Improper Verification of Cryptographic Signature
CWE-347
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
We track 450 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.4. 7 have been exploited in real attacks.
Latest Improper Verification of Cryptographic Signature vulnerabilities
- 9.8 Critical severity
ruby-saml: Improper Verification of Cryptographic Signature
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently
- 8.8 High severity
SmartThings: Improper Verification of Cryptographic Signature
Samsung SmartThings Improper Verification of Cryptographic Signature Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Samsung SmartThings. Authentication is not requ
- 8.6 High severity
saml2: Improper Verification of Cryptographic Signature
The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect bin
- 7.8 High severity
Cisco Secure Client: Improper Verification of Cryptographic Signature
A vulnerability in the interprocess communication (IPC) channel of Cisco Secure Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the Secure Firewall Posture Engine, formerly HostScan, is
- 9.8 Critical severity
Vasion Print: Improper Verification of Cryptographic Signature
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Signature Validation OVE-20230524-0014.
- 9.3 Critical severity
WPS Office: Improper Verification of Cryptographic Signature
Improper verification of the digital signature in ksojscore.dll in Kingsoft WPS Office in versions equal or less than 12.1.0.18276 on Windows allows an attacker to load an arbitrary Windows library. The patch released in version 12.2.0.16909 to mitigate CVE-20
- 9.8 Critical severity
ltiauthenticator: Improper Verification of Cryptographic Signature
`jupyterhub-ltiauthenticator` is a JupyterHub authenticator for learning tools interoperability (LTI). LTI13Authenticator that was introduced in `jupyterhub-ltiauthenticator` 1.3.0 wasn't validating JWT signatures. This is believed to allow the LTI13Authentica
- 7.2 High severity
MBD-X12DPG-OA6: Insufficient Verification of Data Authenticity
There is a vulnerability in the BMC firmware image authentication design at Supermicro MBD-X12DPG-OA6 . An attacker can modify the firmware to bypass BMC inspection and bypass the signature verification process
- 7.2 High severity
AMD EPYC™ 7001 Series: Improper Verification of Cryptographic Signature
Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP.
- 9.3 Critical severity
hyperbridge: Improper Verification of Cryptographic Signature
Hyperbridge is a hyper-scalable coprocessor for verifiable, cross-chain interoperability. A critical vulnerability was discovered in the ismp-grandpa crate, that allowed a malicious prover easily convince the verifier of the finality of arbitrary headers. This
- 8.8 High severity
Enterprise Server: Improper Verification of Cryptographic Signature
An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed signature spoofing for unauthorized internal users. Instances not utilizing SAML single sign-on or where the attacker is not already an ex
- 8.1 High severity
aws-cdk: Improper Verification of Cryptographic Signature
The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. Users who use IAM OIDC custom resource provider package will download CA Thumbprints as
- 7.8 High severity
Endpoint Manager: Improper Verification of Cryptographic Signature
Improper signature verification in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code execution. Local user interaction is required.
- 8.7 High severity
cjwt: Improper Verification of Cryptographic Signature
cjwt is a C JSON Web Token (JWT) Implementation. Algorithm confusion occurs when a system improperly verifies the type of signature used, allowing attackers to exploit the lack of distinction between signing methods. If the system doesn't differentiate between
- 9.1 Critical severity
Excel: Improper Verification of Cryptographic Signature
A library injection vulnerability exists in Microsoft Excel 16.83 for macOS. A specially crafted library can leverage Excel's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger thi
- 9.1 Critical severity
Outlook: Improper Verification of Cryptographic Signature
A library injection vulnerability exists in Microsoft Outlook 16.83.3 for macOS. A specially crafted library can leverage Outlook's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigg
- 9.8 Critical severity
Teams (work or school): Improper Verification of Cryptographic Signature
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. A specially crafted library can leverage Teams's access privileges, leading to a permission bypass. A malicious application could inject a library and
- 9.1 Critical severity
Word: Improper Verification of Cryptographic Signature
A library injection vulnerability exists in Microsoft Word 16.83 for macOS. A specially crafted library can leverage Word's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this
- 7.1 High severity
OneNote: Improper Verification of Cryptographic Signature
A library injection vulnerability exists in Microsoft OneNote 16.83 for macOS. A specially crafted library can leverage OneNote's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger
- 9.8 Critical severity
Teams (work or school): Improper Verification of Cryptographic Signature
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. A specially crafted library can leverage Teams's access privileges, leading to a permission bypass. A malicious applicati
- 9.8 Critical severity
Teams (work or school): Improper Verification of Cryptographic Signature
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. A specially crafted library can leverage Teams's access privileges, leading to a permission bypas
- 9.1 Critical severity
PowerPoint: Improper Verification of Cryptographic Signature
A library injection vulnerability exists in Microsoft PowerPoint 16.83 for macOS. A specially crafted library can leverage PowerPoint's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to t
- 8.8 High severity
RecoverPoint for Virtual Machines: Improper Neutralization of Special Elements used in an OS Command
Dell RecoverPoint for Virtual Machines 6.0.x contains an OS Command injection vulnerability. A low privileged remote attacker could potentially exploit this vulnerability by running any command as root, leading to gaining of root-level access and compromise of
- 8.5 High severity
Archer C50 Wireless Router: Improper Verification of Cryptographic Signature
This vulnerability exists in the TP-Link Archer C50 due to improper signature verification mechanism in the firmware upgrade process at its web interface. An attacker with administrative privileges within the router’s Wi-Fi range could exploit this vulnerabili
- 7.8 High severity
NetWorker Management Console: Improper Verification of Cryptographic Signature
Dell NetWorker Management Console, version(s) 19.11, contain(s) an Improper Verification of Cryptographic Signature vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Code execution.
- 7.8 High severity
Samsung Mobile Devices: Improper Verification of Cryptographic Signature
Improper Verification of Cryptographic Signature in SmartSwitch prior to SMR Dec-2024 Release 1 allows local attackers to install malicious applications.
- 7.2 High severity
iota C.ai Conversational Platform: Improper Verification of Cryptographic Signature
A improper verification of cryptographic signature vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to load a malicious DLL via upload plugin function.
- 9.1 Critical severity
dataease: Improper Verification of Cryptographic Signature
DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions a the lack of signature verification of jwt tokens allows attackers to forge jwts which then allow ac
- 9.8 Critical severity
IoT Interface & CMC III Processing Unit: Improper Verification of Cryptographic Signature
The firmware upgrade function in the admin web interface of the Rittal IoT Interface & CMC III Processing Unit devices checks if the patch files are signed before executing the containing run.sh script. The signing process is kind of an HMAC with a long string
- 7.2 High severity
Data Center Expert: Improper Verification of Cryptographic Signature
CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that could compromise the Data Center Expert software when an upgrade bundle is manipulated to include arbitrary bash scripts that are executed as root.
- 9.1 Critical severity
Enterprise Server: Improper Verification of Cryptographic Signature
An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed resulting in unauthorized provisioning of users and access to the instance. Exploitation required t
- 9.1 Critical severity
Elliptic: Improper Verification of Cryptographic Signature
The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.
- 9.8 Critical severity
ssoready: Improper Verification of Cryptographic Signature
ssoready is a single sign on provider implemented via docker. Affected versions are vulnerable to XML signature bypass attacks. An attacker can carry out signature bypass if you have access to certain IDP-signed messages. The underlying mechanism exploits diff
- 8.8 High severity
Remote Full Client: Improper Verification of Cryptographic Signature
Improper verification of cryptographic signature during installation of a Printer driver via the TeamViewer_service.exe component of TeamViewer Remote Clients prior version 15.58.4 for Windows allows an attacker with local unprivileged access on a Windows syst
- 8.8 High severity
Remote Full Client: Improper Verification of Cryptographic Signature
Improper verification of cryptographic signature during installation of a VPN driver via the TeamViewer_service.exe component of TeamViewer Remote Clients prior version 15.58.4 for Windows allows an attacker with local unprivileged access on a Windows system t
- 7.7 High severity
Red Hat Build of Keycloak: Improper Verification of Cryptographic Signature
A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the
- 7.8 High severity
LibreOffice: Improper Verification of Cryptographic Signature
Improper Digital Signature Invalidation vulnerability in Zip Repair Mode of The Document Foundation LibreOffice allows Signature forgery vulnerability in LibreOfficeThis issue affects LibreOffice: from 24.2 before < 24.2.5.
- 9.8 Critical severity
ruby-saml: Improper Verification of Cryptographic Signature
The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by th
- 9.8 Critical severity
GitHub Enterprise Server: Improper Verification of Cryptographic Signature
An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers utilizing publicly exposed signed federation metadata XML. This vulnerability allowed an attacker with direct
- 7.8 High severity
Client Connector: Improper Verification of Cryptographic Signature
The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locally executed. This affects Zscaler Client Connector on MacOS <4.2.