Insufficient Verification of Data Authenticity
CWE-345
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
We track 338 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.4. 2 have been exploited in real attacks.
Latest Insufficient Verification of Data Authenticity vulnerabilities
- 9.8 Critical severity
Safety Manager Firmware: Insufficient Verification of Data Authenticity
Honeywell Experion PKS Safety Manager (SM and FSC) through 2022-05-06 has Insufficient Verification of Data Authenticity. According to FSCT-2022-0053, there is a Honeywell Experion PKS Safety Manager insufficient logic security controls issue. The affected com
- 7.2 High severity
Ace1000 Firmware: Insufficient Verification of Data Authenticity
The Motorola ACE1000 RTU through 2022-05-02 mishandles firmware integrity. It utilizes either the STS software suite or ACE1000 Easy Configurator for performing firmware updates. In case of the Easy Configurator, firmware updates are performed through access t
- 8.8 High severity
Ace1000 Firmware: Insufficient Verification of Data Authenticity
Motorola ACE1000 RTUs through 2022-05-02 mishandle application integrity. They allow for custom application installation via either STS software, the C toolkit, or the ACE1000 Easy Configurator. In the case of the Easy Configurator, application images (as PLX/
- 9.8 Critical severity
Mdlc: Use of a Broken or Risky Cryptographic Algorithm
The Motorola MDLC protocol through 2022-05-02 mishandles message integrity. It supports three security modes: Plain, Legacy Encryption, and New Encryption. In Legacy Encryption mode, traffic is encrypted via the Tiny Encryption Algorithm (TEA) block-cipher in
- 9.8 Critical severity
Pc10g-cpu Tcc-6353 Firmware: Insufficient Verification of Data Authenticity
JTEKT TOYOPUC PLCs through 2022-04-29 do not ensure data integrity. They utilize the unauthenticated CMPLink/TCP protocol for engineering purposes, including downloading projects and control logic to the PLC. Control logic is downloaded to the PLC on a block-b
- 7.5 High severity
Lvskihp Outdoorunit Firmware: Insufficient Verification of Data Authenticity
On Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 devices, the RPC endpoint crtc_fw_upgrade provides a means of provisioning a firmware update for the device. /lib/functions/wnc_jsonsh/wnc_crtc_fw.sh has no cryptographic validation of the image, thus all
- 7.5 High severity
OPC UA Modicon Communication Module: Insufficient Verification of Data Authenticity
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could cause loading of unauthorized firmware images due to improper verification of the firmware signature. Affected Products: X80 advanced RTU Communication Module (BMENOR2200
- 7.2 High severity
Cisco Adaptive Security Appliance (ASA) Software: Insufficient Verification of Data Authenticity
A vulnerability in the packaging of Cisco Adaptive Security Device Manager (ASDM) images and the validation of those images by Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker with administrative privileges to uplo
- 10.0 High severity
MULTIPROG: Insufficient Verification of Data Authenticity
An unauthenticated, remote attacker could upload malicious logic to the devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.
- 10.0 High severity
ILC 1x0: Insufficient Verification of Data Authenticity
An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.
- 7.8 High severity
SINEMA Remote Connect Server: Insufficient Verification of Data Authenticity
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The application does not perform the integrity check of the update packages. Without validation, an admin user might be tricked to install a malicious package, granting
- 9.8 Critical severity
Apache HTTP Server: Insufficient Verification of Data Authenticity
Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.
- 7.5 High severity
Cisco Adaptive Security Appliance (ASA) Software: Insufficient Verification of Data Authenticity
A vulnerability in the implementation of the Datagram TLS (DTLS) protocol in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause high CPU utilization, resul
- 7.8 High severity
DA50N: Insufficient Verification of Data Authenticity
Authorized users may install a maliciously modified package file when updating the device via the web user interface. The user may inadvertently use a package file obtained from an unauthorized source or a file that was compromised between download and deploym
- 8.1 High severity
Cisco IP Phone 7800 Series with Multiplatform…: Cross-Site Request Forgery
A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of the web-base
- 9.8 Critical severity
Trend Micro Apex Central Arbitrary File Upload Exploited
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.
- 9.1 Critical severity
APC Smart-UPS: Insufficient Verification of Data Authenticity
A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leaked and used to upload malicious firmware. Affected Product: APC Smart-UPS Family: SMT Series (SMT Series ID=18:
- 9.8 Critical severity
My Cloud: Insufficient Verification of Data Authenticity
A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loading through an unsecured HTTP call. This was a result insufficient verification of calls to the device. The vulnerabili