Improper Verification of Cryptographic Signature
CWE-347
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
We track 450 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.4. 7 have been exploited in real attacks.
Latest Improper Verification of Cryptographic Signature vulnerabilities
- 7.5 High severity
Client Connector: Improper Verification of Cryptographic Signature
Anti-tampering can be disabled under certain conditions without signature validation. This affects Zscaler Client Connector <4.2.0.190 with anti-tampering enabled.
- 7.2 High severity
WBR-6013: Improper Verification of Cryptographic Signature
A firmware update vulnerability exists in the boa formUpload functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted network packets can lead to arbitrary firmware update. An attacker can provide a malicious file to trigger this vulnerability.
- 7.8 High severity
Samsung Mobile Devices: Improper Verification of Cryptographic Signature
Improper verification of signature in FilterProvider prior to SMR Jul-2024 Release 1 allows local attackers to execute privileged behaviors. User interaction is required for triggering this vulnerability.
- 8.8 High severity
WebSphere Application Server: Improper Verification of Cryptographic Signature
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to identity spoofing by an authenticated user due to improper signature validation. IBM X-Force ID: 294721.
- 9.8 Critical severity
Android: Use of a Broken or Risky Cryptographic Algorithm
There is a possible escalation of privilege due to improperly used crypto. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- 7.5 High severity
authlib: Improper Verification of Cryptographic Signature
lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asymmetric public key. (This is similar to CVE-2022-29217 and CVE-2024-33663.)
- 7.8 High severity
Zoom Workplace VDI App for Windows: Improper Verification of Cryptographic Signature
Insufficient verification of data authenticity in the installer for Zoom Workplace VDI App for Windows may allow an authenticated user to conduct an escalation of privilege via local access.
- 7.8 High severity
Desktop: Improper Verification of Cryptographic Signature
Parallels Desktop Updater Improper Verification of Cryptographic Signature Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain
- 10.0 Critical severity
xml-crypto: Improper Verification of Cryptographic Signature
xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default configuration does not check authorization of the signer, it only checks the validity of the signature per section 3.2.2 of the w3 xmldsig-core-20080610
- 9.8 Critical severity
Client Connector: Improper Verification of Cryptographic Signature
A fallback mechanism in code sign checking on macOS may allow arbitrary code execution. This issue affects Zscaler Client Connector on MacOS prior to 4.2.
- 7.8 High severity
Zoom Desktop Client for Windows: Improper Verification of Cryptographic Signature
Improper privilege management in the installer for Zoom Desktop Client for Windows before version 5.17.10 may allow an authenticated user to conduct an escalation of privilege via local access.
- 9.1 Critical severity
HarmonyOS: Improper Verification of Cryptographic Signature
Vulnerability of package name verification being bypassed in the HwIms module. Impact: Successful exploitation of this vulnerability will affect availability.
- 8.1 High severity
covr_1100: Improper Verification of Cryptographic Signature
An issue in D-Link COVR 1100, 1102, 1103 AC1200 Dual-Band Whole-Home Mesh Wi-Fi System (Hardware Rev B1) truncates Wireless Access Point Passwords (WPA-PSK) allowing an attacker to gain unauthorized network access via weak authentication controls.
- 9.1 Critical severity
FactoryTalk® Service Platform: Improper Verification of Cryptographic Signature
A vulnerability exists in Rockwell Automation FactoryTalk® Service Platform that allows a malicious user to obtain the service token and use it for authentication on another FTSP directory. This is due to the lack of digital signing between the FTSP service to
- 7.5 High severity
Red Hat Enterprise Linux 9: Improper Verification of Cryptographic Signature
A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote clie
- 8.8 High severity
aries-cloudagent-python: Improper Verification of Cryptographic Signature
Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and services running in non-mobile environments. When verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDP-VCs), th
- 9.1 Critical severity
JetNet Series: Improper Verification of Cryptographic Signature
An Improper Verification of Cryptographic Signature vulnerability in the update process of Korenix JetNet Series allows replacing the whole operating system including Trusted Executables. This issue affects JetNet devices older than firmware version 2024/01.
- 7.1 High severity
Magic OS: Improper Verification of Cryptographic Signature
Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file
- 7.1 High severity
Magic OS: Improper Verification of Cryptographic Signature
Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file
- 7.1 High severity
NTH-AN00: Improper Verification of Cryptographic Signature
Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.
- 7.1 High severity
NTH-AN00: Improper Verification of Cryptographic Signature
Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.
- 7.1 High severity
NTH-AN00: Improper Verification of Cryptographic Signature
Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.
- 8.8 High severity
yii2-authclient: Improper Authentication
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the `authCodeVerifier` should be
- 7.5 High severity
misskey: Improper Verification of Cryptographic Signature
Misskey is an open source, decentralized social media platform. Misskey's missing signature validation allows arbitrary users to impersonate any remote user. This issue has been patched in version 2023.11.1-beta.1.
- 8.8 High severity
PNV-A6081R: Improper Verification of Cryptographic Signature
Bashis, a Security Researcher at IPVM has found a flaw that allows for a remote code execution during the installation of Wave on the camera device. The Wave server application in camera device was vulnerable to command injection allowing an attacker to run ar
- 7.5 High severity
VMware Tools: Improper Verification of Cryptographic Signature
VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virt
- 7.5 High severity
browserify-sign: Improper Verification of Cryptographic Signature
browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures th
- 7.8 High severity
Client Connector: Improper Verification of Cryptographic Signature
Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.
- 7.5 High severity
Udm: Improper Verification of Cryptographic Signature
pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompressed public key that has not been validated. An attacker can send arbitrary SUCIs to the UDM, which
- 8.8 High severity
OMAP: Improper Verification of Cryptographic Signature
The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) performs an RSA check implemented in mask ROM when loading a module through the SK_LOAD routine. However, only the module header authenticity is validated. An adversary can r
- 7.8 High severity
BIG-IP Edge Client: Improper Verification of Cryptographic Signature
The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. This vulnerability is due to an incomplete fix for CVE-2023-38418. Note: Software versions which have reached End of Technical Su
- 8.1 High severity
warpgate: Improper Verification of Cryptographic Signature
Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verification for a user can be bypassed by sending an SSH key offer without a signature. This allows bypassing authentication under following con
- 7.8 High severity
Cisco IOS XR Software: Insufficient Verification of Data Authenticity
A vulnerability in the iPXE boot function of Cisco IOS XR software could allow an authenticated, local attacker to install an unverified software image on an affected device. This vulnerability is due to insufficient image verification. An attacker could explo
- 7.0 High severity
Cisco IOS XR Software: Time-of-check Time-of-use (TOCTOU) Race Condition
A vulnerability in Cisco IOS XR Software image verification checks could allow an authenticated, local attacker to execute arbitrary code on the underlying operating system. This vulnerability is due to a time-of-check, time-of-use (TOCTOU) race condition when
- 7.8 High severity
QMS Automotive: Improper Verification of Cryptographic Signature
A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application uses weak outdated application signing mechanism. This could allow an attacker to tamper the application code.
- 7.8 High severity
Acronis Agent: Improper Verification of Cryptographic Signature
Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Agent (macOS) before build 30600, Acronis Cyber Protect 15 (macOS) before build 35979.
- 9.8 Critical severity
ZIA Admin Portal: Improper Verification of Cryptographic Signature
An Improper Verification of Cryptographic Signature in the SAML authentication of the Zscaler Admin UI allows a Privilege Escalation.This issue affects Admin UI: from 6.2 before 6.2r.
- 7.2 High severity
Cisco Emergency Responder: Improper Privilege Management
A vulnerability in Cisco Emergency Responder, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an authenticated, remote attacker to eleva
- 8.8 High severity
EBTS/MBTS Base Radio: Improper Verification of Cryptographic Signature
Motorola EBTS/MBTS Base Radio fails to check firmware authenticity. The Motorola MBTS Base Radio lacks cryptographic signature validation for firmware update packages, allowing an authenticated attacker to gain arbitrary code execution, extract secret key mate
- 8.8 High severity
MBTS Site Controller: Improper Verification of Cryptographic Signature
Motorola MBTS Site Controller fails to check firmware update authenticity. The Motorola MBTS Site Controller lacks cryptographic signature validation for firmware update packages, allowing an authenticated attacker to gain arbitrary code execution, extract sec