Improper Verification of Cryptographic Signature
CWE-347
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
We track 450 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.4. 7 have been exploited in real attacks.
Latest Improper Verification of Cryptographic Signature vulnerabilities
- 7.5 High severity
HarmonyOS: Improper Verification of Cryptographic Signature
Vulnerability of insecure signatures in the ServiceWifiResources module. Successful exploitation of this vulnerability may cause ServiceWifiResources to be maliciously modified and overwritten.
- 7.5 High severity
HarmonyOS: Improper Verification of Cryptographic Signature
Vulnerability of insecure signatures in the OsuLogin module. Successful exploitation of this vulnerability may cause OsuLogin to be maliciously modified and overwritten.
- 7.5 High severity
uthenticode: Missing Cryptographic Step
uthenticode is a small cross-platform library for partially verifying Authenticode digital signatures. Versions of uthenticode prior to the 2.x series did not check Extended Key Usages in certificates, in violation of the Authenticode X.509 certificate profile
- 9.8 Critical severity
uthenticode: Improper Verification of Cryptographic Signature
uthenticode is a small cross-platform library for partially verifying Authenticode digital signatures. Version 1.0.9 of uthenticode hashed the entire file rather than hashing sections by virtual address, in violation of the Authenticode specification. As a res
- 7.8 High severity
Zoom Desktop Client for Windows and Zoom Rooms…: Improper Privilege Management
Improper privilege management in Zoom Desktop Client for Windows and Zoom Rooms for Windows before 5.15.5 may allow an authenticated user to enable an information disclosure via local access.
- 7.8 High severity
BIG-IP Edge Client: Improper Verification of Cryptographic Signature
The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- 7.8 High severity
PowerStore: Improper Verification of Cryptographic Signature
Dell PowerStore versions prior to 3.5 contain an improper verification of cryptographic signature vulnerability. An attacker can trick a high privileged user to install a malicious binary by bypassing the existing cryptographic signature checks
- 7.8 High severity
Zoom for Windows Client: Improper Verification of Cryptographic Signature
Improper privilege management in Zoom for Windows, Zoom Rooms for Windows, and Zoom VDI for Windows clients before 5.14.0 may allow an authenticated user to potentially enable an escalation of privilege via local access. Users may potentially utilize higher le
- 7.7 High severity
Zoom for Windows Client: Improper Verification of Cryptographic Signature
Zoom for Windows clients prior to 5.13.5 contain an improper verification of cryptographic signature vulnerability. A malicious user may potentially downgrade Zoom Client components to previous versions.
- 8.8 High severity
notation-go: Improper Verification of Cryptographic Signature
notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry can cause users to verify the wrong artifact. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation-go
- 9.1 Critical severity
Signedxml: Improper Verification of Cryptographic Signature
In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack (aka XSW).
- 7.8 High severity
Acronis Cyber Protect Home Office: Improper Verification of Cryptographic Signature
Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40208.
- 7.5 High severity
ECS: Improper Verification of Cryptographic Signature
DELL ECS prior to 3.8.0.2 contains an improper verification of cryptographic signature vulnerability. A network attacker with an ability to intercept the request could potentially exploit this vulnerability to modify the body data of the request.
- 9.8 Critical severity
Stationguard: Improper Verification of Cryptographic Signature
The update process in OMICRON StationGuard and OMICRON StationScout before 2.21 can be exploited by providing a modified firmware update image. This allows a remote attacker to gain root access to the system.
- 7.8 High severity
Cisco Enterprise NFV Infrastructure Software: Improper Verification of Cryptographic Signature
A vulnerability in the upgrade signature verification of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, local attacker to provide an unauthentic upgrade file for upload. This vulnerability is due to insufficient cryptograp
- 7.8 High severity
Android: Improper Verification of Cryptographic Signature
In the Android operating system, there is a possible way to replace a boot partition due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation
- 9.8 Critical severity
Control: Improper Verification of Cryptographic Signature
In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without invalidating the signature, such as instructions that result in offering the end user a (different) at
- 7.8 High severity
Dell Command Update (DCU): Improper Verification of Cryptographic Signature
Dell Command | Update, Dell Update, and Alienware Update versions prior to 4.7 contain a improper verification of cryptographic signature in get applicable driver component. A local malicious user could potentially exploit this vulnerability leading to malicio
- 9.8 Critical severity
reason-jose: Improper Verification of Cryptographic Signature
reason-jose is a JOSE implementation in ReasonML and OCaml.`Jose.Jws.validate` does not check HS256 signatures. This allows tampering of JWS header and payload data if the service does not perform additional checks. Such tampering could expose applications usi
- 9.8 Critical severity
Newtest: Improper Verification of Cryptographic Signature
The Robot application in Ip-label Newtest before v8.5R0 was discovered to use weak signature checks on executed binaries, allowing attackers to have write access and escalate privileges via replacing NEWTESTREMOTEMANAGER.EXE.
- 7.5 High severity
Pqclean: Improper Verification of Cryptographic Signature
CRYSTALS-DILITHIUM (in Post-Quantum Cryptography Selected Algorithms 2022) in PQClean d03da30 may allow universal forgeries of digital signatures via a template side-channel attack because of intermediate data leakage of one vector.
- 7.6 High severity
node-jsonwebtoken: Improper Verification of Cryptographic Signature
In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify
- 7.8 High severity
EcoStruxure Operator Terminal Expert: Improper Verification of Cryptographic Signature
A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load a malicious DLL which could result in execution of malicious code. Affected Products: EcoStr
- 7.8 High severity
EcoStruxure Operator Terminal Expert: Improper Verification of Cryptographic Signature
A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that allows adversaries with local user privileges to load a malicious DLL which could lead to execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert
- 9.8 Critical severity
datahub: Improper Verification of Cryptographic Signature
DataHub is an open-source metadata platform. Prior to version 0.8.45, the `StatelessTokenService` of the DataHub metadata service (GMS) does not verify the signature of JWT tokens. This allows an attacker to connect to DataHub instances as any user if Metadata
- 7.5 High severity
WARP: Improper Verification of Cryptographic Signature
Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client. Due to insufficient policy verification by WARP iOS client, this feature could be bypassed by using the "Disable WARP" quic
- 8.1 High severity
node-saml: Improper Verification of Cryptographic Signature
node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP
- 7.8 High severity
grafana: Improper Verification of Cryptographic Signature
Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious pl
- 8.1 High severity
passport-saml: Improper Verification of Cryptographic Signature
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession
- 9.8 Critical severity
sif: Use of a Broken or Risky Cryptographic Algorithm
syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signat
- 7.8 High severity
Zoom Room for Conference Room for Windows: Improper Verification of Cryptographic Signature
Zoom Rooms for Conference Rooms for Windows versions before 5.11.0 are susceptible to a Local Privilege Escalation vulnerability. A local low-privileged malicious user could exploit this vulnerability to escalate their privileges to the SYSTEM user.
- 7.8 High severity
Zoom Client for Meetings for MacOS: Improper Verification of Cryptographic Signature
The Zoom Client for Meetings for MacOS (Standard and for IT Admin) before version 5.11.3 contains a vulnerability in the package signature validation during the update process. A local low-privileged user could exploit this vulnerability to escalate their priv
- 7.8 High severity
Zoom Client for Meetings for MacOS: Improper Verification of Cryptographic Signature
The Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with version 5.7.3 and before 5.11.5 contains a vulnerability in the auto update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to r
- 8.8 High severity
policy-controller: Improper Verification of Cryptographic Signature
PolicyController is a utility used to enforce supply chain policy in Kubernetes clusters. In versions prior to 0.2.1 PolicyController will report a false positive, resulting in an admission when it should not be admitted when there is at least one attestation
- 9.8 Critical severity
cosign: Improper Verification of Cryptographic Signature
cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. `cosign verify-attestation` used with the `--type` flag will report a false positive verification when there is at
- 9.8 Critical severity
Sysmac Cs1 Firmware: Improper Verification of Cryptographic Signature
The Omron SYSMAC Cx product family PLCs (CS series, CJ series, and CP series) through 2022-05-18 lack cryptographic authentication. They utilize the Omron FINS (9600/TCP) protocol for engineering purposes, including downloading projects and control logic to th
- 9.8 Critical severity
Nx701-1600 Firmware: Improper Verification of Cryptographic Signature
The Omron SYSMAC Nx product family PLCs (NJ series, NY series, NX series, and PMAC series) through 2022-005-18 lack cryptographic authentication. These PLCs are programmed using the SYMAC Studio engineering software (which compiles IEC 61131-3 conformant POU c
- 7.5 High severity
openzeppelin-contracts: Improper Verification of Cryptographic Signature
OpenZeppelin Contracts is a library for smart contract development. Versions 4.1.0 until 4.7.1 are vulnerable to the SignatureChecker reverting. `SignatureChecker.isValidSignatureNow` is not expected to revert. However, an incorrect assumption about Solidity 0
- 9.8 Critical severity
jsrsasign: Improper Verification of Cryptographic Signature
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. Workaround: Vali
- 9.8 Critical severity
biscuit: Improper Verification of Cryptographic Signature
Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to create