Improper Verification of Cryptographic Signature
CWE-347
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
We track 450 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.4. 7 have been exploited in real attacks.
Latest Improper Verification of Cryptographic Signature vulnerabilities
- 9.1 Critical severity
ruby-saml: Improper Verification of Cryptographic Signature
The ruby-saml library is for implementing the client side of a SAML authorization. ruby-saml versions up to and including 1.12.4 contain an authentication bypass vulnerability due to an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML differentl
- 7.8 High severity
Endpoint Manager: Improper Verification of Cryptographic Signature
Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary code. User Interaction is required.
- 7.5 High severity
node-jws: Improper Verification of Cryptographic Signature
auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are a
- 9.3 Critical severity
XML::Sig: Improper Verification of Cryptographic Signature
XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. An attacker can remove the signature from the XML document to make it pass the verification check. XML-Sig is a Perl module to validate signatures on XML fil
- 7.8 High severity
GoSign Desktop: Improper Verification of Cryptographic Signature
GoSign Desktop versions 2.4.0 and earlier use an unsigned update manifest for distributing application updates. The manifest contains package URLs and SHA-256 hashes but is not digitally signed, so its authenticity relies solely on the underlying TLS channel.
- 7.8 High severity
Zoom Workplace VDI Client: Improper Verification of Cryptographic Signature
Improper verification of cryptographic signature in the installer for Zoom Workplace VDI Client for Windows may allow an authenticated user to conduct an escalation of privilege via local access.
- 8.1 High severity
DevOps Loop: Improper Verification of Cryptographic Signature
Improper authentication in the API authentication middleware of HCL DevOps Loop allows authentication tokens to be accepted without proper validation of their expiration and cryptographic signature. As a result, an attacker could potentially use expired or tam
- 8.3 High severity
constellation: Improper Verification of Cryptographic Signature
Constellation is the first Confidential Kubernetes. The Constellation CVM image uses LUKS2-encrypted volumes for persistent storage. When opening an encrypted storage device, the CVM uses the libcryptsetup function crypt_activate_by_passhrase. If the VM is suc
- 8.1 High severity
DAP-2695: Improper Verification of Cryptographic Signature
A weakness has been identified in D-Link DAP-2695 2.00RC13. The affected element is the function sub_40C6B8 of the component Firmware Update Handler. Executing manipulation can lead to improper verification of cryptographic signature. The attack can be launche
- 7.0 High severity
Deck Mate 1: Improper Verification of Cryptographic Signature
Deck Mate 1 executes firmware directly from an external EEPROM without verifying authenticity or integrity. An attacker with physical access can replace or reflash the EEPROM to run arbitrary code that persists across reboots. Because this design predates mode
- 7.0 High severity
Deck Mate 2: Use of Hard-coded Cryptographic Key
Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validation. Attackers with access to the update
- 7.8 High severity
FortiClientMac: Improper Verification of Cryptographic Signature
An Improper Verification of Cryptographic Signature vulnerability [CWE-347] in FortiClient MacOS installer version 7.4.2 and below, version 7.2.9 and below, 7.0 all versions may allow a local user to escalate their privileges via FortiClient related executable
- 9.8 Critical severity
OAuth Single Sign On – SSO (OAuth Client): Improper Verification of Cryptographic Signature
The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 6.26.12. This is due to the plugin performing unsafe JWT token processing without verificatio
- 9.4 Critical severity
formbricks: Improper Authentication
Formbricks is an open source qualtrics alternative. Prior to version 4.0.1, Formbricks is missing JWT signature verification. This vulnerability stems from a token validation routine that only decodes JWTs (jwt.decode) without verifying their signatures. Both
- 9.3 Critical severity
eScan AV: Improper Certificate Validation
MicroWorld eScan AV's update mechanism failed to ensure authenticity and integrity of updates: update packages were delivered and accepted without robust cryptographic verification. As a result, an on-path attacker could perform a man-in-the-middle (MitM) atta
- 7.2 High severity
MBD-X12STW: Improper Verification of Cryptographic Signature
There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X12STW . An attacker can update the system firmware with a specially crafted image.
- 7.2 High severity
X13SEM-F: Improper Verification of Cryptographic Signature
There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X13SEM-F . An attacker can update the system firmware with a specially crafted image.
- 8.8 High severity
Linkr: Improper Verification of Cryptographic Signature
Linkr is a lightweight file delivery system that downloads files from a webserver. Linkr versions through 2.0.0 do not verify the integrity or authenticity of .linkr manifest files before using their contents, allowing a tampered manifest to inject arbitrary f
- 7.2 High severity
E3 Supervisory Control: Improper Verification of Cryptographic Signature
E3 Site Supervisor Control (firmware version < 2.31F01) firmware upgrade packages are unsigned. An attacker can forge malicious firmware upgrade packages. An attacker with admin access to the application services can install a malicious firmware upgrade.
- 8.8 High severity
CGM CLININET: Improper Verification of Cryptographic Signature
An insufficiently secured internal function allows session generation for arbitrary users. The decodeParam function checks the JWT but does not verify which signing algorithm was used. As a result, an attacker can use the "ex:action" parameter in the VerifyUse
- 9.1 Critical severity
gnark: Improper Verification of Cryptographic Signature
gnark is a zero-knowledge proof system framework. In versions prior to 0.14.0, the Verify function in eddsa.go and ecdsa.go used the S value from a signature without asserting that 0 ≤ S < order, leading to a signature malleability vulnerability. Because gnark
- 8.7 High severity
Mendix SAML (Mendix 10.12 compatible): Improper Verification of Cryptographic Signature
A vulnerability has been identified in Mendix SAML (Mendix 10.12 compatible) (All versions < V4.0.3), Mendix SAML (Mendix 10.21 compatible) (All versions < V4.1.2), Mendix SAML (Mendix 9.24 compatible) (All versions < V3.6.21). Affected versions of the module
- 9.8 Critical severity
devscripts: Improper Verification of Cryptographic Signature
It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is alre
- 10.0 Critical severity
node-saml: Improper Authentication
A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature. This allows an attacke
- 9.1 Critical severity
HP Linux Imaging and Printing Software: Improper Verification of Cryptographic Signature
A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software documentation. This potential vulnerability is due to the use of a weak code signing key, Digital Signature Algorithm (DSA).
- 9.3 Critical severity
node-saml: Improper Neutralization of Alternate XSS Syntax
Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature
- 8.4 High severity
TIA Administrator: Improper Verification of Cryptographic Signature
A vulnerability has been identified in TIA Administrator (All versions < V3.0.6). The affected application improperly validates code signing certificates. This could allow an attacker to bypass the check and exceute arbitrary code during installations.
- 8.1 High severity
tiny-secp256k1: Improper Verification of Cryptographic Signature
tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a malicious JSON-stringifyable message can be made passing on verify(), when global Buffer is the buffer package. This affects only environments where require('buffer') is the NPM bu
- 9.3 Critical severity
rfc3161-client: Improper Verification of Cryptographic Signature
rfc3161-client is a Python library implementing the Time-Stamp Protocol (TSP) described in RFC 3161. Prior to version 1.0.3, there is a flaw in the timestamp response signature verification logic. In particular, chain verification is performed against the TSR'
- 4.6 Medium severity
IGEL OS Use of a Key Past its Expiration Date Exploited
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.
- 7.5 High severity
samlify: Improper Verification of Cryptographic Signature
samlify is a Node.js library for SAML single sign-on. A Signature Wrapping attack has been found in samlify prior to version 2.10.0, allowing an attacker to forge a SAML Response to authenticate as any user. An attacker would need a signed XML document by the
- 8.7 High severity
openpgpjs: Improper Verification of Cryptographic Signature
OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. Startinf in version 5.0.1 and prior to versions 5.11.3 and 6.1.1, a maliciously modified message can be passed to either `openpgp.verify` or `openpgp.decrypt`, causing these functions to return
- 9.8 Critical severity
OPKSSH: Improper Verification of Cryptographic Signature
Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH depends on the OpenPubkey library for authentication, this vulnerability in OpenPubkey also applies to
- 8.0 High severity
CPC200-CCPA: Improper Verification of Cryptographic Signature
CarlinKit CPC200-CCPA update.cgi Improper Verification of Cryptographic Signature Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of CarlinKit CPC200-CCPA devices. Although
- 7.2 High severity
Cisco Secure Network Analytics: Improper Verification of Cryptographic Signature
A vulnerability in the web-based management interface of Cisco Secure Network Analytics could allow an authenticated, remote attacker with valid administrative credentials to execute arbitrary commands as root on the underlying operating system. This vulnerabi
- 7.5 High severity
suricata: Improper Verification of Cryptographic Signature
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The AF_PACKET defrag option is enabled by default and allows AF_PACKET to re-assemble fragmented packets before reaching Suricata. However the
- 8.7 High severity
minio: Improper Verification of Cryptographic Signature
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user a
- 9.3 Critical severity
xml-crypto: Improper Verification of Cryptographic Signature
xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto f
- 9.3 Critical severity
xml-crypto: Improper Verification of Cryptographic Signature
xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto f
- 9.8 Critical severity
ruby-saml: Improper Verification of Cryptographic Signature
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently