Improper Verification of Cryptographic Signature
CWE-347
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
We track 450 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.4. 7 have been exploited in real attacks.
Latest Improper Verification of Cryptographic Signature vulnerabilities
- 7.1 High severity
incus: Improper Verification of Cryptographic Signature
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz-* headers. Attackers can add an unsigned X-Amz-Copy-Source header to a presigned upload
- 9.2 Critical severity
Apache Pulsar: Improper Verification of Cryptographic Signature
Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). The provider is intended for use with token authentication, which verifies the token before authorization. The provider did n
- 8.8 High severity
Chrome: Improper Verification of Cryptographic Signature
Improper signature verification in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
- 9.1 Critical severity
Totolink: Improper Verification of Cryptographic Signature
A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted firmware binary can lead to arbitrary firmware update. An attacker can make an authenticated
- 9.8 Critical severity
Eclipse ioFog: Improper Verification of Cryptographic Signature
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain ad
- 9.1 Critical severity
joserfc: Authentication Bypass by Spoofing
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated.
- 7.5 High severity
Content Credentials Rust SDK: Improper Verification of Cryptographic Signature
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write acces
- 7.5 High severity
Content Credentials Rust SDK: Improper Verification of Cryptographic Signature
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write acces
- 7.5 High severity
Content Credentials Rust SDK: Improper Verification of Cryptographic Signature
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write acces
- 7.5 High severity
Content Credentials Rust SDK: Improper Verification of Cryptographic Signature
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write acces
- 9.1 Critical severity
Windows 10 Version 1607: Improper Verification of Cryptographic Signature
Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
- 9.6 Critical severity
DCS-930L: Insufficient Verification of Data Authenticity
A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cr
- 7.5 High severity
MarkLogic Server: Improper Authentication
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing. In deployments that use SAML authentication, an unauthenticated remote attacker could cause the affected
- 7.5 High severity
libdigidocpp: Improper Verification of Cryptographic Signature
Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS. The vulnerability allows an attacker to create forged digital signatures that are displayed a valid by a
- 7.3 High severity
Docker Desktop: Improper Verification of Cryptographic Signature
Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a crafted package and convince a user to approve the Docker-signed UAC prompt could execu
- 9.8 Critical severity
PrestaShop Virtual POS Module: Improper Verification of Cryptographic Signature
Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects PrestaShop Virtual POS Module: from 26.8.1 bef
- 9.8 Critical severity
OpenCart Virtual POS Module: Improper Verification of Cryptographic Signature
Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects OpenCart Virtual POS Module: from 26.8.2 before
- 7.4 High severity
fast-jwt: Improper Verification of Cryptographic Signature
fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS2
- 9.8 Critical severity
fast-jwt: Improper Verification of Cryptographic Signature
fast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms
- 7.4 High severity
fast-jwt provides fast JSON Web Token (JWT) implementation.
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedAl
- 7.8 High severity
Guardium Data Protection: Improper Verification of Cryptographic Signature
IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer. An attacker with local access could exploit this vulnerability to execute arbitrary code with root privileges.
- 7.5 High severity
DataPower Gateway 10.6CD: Improper Verification of Cryptographic Signature
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass authentication by forging valid JSON Web Signatures due to improper verification of crypt
- 8.1 High severity
DataPower Gateway 10.6CD: Improper Verification of Cryptographic Signature
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to bypass security restrictions due to improper verification of cryptographic signatu
- 10.0 Critical severity
Cisco License On-Prem: Improper Verification of Cryptographic Signature
As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review re
- 7.8 High severity
ClearPass Policy Manager (CPPM): Improper Verification of Cryptographic Signature
A missing integrity verification vulnerability in the Windows client software for ClearPass Policy Manager could allow malicious users on a local instance to elevate their user privileges. A successful exploit could allow these users to execute attacker-suppli
- 7.1 High severity
Snapdragon: Improper Verification of Cryptographic Signature
Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed.
- 7.9 High severity
Progress® Telerik® Fiddler® Classic: Improper Verification of Cryptographic Signature
In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools launched by the application is insufficient. Before executing a helper tool, the application only verifies that the
- 7.1 High severity
BC-JAVA: Improper Verification of Cryptographic Signature
In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation and ProofOfPossession verify and aggregateVerify that gate on it, accepted a public key built on a foreign ECCurve
- 8.2 High severity
BC-JAVA: Insufficient Verification of Data Authenticity
In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no embedded Primary Key Binding (cross-certification) signature, in the case where that binding omits a
- 7.4 High severity
zebra: Improper Verification of Cryptographic Signature
Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer out
- 7.4 High severity
zebra: Improper Verification of Cryptographic Signature
Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SINGLE that lack a corresponding output. Attackers can broadcast crafted V5 transactions with more inputs than outputs that
- 8.6 High severity
MGate MB3170 Series: Improper Verification of Cryptographic Signature
An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the
- 7.5 High severity
bc-csharp: Improper Verification of Cryptographic Signature
Improper verification of cryptographic signature in the attribute certificate path validator (PkixAttrCertPathValidator, also used by PkixAttrCertPathBuilder) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to have a forged
- 9.4 Critical severity
SConnect: Improper Handling of Length Parameter Inconsistency
This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component. The attack leverages an unrestricted messag
- 8.1 High severity
tugtainer: Improper Verification of Cryptographic Signature
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, when the OIDC login flow completes, backend/modules/auth/providers/auth_oidc_provider.py decodes the id_token returned by the identity provider's token endpoin
- 7.1 High severity
GeForce: Improper Verification of Cryptographic Signature
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where improper verification of cryptographic signatures may cause signature verification to be bypassed under memory pressure. A successful exploit of this vulnerability migh
- 9.2 Critical severity
Apache PLC4X: Improper Certificate Validation
Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of Apache PLC4X (PLC4J) allows an attacker in a network position between client and server to impersonate the OPC UA server and to read, forge or modify s
- 7.5 High severity
G520 Series: Improper Verification of Cryptographic Signature
The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packag
- 8.8 High severity
YSSD-RTMP-H5: Improper Verification of Cryptographic Signature
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, both the local and cloud update mechanisms apply new firmware without any cryptographic verification, relying only on basic hashing. This design allows an attacker who can reach the update routine to introduc
- 7.4 High severity
pyjwt: Improper Verification of Cryptographic Signature
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an appl