CWE-345 · Cryptography
Insufficient Verification of Data Authenticity
730CVEs
1exploited
2with a public check
5likely (EPSS 10%+)
SortMost likely exploited
730 CVEs with CWE-345 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2022-26871In CISA KEVExploitedAn arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execu…Trend Micro · Trend Micro Apex Central · CVSS 9.8 · 2022-03-29 | 9.8 | 19% | 2022-03-29 |
| CVE-2019-17228CheckMotors Car Dealer & Classified Ads <= 1.4.0 - Unauthenticated settings import/exportStylemixthemes · Motors - Car Dealer, Classifieds & Listing · 2020-02-24 | – | 1.3% | 2020-02-24 |
| CVE-2026-41432CheckNew API < v0.12.10 - Stripe Webhook BypassQuantumNous · new-api · CVSS 7.1 · 2026-05-08 | 7.1 | 0.9% | 2026-05-08 |
| CVE-2016-4553client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-…Squid-Cache · Squid · 2016-05-10 | – | 80% | 2016-05-10 |
| CVE-2016-4554mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crafted HTTP Host head…Squid-Cache · Squid · 2016-05-10 | – | 39% | 2016-05-10 |
| CVE-2023-35719ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass VulnerabilityManageEngine · ADSelfService Plus · CVSS 6.8 · 2023-09-06 | 6.8 | 25% | 2023-09-06 |
| CVE-2014-4936The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.1012 and earlier allow man-in-the-middle a…Malwarebytes · Malwarebytes Anti-Exploit · 2014-12-16 | – | 17% | 2014-12-16 |
| CVE-2024-5458Filter bypass in filter_var (FILTER_VALIDATE_URL)PHP Group · PHP · CVSS 5.3 · 2024-06-09 | 5.3 | 12% | 2024-06-09 |
| CVE-2017-7674The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response vari…Apache Software Foundation · Apache Tomcat · 2017-08-11 | – | 8.0% | 2017-08-11 |
| CVE-2015-0251The mod_dav_svn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a crafted v1 HTTP protoco…Apache · Subversion · 2015-04-08 | – | 7.9% | 2015-04-08 |
| CVE-2023-5482Insufficient data validation in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium se…Google · Chrome · CVSS 8.8 · 2023-11-01 | 8.8 | 7.3% | 2023-11-01 |
| CVE-2020-11985IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof the…Apache · Apache HTTP Server · 2020-08-07 | – | 7.1% | 2020-08-07 |
| CVE-2014-0364The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to s…Igniterealtime · Smack · 2014-04-30 | – | 6.2% | 2014-04-30 |
| CVE-2017-11103Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in a way that violates the Kerberos 5 prot…Heimdal Project · Heimdal · 2017-07-13 | – | 5.1% | 2017-07-13 |
| CVE-2022-20829Cisco Adaptive Security Device Manager and Adaptive Security Appliance Software Client-side Arbitrary Code Execution VulnerabilityCisco · Cisco Adaptive Security Appliance (ASA) Software · CVSS 9.1 · 2022-06-24 | 9.1 | 3.7% | 2022-06-24 |
| CVE-2019-11235FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve be…Freeradius · Freeradius · 2019-04-21 | – | 3.6% | 2019-04-21 |
| CVE-2026-85431MOOS essential-moos through 10.0.1 pMOOSBridge Unauthenticated UDP Packet Injectionthemoos · essential-moos · CVSS 7.5 · 2026-09-03 | 7.5 | 3.4% | 2026-09-03 |
| CVE-2020-28900Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of Privileges or Code Execution as root via…Nagios · Fusion · 2021-05-24 | – | 3.1% | 2021-05-24 |
| CVE-2018-19971JFrog Artifactory Pro 6.5.9 has Incorrect Access Control.Jfrog · Artifactory · 2019-04-16 | – | 3.0% | 2019-04-16 |
| CVE-2019-0805An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'. This CVE…Microsoft · Windows · 2019-04-09 | – | 2.8% | 2019-04-09 |
| CVE-2014-8165scripts/amsvis/powerpcAMS/amsnet.py in powerpc-utils-python uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialize…Powerpc-Utils Project · Powerpc-Utils · 2015-02-19 | – | 2.8% | 2015-02-19 |
| CVE-2023-51764Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other opti…Postfix · Postfix · 2023-12-24 | – | 2.6% | 2023-12-24 |
| CVE-2021-43616The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is i…Npmjs · Npm · CVSS 9 · 2021-11-13 | 9.0 | 2.6% | 2021-11-13 |
| CVE-2019-5161An exploitable remote code execution vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 versions 03.02.02(14), 03.01.07(13), and 03.00.39(12). A specially…Wago · WAGO PFC200 Firmware · 2020-03-10 | – | 2.5% | 2020-03-10 |
| CVE-2021-37421Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass.Zohocorp · Manageengine Adselfservice Plus · 2021-08-30 | – | 2.5% | 2021-08-30 |
| CVE-2021-1586Cisco Nexus 9000 Series Fabric Switches ACI Mode Multi-Pod and Multi-Site TCP Denial of Service VulnerabilityCisco · Cisco NX-OS System Software in ACI Mode · CVSS 8.6 · 2021-08-25 | 8.6 | 2.5% | 2021-08-25 |
| CVE-2020-6090An exploitable code execution vulnerability exists in the Web-Based Management (WBM) functionality of WAGO PFC 200 03.03.10(15). A specially crafted series of HTTP requests can ca…Wago · Wago · 2020-06-11 | – | 2.1% | 2020-06-11 |
| CVE-2013-2167python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypasspython-keystoneclient · python-keystoneclient · 2019-12-10 | – | 2.0% | 2019-12-10 |
| CVE-2022-22994Insufficient Verification of Data Authenticity Remote Code Execution Vulnerability on Western Digital My Cloud devices.Western Digital · My Cloud · CVSS 8.8 · 2022-01-28 | 8.8 | 1.9% | 2022-01-28 |
| CVE-2020-6443Insufficient data validation in developer tools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker who had convinced the user to use devtools to execute arbitrary co…Google · Chrome · 2020-04-13 | – | 1.8% | 2020-04-13 |
| CVE-2019-15162rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platforms provides details about why authentication failed, which might make it easier for attackers to enumerate valid user…Tcpdump · Libpcap · 2019-10-03 | – | 1.8% | 2019-10-03 |
| CVE-2015-2908Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, do not validate firmware updates, which allows remote attack…Munic · Mobile Devices (MDI) OBD-II dongles · 2015-08-23 | – | 1.8% | 2015-08-23 |
| CVE-2024-23922Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution VulnerabilitySony · XAV-AX5500 · CVSS 6.8 · 2024-09-23 | 6.8 | 1.8% | 2024-09-23 |
| CVE-2020-6081An exploitable code execution vulnerability exists in the PLC_Task functionality of 3S-Smart Software Solutions GmbH CODESYS Runtime 3.5.14.30. A specially crafted network request…Codesys · 3S · CVSS 9.9 · 2020-05-07 | 9.9 | 1.8% | 2020-05-07 |
| CVE-2026-85430MOOS essential-moos through 10.0.1 pShare Unauthenticated UDP Datagram Republishingthemoos · essential-moos · CVSS 9.1 · 2026-09-03 | 9.1 | 1.7% | 2026-09-03 |
| CVE-2022-31800Insufficient Verification of Data Vulnerability in PHOENIX CONTACT classic line industrial controllersPHOENIX CONTACT · ILC 1x0 · CVSS 9.8 · 2022-06-21 | 9.8 | 1.6% | 2022-06-21 |
| CVE-2020-7982An issue was discovered in OpenWrt 18.06.0 to 18.06.6 and 19.07.0, and LEDE 17.01.0 to 17.01.7. A bug in the fork of the opkg package manager before 2020-01-25 prevents correct pa…Openwrt · Lede · 2020-03-16 | – | 1.6% | 2020-03-16 |
| CVE-2017-3198GIGABYTE BRIX UEFI firmware is not cryptographically signedGIGABYTE · GB-BSi7H-6500 · 2018-07-09 | – | 1.6% | 2018-07-09 |
| CVE-2020-24045A sandbox escape issue was discovered in TitanHQ SpamTitan Gateway 7.07. It limits the admin user to a restricted shell, allowing execution of a small number of tools of the opera…Titanhq · Spamtitan · 2020-09-17 | – | 1.6% | 2020-09-17 |
| CVE-2015-6853The Domino web agent in CA Single Sign-On (aka SSO, formerly SiteMinder) R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, R12.5 before CR5, R12.51 before CR4, and R12.52 before…Broadcom · Single Sign-On · 2016-03-24 | – | 1.5% | 2016-03-24 |
| CVE-2015-6854The non-Domino web agents in CA Single Sign-On (aka SSO, formerly SiteMinder) R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, and R12.5 before CR5 allow remote attackers to ca…Broadcom · Single Sign-On · 2016-03-24 | – | 1.5% | 2016-03-24 |
| CVE-2022-25262In JetBrains Hub before 2022.1.14434, SAML request takeover was possible.Jetbrains · Hub · 2022-02-25 | – | 1.5% | 2022-02-25 |
| CVE-2015-7539The Plugins Manager in Jenkins before 1.640 and LTS before 1.625.2 does not verify checksums for plugin files referenced in update site data, which makes it easier for man-in-the-…Jenkins · Jenkins · 2016-02-03 | – | 1.4% | 2016-02-03 |
| CVE-2019-6475A flaw in mirror zone validity checking can allow zone data to be spoofedISC · BIND 9 · CVSS 5.9 · 2019-10-17 | 5.9 | 1.4% | 2019-10-17 |
| CVE-2016-1493Intel Driver Update Utility before 2.4 retrieves driver updates in cleartext, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted file.Intel · Driver Update Utility · 2016-01-29 | – | 1.2% | 2016-01-29 |
| CVE-2015-4674The autoupdate implementation in TimeDoctor Pro 1.4.72.3 on Windows relies on unsigned installer files that are retrieved without use of SSL, which makes it easier for man-in-the-…Timedoctor · Timedoctor · 2015-08-07 | – | 1.2% | 2015-08-07 |
| CVE-2023-38552When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node…NodeJS · Node · 2023-10-18 | – | 1.2% | 2023-10-18 |
| CVE-2014-5406Hospira LifeCare PCA Infusion SystemHospira · LifeCare PCA Infusion System · CVSS 7.6 · 2015-07-06 | 7.6 | 1.2% | 2015-07-06 |
| CVE-2019-10181It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker c…IcedTea · icedtea-web · CVSS 6.3 · 2019-07-31 | 6.3 | 1.2% | 2019-07-31 |
| CVE-2022-31801Insufficient Verification of Data Vulnerability in ProConOS/ProConOS eCLR SDK and MULTIPROG Engineering toolPHOENIX CONTACT · MULTIPROG · CVSS 9.8 · 2022-06-21 | 9.8 | 1.2% | 2022-06-21 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.