cve.bz

CWE-345: Insufficient Verification of Data Authenticity, page 10

Filter

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

What the weakness is: CWE-345 at MITRE

Ask an AI about CWE-345

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-345: Insufficient Verification of Data Authenticity and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/345.html and https://cve.bz/cve/cwe/345?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.3CVE-2025-5320EPSS 0.3%

    A vulnerability classified as problematic has been found in gradio-app gradio up to 5.29.1. This affects the function is_valid_origin of the component CORS Handler. The manipulation of the argument localhost_aliases leads to erweiterte Rec…

  2. 9.1CVE-2025-27558EPSS 0.3%

    IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or WPA3) or Wired Equivalent Privacy (WEP), an adversary can exploit this vulnerability to inject arbi…

  3. 7.5CVE-2025-29842EPSS 0.4%

    Acceptance of extraneous untrusted data with trusted data in UrlMon allows an unauthorized attacker to bypass a security feature over a network.

  4. 8.2CVE-2025-43865EPSS 0.8%

    React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values ​…

  5. 6.0CVE-2025-27735EPSS 0.4%

    Insufficient verification of data authenticity in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.

  6. 6.5CVE-2025-30144EPSS 0.6%

    fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 5.0.6, the fast-jwt library does not properly validate the iss claim based on the RFC 7519. The iss (issuer) claim validation within the fast-jwt library permits an array…

  7. 6.3CVE-2025-2346EPSS 0.2%

    A vulnerability has been found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308 and classified as problematic. This vulnerability affects unknown code of the component Domain Handler. The manipulation of the argument Domain Name leads t…

  8. 7.5CVE-2025-0149EPSS 0.2%

    Insufficient verification of data authenticity in some Zoom Workplace Apps may allow an unprivileged user to conduct a denial of service via network access.

  9. 8.5CVE-2025-27616EPSS 0.3%

    Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webhook payload with a specific set of headers and body data, an attacker could trans…

  10. 5.3CVE-2025-1945EPSS 0.6%

    picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files tha…

  11. 5.3CVE-2025-1944EPSS 0.3%

    picklescan before 0.0.23 is vulnerable to a ZIP archive manipulation attack that causes it to crash when attempting to extract and scan PyTorch model archives. By modifying the filename in the ZIP header while keeping the original filename…

  12. 6.1CVE-2025-27257EPSS 0.2%

    Insufficient Verification of Data Authenticity vulnerability in GE Vernova UR IED family devices allows an authenticated user to install a modified firmware. The firmware signature verification is enforced only on the client-side dedicated…

  13. 9.1CVE-2025-27680EPSS 0.3%

    Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.750 Application 20.0.1442 allows Insecure Firmware Image with Insufficient Verification of Data Authenticity V-2024-004.

  14. 8.5CVE-2025-24903EPSS 0.2%

    libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers. Prior to commit 82d70f6720e762898f34ae76b0894b0297d9b2f8, any contact may forge a sync…

  15. 7.3CVE-2024-39805EPSS 0.1%

    Insufficient verification of data authenticity in some Intel(R) DSA software before version 23.4.39 may allow an authenticated user to potentially enable escalation of privilege via local access.

  16. 4.5CVE-2025-24807EPSS 0.2%

    eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.10, 2.10.7, 2.14.5, 3.0.2, 3.1.2, and 3.2.0, per design, PermissionsCA is not full chain …

  17. 5.7CVE-2025-25188EPSS 0.3%

    Hickory DNS is a Rust based DNS client, server, and resolver. A vulnerability present starting in version 0.8.0 and prior to versions 0.24.3 and 0.25.0-alpha.5 impacts Hickory DNS users relying on DNSSEC verification in the client library,…

  18. 8.6CVE-2025-1108EPSS 0.2%

    Insufficient data authenticity verification vulnerability in Janto, versions prior to r12. This allows an unauthenticated attacker to modify the content of emails sent to reset the password. To exploit the vulnerability, the attacker must …

  19. 2.3CVE-2025-23415EPSS 0.1%

    An insufficient verification of data authenticity vulnerability exists in BIG-IP APM Access Policy endpoint inspection that may allow an attacker to bypass endpoint inspection checks for VPN connection initiated thru BIG-IP APM browser net…

  20. 6.5CVE-2025-0510EPSS 0.3%

    Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that is described in CVE-2024-49040. This vulnerability was fixed in Thunderbird 128.7 and Thunderbird 135.

  21. 7.2CVE-2024-10237EPSS 0.3%

    There is a vulnerability in the BMC firmware image authentication design at Supermicro MBD-X12DPG-OA6 . An attacker can modify the firmware to bypass BMC inspection and bypass the signature verification process

  22. 5.2CVE-2025-24882EPSS 0.2%

    regclient is a Docker and OCI Registry Client in Go. A malicious registry could return a different digest for a pinned manifest without detection. This vulnerability is fixed in 0.7.1.

  23. 5.3CVE-2024-55929EPSS 0.2%

    A mail spoofing vulnerability in Xerox Workplace Suite allows attackers to forge email headers, making it appear as though messages are sent from trusted sources.

  24. 8.7CVE-2025-21606EPSS 0.3%

    stats is a macOS system monitor in for the menu bar. The Stats application is vulnerable to a local privilege escalation due to the insecure implementation of its XPC service. The application registers a Mach service under the name `eu.exe…

  25. 7.5CVE-2024-54111EPSS 0.1%

    Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.

  26. 4.2CVE-2024-12369EPSS 0.2%

    A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen…

  27. 6.7CVE-2024-52548EPSS 0.2%

    An attacker who can execute arbitrary Operating Systems commands, can bypass code signing enforcements in the kernel, and execute arbitrary native code. This vulnerability has been resolved in firmware version 2.800.0000000.8.R.20241111.

  28. 6.5CVE-2024-53259EPSS 0.6%

    quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used IP_PMTUDISC_DO, the kernel would then return a "message too large" error on send…

  29. 5.1CVE-2022-33861EPSS 0.1%

    IPP software versions prior to v1.71 do not sufficiently verify the authenticity of data, in a way that causes it to accept invalid data.

  30. 9.8CVE-2024-11666EPSS 0.4%

    Affected devices beacon to eCharge cloud infrastructure asking if there are any command they should run. This communication is established over an insecure channel since peer verification is disabled everywhere. Therefore, remote unauthent…

  31. 7.8CVE-2024-8356EPSS 0.2%

    Visteon Infotainment VIP MCU Code Insufficient Validation of Data Authenticity Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Visteon Infotainment sys…

  32. 3.7CVE-2024-10977EPSS 0.4%

    Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error …

  33. 7.1CVE-2024-43428EPSS 0.2%

    To address a cache poisoning risk in Moodle, additional validation for local storage was required.

  34. 8.8CVE-2024-7847EPSS 0.2%

    VULNERABILITY DETAILS Rockwell Automation used the latest versions of the CVSS scoring system to assess the following vulnerabilities. The following vulnerabilities were reported to us by Sharon Brizinov of Claroty Research - Team82. A …

  35. 2.1CVE-2024-47867EPSS 0.2%

    Gradio is an open-source Python package designed for quick prototyping. This vulnerability is a **lack of integrity check** on the downloaded FRP client, which could potentially allow attackers to introduce malicious code. If an attacker g…

  36. 6.4CVE-2024-47079EPSS 0.2%

    Meshtastic is an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices. Meshtastic firmware is an open source firmware implementation for the broader project. The remote hardware module of the fir…

  37. 6.0CVE-2024-47123EPSS 0.08%

    The goTenna Pro App uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. This leaves messages malleable to an attacker that can access the message. It is recommended to continu…

  38. 6.0CVE-2024-43108EPSS 0.09%

    The goTenna Pro ATAK Plugin uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. This leaves messages malleable to an attacker that can access the message. It is advised to con…

  39. 6.8CVE-2024-23922ExploitEPSS 1.8%

    Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-AX5500 devices. Authenticat…

  40. 7.5CVE-2024-45410EPSS 1.5%

    Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a…

  41. 5.3CVE-2022-4533EPSS 0.2%

    The Limit Login Attempts Plus plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.1.0. This is due to insufficient restrictions on where the IP Address information is being retrieved for request lo…

  42. 7.5CVE-2023-28457EPSS 0.2%

    An issue was discovered in Technitium through 11.0.3. It enables attackers to conduct a DNS cache poisoning attack and inject fake responses within 1 second, which is impactful.

  43. 6.5CVE-2024-42483EPSS 0.3%

    ESP-NOW Component provides a connectionless Wi-Fi communication protocol. An replay attacks vulnerability was discovered in the implementation of the ESP-NOW because the caches is not differentiated by message types, it is a single, shared…

  44. 5.3CVE-2024-25584EPSS 0.2%

    Dovecot accepts dot LF DOT LF symbol as end of DATA command. RFC requires that it should always be CR LF DOT CR LF. This causes Dovecot to convert single mail with LF DOT LF in middle, into two emails when relaying to SMTP. Dovecot will sp…

  45. 5.3CVE-2022-4539EPSS 0.6%

    The Web Application Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1.2. This is due to insufficient restrictions on where the IP Address information is being retrieved for request log…

  46. 7.8CVE-2024-7980EPSS 0.3%

    Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a crafted symbolic link. (Chromium security severity: Medium)

  47. 7.8CVE-2024-7979EPSS 0.2%

    Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a crafted symbolic link. (Chromium security severity: Medium)

  48. 7.5CVE-2024-38198EPSS 0.8%

    Windows Print Spooler Elevation of Privilege Vulnerability

  49. 7.5CVE-2024-37968EPSS 1.0%

    Windows DNS Spoofing Vulnerability

  50. 6.6CVE-2023-28865EPSS 0.3%

    Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR15, 4.0.0 SR05, 4.1.0 SR03, and 4.2.0 SR02 fails to validate the directory contents of certain directories (e.g., ensuring the expected hash sum) during the Pre-Boot Authorization…