cve.bz

CWE-347: Improper Verification of Cryptographic Signature, page 15

Filter

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

What the weakness is: CWE-347 at MITRE

Ask an AI about CWE-347

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-347: Improper Verification of Cryptographic Signature and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/347.html and https://cve.bz/cve/cwe/347?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.4CVE-2022-24759EPSS 0.5%

    `@chainsafe/libp2p-noise` contains TypeScript implementation of noise protocol, an encryption protocol used in libp2p. `@chainsafe/libp2p-noise` before 4.1.2 and 5.0.3 does not correctly validate signatures during the handshake process. Th…

  2. 8.1CVE-2022-23610EPSS 0.7%

    wire-server provides back end services for Wire, an open source messenger. In versions of wire-server prior to the 2022-01-27 release, it was possible to craft DSA Signatures to bypass SAML SSO and impersonate any Wire user with SAML crede…

  3. 7.8CVE-2021-20319EPSS 0.5%

    An improper signature verification vulnerability was found in coreos-installer. A specially crafted gzip installation image can bypass the image signature verification and as a consequence can lead to the installation of unsigned content. …

  4. 6.2CVE-2021-43393EPSS 0.2%

    STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to abuse signature verification. This is associated with the ECDSA signature algorithm on the Java Card J-SAFE3 and STSAFE-J platforms exposing a 3.0.4 …

  5. 6.2CVE-2021-43392EPSS 0.2%

    STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to obtain information on cryptographic secrets. This is associated with the ECDSA signature algorithm on the Java Card J-SAFE3 and STSAFE-J platforms ex…

  6. 7.5CVE-2021-25636EPSS 1.0%

    LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Valida…

  7. 5.3CVE-2022-23655EPSS 0.6%

    Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS did not validate gateway server signatures. As a result non-authoritative gateway servers may be used to exfiltrate user private k…

  8. 5.5CVE-2021-40045EPSS 0.2%

    There is a vulnerability of signature verification mechanism failure in system upgrade through recovery mode.Successful exploitation of this vulnerability may affect service confidentiality.

  9. 7.8CVE-2022-24115EPSS 0.2%

    Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Cyber Protect Home Office (macOS) before build 39605, Acronis True Image 2021 (macOS) before build 39287

  10. 7.5CVE-2022-21134EPSS 0.9%

    A firmware update vulnerability exists in the "update" firmware checks functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to firmware update. An attacker can send a sequence of reques…

  11. 7.5CVE-2021-44878EPSS 0.9%

    If an OpenID Connect provider supports the "none" algorithm (i.e., tokens with no signature), pac4j v5.3.0 (and prior) does not refuse it without an explicit configuration on its side or for the "idtoken" response type which is not secure …

  12. 6.5CVE-2021-20156EPSS 0.4%

    Trendnet AC2600 TEW-827DRU version 2.08B01 contains an improper access control configuration that could allow for a malicious firmware update. It is possible to manually install firmware that may be malicious in nature as there does not ap…

  13. 7.8CVE-2020-16156EPSS 0.9%

    CPAN 2.28 allows Signature Verification Bypass.

  14. 7.8CVE-2020-16154EPSS 0.8%

    The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.

  15. 5.5CVE-2021-0152EPSS 0.1%

    Improper verification of cryptographic signature in the installer for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products in Windows 10 may allow an authenticated user to potentially enable denial of service via local …

  16. 7.4CVE-2021-34420EPSS 0.4%

    The Zoom Client for Meetings for Windows installer before version 5.5.4 does not properly verify the signature of files with .msi, .ps1, and .bat extensions. This could lead to a malicious actor installing malicious software on a customer’…

  17. 9.8CVE-2021-43572EPSS 1.2%

    The verify function in the Stark Bank Python ECDSA library (aka starkbank-escada or ecdsa-python) before 2.0.1 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.

  18. 9.8CVE-2021-43571EPSS 1.0%

    The verify function in the Stark Bank Node.js ECDSA library (ecdsa-node) 1.1.2 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.

  19. 9.8CVE-2021-43570EPSS 1.0%

    The verify function in the Stark Bank Java ECDSA library (ecdsa-java) 1.0.0 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.

  20. 9.8CVE-2021-43569EPSS 1.1%

    The verify function in the Stark Bank .NET ECDSA library (ecdsa-dotnet) 1.3.1 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.

  21. 9.8CVE-2021-43568EPSS 1.1%

    The verify function in the Stark Bank Elixir ECDSA library (ecdsa-elixir) 1.0.0 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.

  22. 5.3CVE-2021-39909EPSS 0.6%

    Lack of email address ownership verification in the CODEOWNERS feature in all versions of GitLab EE starting from 11.3 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows a…

  23. 7.2CVE-2021-37127EPSS 0.7%

    There is a signature management vulnerability in some huawei products. An attacker can forge signature and bypass the signature check. During firmware update process, successful exploit this vulnerability can cause the forged system file o…

  24. 7.5CVE-2021-41832EPSS 1.3%

    It is possible for an attacker to manipulate documents to appear to be signed by a trusted source. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021-25635 for the Libre…

  25. 5.3CVE-2021-41831EPSS 1.5%

    It is possible for an attacker to manipulate the timestamp of signed documents. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021-25634 for the LibreOffice advisory.

  26. 7.5CVE-2021-41830EPSS 1.4%

    It is possible for an attacker to manipulate signed documents and macros to appear to come from a trusted source. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021-2563…

  27. 8.8CVE-2021-29108EPSS 0.8%

    There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenticated attacker who is able to intercept and modify a SAML assertion to impers…

  28. 9.8CVE-2021-37927EPSS 2.2%

    Zoho ManageEngine ADManager Plus version 7110 and prior allows account takeover via SSO.

  29. 7.8CVE-2021-31847EPSS 0.4%

    Improper access control vulnerability in the repair process for McAfee Agent for Windows prior to 5.7.4 could allow a local attacker to perform a DLL preloading attack using unsigned DLLs. This would result in elevation of privileges and t…

  30. 7.3CVE-2021-31841EPSS 0.2%

    A DLL sideloading vulnerability in McAfee Agent for Windows prior to 5.7.4 could allow a local user to perform a DLL sideloading attack with an unsigned DLL with a specific name and in a specific location. This would result in the user gai…

  31. 6.4CVE-2021-34709EPSS 0.2%

    Multiple vulnerabilities in image verification checks of Cisco Network Convergence System (NCS) 540 Series Routers, only when running Cisco IOS XR NCS540L software images, and Cisco IOS XR Software for Cisco 8000 Series Routers could allow…

  32. 6.7CVE-2021-34708EPSS 0.2%

    Multiple vulnerabilities in image verification checks of Cisco Network Convergence System (NCS) 540 Series Routers, only when running Cisco IOS XR NCS540L software images, and Cisco IOS XR Software for Cisco 8000 Series Routers could allow…

  33. 8.1CVE-2021-3051EPSS 0.6%

    An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR SAML authentication that enables an unauthenticated network-based attacker with specific knowledge of the Cortex XSOAR instance to access protected re…

  34. 7.5CVE-2021-1849EPSS 1.0%

    An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. A malicious application may be able to bypass Privacy preferences.

  35. 9.8CVE-2021-33885EPSS 5.6%

    An Insufficient Verification of Data Authenticity vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to send the device malicious data that will be used in place of the correct data. This resul…

  36. 7.5CVE-2021-34433EPSS 0.3%

    In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally succeeds without verifying the server side's signature on the client side, if that signature is not i…

  37. 7.2CVE-2021-34715EPSS 1.1%

    A vulnerability in the image verification function of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute code with internal user privileges on the underl…

  38. 7.8CVE-2021-3633EPSS 0.3%

    A DLL preloading vulnerability was reported in Lenovo Driver Management prior to version 2.9.0719.1104 that could allow privilege escalation.

  39. 7.8CVE-2021-36277EPSS 0.2%

    Dell Command | Update, Dell Update, and Alienware Update versions before 4.3 contains an Improper Verification of Cryptographic Signature Vulnerability. A local authenticated malicious user may exploit this vulnerability by executing arbit…

  40. 9.8CVE-2021-38195EPSS 0.9%

    An issue was discovered in the libsecp256k1 crate before 0.5.0 for Rust. It can verify an invalid signature because it allows the R or S parameter to be larger than the curve order, aka an overflow.

  41. 4.9CVE-2021-3680EPSS 0.5%

    showdoc is vulnerable to Missing Cryptographic Step

  42. 9.8CVE-2021-37160EPSS 8.2%

    A firmware validation issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. There is no firmware validation (e.g., cryptographic signature val…

  43. 7.2CVE-2021-22708EPSS 0.7%

    A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Sma…

  44. 7.5CVE-2021-26100EPSS 0.3%

    A missing cryptographic step in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an unauthenticated attacker who intercepts the encrypted messages to manipulate them in such a way that makes the tampering and the r…

  45. 9.8CVE-2021-24020EPSS 0.6%

    A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to tamper with signed URLs by appending further data which allo…

  46. 7.8CVE-2021-35039EPSS 0.3%

    kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.si…

  47. 6.5CVE-2021-32738EPSS 0.5%

    js-stellar-sdk is a Javascript library for communicating with a Stellar Horizon server. The `Utils.readChallengeTx` function used in SEP-10 Stellar Web Authentication states in its function documentation that it reads and validates the cha…

  48. 6.5CVE-2021-23993EPSS 0.4%

    An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker creates a crafted OpenPGP key with a subkey that has an invalid self signature, and the Thunderbird user imports the cra…

  49. 4.3CVE-2021-23992EPSS 0.5%

    Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may create a crafted version of an OpenPGP key, by either replacing the original user ID, or by adding another user ID. If Thun…

  50. 9.8CVE-2021-32685EPSS 0.7%

    tEnvoy contains the PGP, NaCl, and PBKDF2 in node.js and the browser (hashing, random, encryption, decryption, signatures, conversions), used by TogaTech.org. In versions prior to 7.0.3, the `verifyWithMessage` method of `tEnvoyNaClSigning…