CWE-345: Insufficient Verification of Data Authenticity, page 12
Filter
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
What the weakness is: CWE-345 at MITRE
Ask an AI about CWE-345
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-345: Insufficient Verification of Data Authenticity and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/345.html and https://cve.bz/cve/cwe/345?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 5.3CVE-2023-5548EPSS 0.3%
Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection.
- 9.1CVE-2023-4699EPSS 0.8%
Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC-F Series CPU modules, MELSEC iQ-F Series, MELSEC iQ-R series CPU modules, MELSEC iQ-R series, MELSEC iQ-L series, MELSEC Q series, MELSEC-…
- 8.8CVE-2023-5482EPSS 7.3%
Insufficient data validation in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
- 7.8CVE-2023-41898EPSS 0.2%
Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. This enables all sorts of attacks, including arbitrary JavaScript ex…
- 9.0CVE-2023-41896EPSS 0.3%
Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure53 detected `auth_callback=1`, which is leveraged by the WebSocket authentication logic in tandem with the `state` param…
- 7.8CVE-2023-43800EPSS 0.2%
Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint `/v2/pkgs/tools/installed`. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass t…
- 7.5CVE-2023-38552EPSS 1.2%
When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the int…
- 6.5CVE-2023-43666EPSS 0.6%
Insufficient Verification of Data Authenticity vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, General user can view all user data like Admin account. Users are advised to upgrade to Apache InL…
- 5.3CVE-2023-42782EPSS 0.4%
A insufficient verification of data authenticity vulnerability [CWE-345] in FortiAnalyzer version 7.4.0 and below 7.2.3 allows a remote unauthenticated attacker to send messages to the syslog server of FortiAnalyzer via the knoweldge of an…
- 7.8CVE-2023-5450EPSS 0.2%
An insufficient verification of data vulnerability exists in BIG-IP Edge Client Installer on macOS that may allow an attacker elevation of privileges during the installation process. Note: Software versions which have reached End of Tech…
- 5.5CVE-2023-5366EPSS 0.4%
A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This issue may allow a local attacker to create specially crafted packets with a modified or spoofed targ…
- 9.0CVE-2023-39347EPSS 0.6%
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to update pod labels can cause Cilium to apply incorrect network policies. This issue arises due to the fact that on po…
- 8.8CVE-2015-8371EPSS 0.7%
Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-controlled code entering a server-side build process. The issue occurs because of the way that dist packages are cached.…
- 8.8CVE-2023-43636EPSS 0.1%
In EVE OS, the “measured boot” mechanism prevents a compromised device from accessing the encrypted data located in the vault. As per the “measured boot” design, the PCR values calculated at different stages of the boot process will chang…
- 4.9CVE-2023-26141EPSS 0.9%
Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will…
- 7.8CVE-2023-20236EPSS 0.1%
A vulnerability in the iPXE boot function of Cisco IOS XR software could allow an authenticated, local attacker to install an unverified software image on an affected device. This vulnerability is due to insufficient image verification.…
- 7.2CVE-2023-4589EPSS 0.3%
Insufficient verification of data authenticity vulnerability in Delinea Secret Server, in its v10.9.000002 version. An attacker with an administrator account could perform software updates without proper integrity verification mechanisms. …
- 6.8CVE-2023-35719EPSS 25%
ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of M…
- 7.5CVE-2023-35906EPSS 0.4%
IBM Aspera Faspex 5.0.5 could allow a remote attacked to bypass IP restrictions due to improper access controls. IBM X-Force ID: 259649.
- 5.3CVE-2023-41045EPSS 0.4%
Graylog is a free and open log management platform. Graylog makes use of only one single source port for DNS queries. Graylog binds a single socket for outgoing DNS queries and while that socket is bound to a random port number it is never…
- 7.8CVE-2023-38831KEVExploitEPSS 99.8%
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also…
- 7.8CVE-2023-22955EPSS 0.3%
An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. The validation of firmware images only consists of simple checksum checks for different firmware components. Thus, by knowing how to calculate and where to store th…
- 8.8CVE-2023-36541EPSS 0.5%
Insufficient verification of data authenticity in Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of privilege via network access.
- 5.7CVE-2023-4177EPSS 0.2%
A vulnerability was found in EmpowerID up to 7.205.0.0. It has been rated as problematic. This issue affects some unknown processing of the component Multi-Factor Authentication Code Handler. The manipulation leads to information disclosur…
- 9.8CVE-2023-36139EPSS 0.5%
In PHPJabbers Cleaning Business Software 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.
- 9.8CVE-2023-36134EPSS 0.6%
In PHP Jabbers Class Scheduling System 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.
- 5.5CVE-2023-3749EPSS 0.1%
A local user could edit the VideoEdge configuration file and interfere with VideoEdge operation.
- 5.5CVE-2023-36858EPSS 0.1%
An insufficient verification of data vulnerability exists in BIG-IP Edge Client for Windows and macOS that may allow an attacker to modify its configured server list. Note: Software versions which have reached End of Technical Support (Eo…
- 6.5CVE-2023-2314EPSS 0.4%
Insufficient data validation in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
- 9.8CVE-2023-37920EPSS 0.6%
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's ro…
- 6.7CVE-2023-30562EPSS 0.2%
A GRE dataset file within Systems Manager can be tampered with and distributed to PCUs.
- 5.7CVE-2023-30559EPSS 0.2%
The firmware update package for the wireless card is not properly signed and can be modified.
- 9.8CVE-2023-25178EPSS 0.5%
Controller may be loaded with malicious firmware which could enable remote code execution. See Honeywell Security Notification for recommendations on upgrading and versioning.
- 4.3CVE-2023-37264EPSS 0.4%
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Ta…
- 9.8CVE-2023-3325EPSS 0.5%
The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the use of an insufficiently unique cryptographic signature on the 'cmsc_add_site' function in versions up to, and including, 2.287. This makes it possible…
- 7.8CVE-2023-30759EPSS 0.1%
The driver installation package created by Printer Driver Packager NX v1.0.02 to v1.1.25 fails to detect its modification and may spawn an unexpected process with the administrative privilege. If a non-administrative user modifies the driv…
- 5.3CVE-2023-2897EPSS 0.3%
The Brizy Page Builder plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.4.18. This is due to an implicit trust of user-supplied IP addresses in an 'X-Forwarded-For' HTTP header for the purpose o…
- 7.8CVE-2023-2866EPSS 0.1%
If an attacker can trick an authenticated user into loading a maliciously crafted .zip file onto Advantech WebAccess version 8.4.5, a web shell could be used to give the attacker full control of the SCADA server.
- 9.8CVE-2023-3028EPSS 0.2%
Insufficient authentication in the MQTT backend (broker) allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles using the HopeChart HQT-401 telematics unit. Other models are possibly affected to…
- 9.8CVE-2023-2987EPSS 0.5%
The Wordapp plugin for WordPress is vulnerable to authorization bypass due to an use of insufficiently unique cryptographic signature on the 'wa_pdx_op_config_set' function in versions up to, and including, 1.6.0. This makes it possible fo…
- 9.8CVE-2023-28386EPSS 0.4%
Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly. The device only calculates the MD5 hash of the firmware and does not check using a private-public key mechanism. The lack of complete PKI system f…
- 4.8CVE-2023-32993EPSS 0.2%
Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to interce…
- 7.2CVE-2023-31502EPSS 0.7%
Altenergy Power Control Software C1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the component /models/management_model.php.
- 6.5CVE-2022-4537EPSS 0.3%
The Hide My WP Ghost – Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. This is due to insufficient restrictions on where the IP Address information is being retrieved for …
- 5.5CVE-2022-44420EPSS 0.07%
In modem, there is a possible missing verification of HashMME value in Security Mode Command. This could local denial of service with no additional execution privileges.
- 9.1CVE-2023-28863EPSS 0.4%
AMI MegaRAC SPx12 and SPx13 devices have Insufficient Verification of Data Authenticity.
- 9.8CVE-2023-27748EPSS 0.7%
BlackVue DR750-2CH LTE v.1.012_2022.10.26 does not employ authenticity check for uploaded firmware. This can allow attackers to upload crafted firmware which contains backdoors and enables arbitrary code execution.
- 5.4CVE-2023-26467EPSS 0.6%
A man in the middle can redirect traffic to a malicious server in a compromised configuration.
- 7.8CVE-2022-48431EPSS 0.1%
In JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be imported without the “Trust Project” confirmation.
- 6.5CVE-2023-27979EPSS 0.2%
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could allow the renaming of files in the IGSS project report directory, this could lead to denial of service when an attacker sends spec…