass the AV engine via manipulating MIME attachment wi
- 7.5 High severity
LOGO! 8 BM (incl. SIPLUS variants): Insufficient Verification of Data Authenticity
A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Affected devices load firmware updates without checking the authenticity. Furthermore the integrity of the unencrypted firmware is only verified by a non-cryptogra
- 9.9 Critical severity
Boundary: Insufficient Verification of Data Authenticity
HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct scopes, allowing potential privilege escalation for authorized users of another scope. Fixed in Boundary 0.10.2.
- 8.8 High severity
nbm-d88n_firmware: Insufficient Verification of Data Authenticity
Patlite NH-FB v1.46 and below was discovered to contain insufficient firmware validation during the upgrade firmware file upload process. This vulnerability allows authenticated attackers to create and upload their own custom-built firmware and inject maliciou
- 7.5 High severity
mod_wsgi: Insufficient Verification of Data Authenticity
A vulnerability was found in mod_wsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-IP header to the target WSGI application because the condition to remove it is missing.
- 7.8 High severity
Proficy Machine Edition: Insufficient Verification of Data Authenticity
Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-353 Missing Support for Integrity Check, and has no authentication or authorization of data packets after establishing a connection for the SRTP protocol.
- 7.8 High severity
Zoom Client for Meetings for MacOS: Insufficient Verification of Data Authenticity
The Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with version 5.7.3 and before 5.11.6 contains a vulnerability in the auto update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to r
- 7.8 High severity
Controlwave Pac Firmware: Insufficient Verification of Data Authenticity
The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity. They utilize the BSAP-IP protocol to transmit firmware updates. Firmware updates are supplied as CAB archive files containing a binary firmware image. In all cases,
- 9.8 Critical severity
Dl8000 Firmware: Insufficient Verification of Data Authenticity
The Emerson ROC and FloBoss RTU product lines through 2022-05-02 perform insecure filesystem operations. They utilize the ROC protocol (4000/TCP, 5000/TCP) for communications between a master terminal and RTUs. Opcode 203 of this protocol allows a master termi
- 7.5 High severity
HarmonyOS: Insufficient Verification of Data Authenticity
The recovery module has a vulnerability of bypassing the verification of an update package before use. Successful exploitation of this vulnerability may affect system stability.