# CWE-345.

Every Advisory and CVE whose sources give the weakness CWE-345, newest first.

## Records, newest first (an older page)

- [Dependency injection in NVCaffe](https://agentprime.io/advisories/CVE-2021-39158.md)
  `CVE-2021-39158` · CVE record: NVIDIA caffe · CVSS 8.8 High · Not analysed yet · Published 23 Aug 2021 · Tags: CWE-345
- [Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault](https://agentprime.io/advisories/GHSA-fp52-qw33-mfmw.md)
  `GHSA-fp52-qw33-mfmw`, `BIT-vault-2020-16250`, `CVE-2020-16250`, `GO-2022-0825` · Go `github.com/hashicorp/vault`: affected `>=0.8.1, <1.2.5 || >=1.3.0, <1.3.8 || >=1.4.0, <1.4.4 || >=1.5.0, <1.5.1`, fixed in `1.2.5`, `1.3.8`, `1.4.4`, `1.5.1` · CVSS 8.2 High · Not analysed yet · Published 2 Aug 2021 · Tags: Authentication bypass, CWE-345
- [Denial of Service in SheetJS Pro](https://agentprime.io/advisories/GHSA-g973-978j-2c3p.md)
  `GHSA-g973-978j-2c3p`, `CVE-2021-32014` · Maven `org.webjars.npm:xlsx` and 1 more: affected `<0.17.0`, fixed in `0.17.0` · CVSS 5.5 Medium · Not analysed yet · Published 22 Jul 2021 · Tags: Denial of service, CWE-345
- [Insufficient verification of data authenticity in Dell PowerFlex](https://agentprime.io/advisories/CVE-2021-21588.md)
  `CVE-2021-21588` · CVE record: Dell PowerFlex · CVSS 6.5 Medium · Not analysed yet · Published 12 Jul 2021 · Tags: CWE-345
- [PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a substantive authentication response.](https://agentprime.io/advisories/CVE-2021-36367.md)
  `CVE-2021-36367` · CVE record · CVSS 8.1 High · Not analysed yet · Published 9 Jul 2021 · Tags: CWE-345
- [Insufficient verification of data authenticity in Siemens Mendix SAML Module](https://agentprime.io/advisories/CVE-2021-33712.md)
  `CVE-2021-33712` · CVE record: Siemens Mendix SAML Module · No CVSS score · Not analysed yet · Published 8 Jun 2021 · Tags: CWE-345
- [Insufficient Verification of Data Authenticity in Pillow](https://agentprime.io/advisories/GHSA-hjfx-8p6c-g7gx.md)
  `GHSA-hjfx-8p6c-g7gx`, `BIT-pillow-2021-28678`, `CVE-2021-28678`, `PYSEC-2021-94` · PyPI `pillow`: affected `>=5.1.0, <8.2.0`, fixed in `8.2.0` · CVSS 5.5 Medium · Not analysed yet · Published 8 Jun 2021 · Tags: CWE-345
- [Verified groups not reliable](https://agentprime.io/advisories/CVE-2021-32665.md)
  `CVE-2021-32665` · CVE record: wireapp wire-ios · CVSS 8.8 High · Not analysed yet · Published 3 Jun 2021 · Tags: CWE-345
- [ReDoS in Sec-Websocket-Protocol header](https://agentprime.io/advisories/GHSA-6fc8-4gx4-v693.md)
  `GHSA-6fc8-4gx4-v693`, `CVE-2021-32640` · npm `ws`: affected `>=5.0.0, <5.2.3 || >=6.0.0, <6.2.2 || >=7.0.0, <7.4.6`, fixed in `5.2.3`, `6.2.2`, `7.4.6` · CVSS 5.3 Medium · Not analysed yet · Published 28 May 2021 · Tags: Denial of service, CWE-345
- [A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can imperso...](https://agentprime.io/advisories/GHSA-w8hx-f868-pvch.md)
  `GHSA-w8hx-f868-pvch`, `CVE-2021-20267`, `PYSEC-2021-136` · PyPI `neutron`: affected `<15.3.3 || >=16.0.0, <16.3.1 || >=17.0.0, <17.1.1`, fixed in `15.3.3`, `16.3.1`, `17.1.1` · No CVSS score · Not analysed yet · Published 28 May 2021 · Tags: CWE-345
- [Token reuse in Ory fosite](https://agentprime.io/advisories/GHSA-v3q9-2p3m-7g43.md)
  `GHSA-v3q9-2p3m-7g43`, `CVE-2020-15222`, `GO-2021-0110` · Go `github.com/ory/fosite`: affected `<0.31.0`, fixed in `0.31.0` · CVSS 8.1 High · Not analysed yet · Published 24 May 2021 · Tags: Authentication bypass, CWE-345
- [Insufficient Verification of Data Authenticity in Eclipse Theia](https://agentprime.io/advisories/GHSA-f7vx-j8mp-3h2x.md)
  `GHSA-f7vx-j8mp-3h2x`, `CVE-2019-17636` · npm `@theia/mini-browser`: affected `>=0.3.9, <0.16.0`, fixed in `0.16.0` · CVSS 8.1 High · Not analysed yet · Published 13 Apr 2021 · Tags: CWE-345
- [Insufficient verification of data authenticity in rpm](https://agentprime.io/advisories/CVE-2021-20271.md)
  `CVE-2021-20271` · CVE record: rpm · No CVSS score · Not analysed yet · Published 26 Mar 2021 · Tags: CWE-345
- [Cisco IOS XE Software Web UI Cross-Site WebSocket Hijacking Vulnerability](https://agentprime.io/advisories/CVE-2021-1403.md)
  `CVE-2021-1403` · CVE record: Cisco Cisco IOS XE Software · CVSS 7.4 High · Not analysed yet · Published 24 Mar 2021 · Tags: CWE-345
- [User content sandbox can be confused into opening arbitrary documents](https://agentprime.io/advisories/GHSA-52mq-6jcv-j79x.md)
  `GHSA-52mq-6jcv-j79x`, `CVE-2021-21320` · npm `matrix-react-sdk`: affected `<3.15.0`, fixed in `3.15.0` · CVSS 2.6 Low · Not analysed yet · Published 3 Mar 2021 · Tags: CWE-345
- [Unprotected dynamically loaded chunks](https://agentprime.io/advisories/GHSA-4fc4-chg7-h8gh.md)
  `GHSA-4fc4-chg7-h8gh`, `CVE-2020-15262` · npm `webpack-subresource-integrity`: affected `<1.5.1`, fixed in `1.5.1` · CVSS 3.7 Low · Not analysed yet · Published 19 Oct 2020 · Tags: CWE-345
- [Cisco Umbrella Roaming Client for Windows Install Vulnerability](https://agentprime.io/advisories/CVE-2019-16000.md)
  `CVE-2019-16000` · CVE record: Cisco Cisco Umbrella Enterprise Roaming Client for Windows · CVSS 4.4 Medium · Not analysed yet · Published 23 Sept 2020 · Tags: CWE-345
- [Cisco AnyConnect Secure Mobility Client for Android Service Hijack Vulnerability](https://agentprime.io/advisories/CVE-2019-16007.md)
  `CVE-2019-16007` · CVE record: Cisco Cisco AnyConnect Secure Mobility Client · CVSS 5.9 Medium · Not analysed yet · Published 23 Sept 2020 · Tags: CWE-345
- [Invalid root may become trusted root in The Update Framework (TUF)](https://agentprime.io/advisories/GHSA-f8mr-jv2c-v8mg.md)
  `GHSA-f8mr-jv2c-v8mg`, `CVE-2020-15163`, `PYSEC-2020-145` · PyPI `tuf`: affected `<0.12.0`, fixed in `0.12.0` · CVSS 8.7 High · Not analysed yet · Published 9 Sept 2020 · Tags: Broken access control, CWE-345
- [Insufficient verification of data authenticity in - PCoIP Standard Agent for Windows - PCoIP Graphics Agent for Windows](https://agentprime.io/advisories/CVE-2020-13178.md)
  `CVE-2020-13178` · CVE record: \- PCoIP Standard Agent for Windows - PCoIP Graphics Agent for Windows · No CVSS score · Not analysed yet · Published 11 Aug 2020 · Tags: CWE-345
- [Insufficient verification of data authenticity in Apache HTTP Server](https://agentprime.io/advisories/CVE-2020-11985.md)
  `CVE-2020-11985` · CVE record: Apache HTTP Server · No CVSS score · Not analysed yet · Published 7 Aug 2020 · Tags: CWE-345
- [Cisco IOS XE Software IPsec VPN Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2020-3220.md)
  `CVE-2020-3220` · CVE record: Cisco Cisco IOS XE Software 16.4.1 · CVSS 6.8 Medium · Not analysed yet · Published 3 Jun 2020 · Tags: CWE-345
- [Insufficient verification of data authenticity in EcoStruxure Machine Expert (all versions)SoMachine…](https://agentprime.io/advisories/CVE-2020-7487.md)
  `CVE-2020-7487` · CVE record: EcoStruxure Machine Expert (all versions)SoMachine, SoMachine Motion (all versions)Modicon M218 Logic Controller (all versions)Modicon M241 Logic Controller (all versions)Modicon M251 Logic Controller (all versions)Modicon M258 Logic Controller (all versions) · No CVSS score · Not analysed yet · Published 22 Apr 2020 · Tags: CWE-345
- [Deprecated functionality in autoyast2 automatically imports gpg keys without checking them](https://agentprime.io/advisories/CVE-2019-18905.md)
  `CVE-2019-18905` · CVE record: SUSE SUSE Linux Enterprise Server 12 and 1 more · CVSS 4.8 Medium · Not analysed yet · Published 3 Apr 2020 · Tags: CWE-345
- [Insufficient Verification of Data Authenticity in python-keystoneclient](https://agentprime.io/advisories/GHSA-9vg3-cf92-h2h7.md)
  `GHSA-9vg3-cf92-h2h7`, `CVE-2013-2167`, `PYSEC-2019-161` · PyPI `python-keystoneclient`: affected `>=0.2.3, <0.3.0`, fixed in `0.3.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Mar 2020 · Tags: CWE-345
- [Cisco NX-OS Software Anycast Gateway Invalid ARP Vulnerability](https://agentprime.io/advisories/CVE-2020-3174.md)
  `CVE-2020-3174` · CVE record: Cisco Cisco NX-OS Software 7.3(2)D1(1d) · CVSS 4.7 Medium · Not analysed yet · Published 26 Feb 2020 · Tags: CWE-345
- [Cisco HyperFlex Software Counter Value Injection Vulnerability](https://agentprime.io/advisories/CVE-2019-12620.md)
  `CVE-2019-12620` · CVE record: Cisco Cisco HyperFlex HX-Series · CVSS 5.3 Medium · Not analysed yet · Published 18 Sept 2019 · Tags: CWE-345
- [Insufficient verification of data authenticity in icedtea-web](https://agentprime.io/advisories/CVE-2019-10181.md)
  `CVE-2019-10181` · CVE record: IcedTea icedtea-web · CVSS 6.3 Medium · Not analysed yet · Published 31 Jul 2019 · Tags: CWE-345
- [Cisco Advanced Malware Protection for Endpoints Windows Command Injection Vulnerability](https://agentprime.io/advisories/CVE-2019-1932.md)
  `CVE-2019-1932` · CVE record: Cisco Cisco AMP for Endpoints · CVSS 6.7 Medium · Not analysed yet · Published 6 Jul 2019 · Tags: CWE-345
- [Improper Certificate Validation and Insufficient Verification of Data Authenticity in Keycloak](https://agentprime.io/advisories/GHSA-38cg-gg9j-q9j9.md)
  `GHSA-38cg-gg9j-q9j9`, `CVE-2019-3875` · Maven `org.keycloak:keycloak-core`: affected `<=6.0.1`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 27 Jun 2019 · Tags: Weak cryptography or TLS, CWE-345
- [Forced Logout in keycloak-connect](https://agentprime.io/advisories/GHSA-68hw-vfh7-xvg8.md)
  `GHSA-68hw-vfh7-xvg8`, `CVE-2019-10157` · npm `keycloak-connect`: affected `<4.8.3`, fixed in `4.8.3` · CVSS 4.7 Medium · Not analysed yet · Published 13 Jun 2019 · Tags: Authentication bypass, CWE-345
- [Prototype Pollution in upmerge](https://agentprime.io/advisories/GHSA-gm9g-2g8v-fvxj.md)
  `GHSA-gm9g-2g8v-fvxj` · npm `upmerge`: affected `<=0.1.8`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 6 Jun 2019 · Tags: Denial of service, CWE-345
- [Cisco Unified Computing System BIOS Signature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2019-1880.md)
  `CVE-2019-1880` · CVE record: Cisco Cisco Unified Computing System (Managed) · CVSS 4.4 Medium · Not analysed yet · Published 5 Jun 2019 · Tags: CWE-345
- [Insufficient verification of data authenticity in Hospira Plum A+ Infusion System and others](https://agentprime.io/advisories/CVE-2015-3956.md)
  `CVE-2015-3956` · CVE record: Hospira Plum A+ Infusion System and 2 more · No CVSS score · Not analysed yet · Published 25 Mar 2019 · Tags: CWE-345
- [Cisco HyperFlex Arbitrary Statistics Write Vulnerability](https://agentprime.io/advisories/CVE-2019-1667.md)
  `CVE-2019-1667` · CVE record: Cisco Cisco HyperFlex HX-Series · CVSS 4.0 Medium · Not analysed yet · Published 21 Feb 2019 · Tags: CWE-345
- [Prototype Pollution in defaults-deep](https://agentprime.io/advisories/GHSA-pjxw-22xf-6pwc.md)
  `GHSA-pjxw-22xf-6pwc`, `CVE-2018-16486` · npm `defaults-deep`: affected `<=0.2.4`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Feb 2019 · Tags: Denial of service, CWE-345
- [Insufficient verification of data authenticity in Power DNS pdns-recursor](https://agentprime.io/advisories/CVE-2019-3807.md)
  `CVE-2019-3807` · CVE record: Power DNS pdns-recursor · CVSS 3.7 Low · Not analysed yet · Published 29 Jan 2019 · Tags: CWE-345
- [Spring Security vulnerable to Authorization Bypass](https://agentprime.io/advisories/GHSA-27xw-p8v6-9jjr.md)
  `GHSA-27xw-p8v6-9jjr`, `CVE-2018-15801` · Maven `org.springframework.security:spring-security-core` and 1 more: affected `>=5.1.0, <5.1.2`, fixed in `5.1.2` · CVSS 3.3 Low · Not analysed yet · Published 20 Dec 2018 · Tags: CWE-345
- [Insufficient verification of data authenticity in Schneider Electric SE Modicon M221, All Versions](https://agentprime.io/advisories/CVE-2018-7798.md)
  `CVE-2018-7798` · CVE record: Schneider Electric SE Modicon M221, All Versions · CVSS 8.2 High · Not analysed yet · Published 2 Nov 2018 · Tags: CWE-345
- [Ansible does not verify that the server hostname matches a domain name in certificates](https://agentprime.io/advisories/GHSA-w64c-pxjj-h866.md)
  `GHSA-w64c-pxjj-h866`, `CVE-2015-3908`, `PYSEC-2015-1` · PyPI `ansible`: affected `<1.9.2`, fixed in `1.9.2` · CVSS 7.5 High · Not analysed yet · Published 10 Oct 2018 · Tags: CWE-345
- [Medtronic MyCareLink 24950 Patient Monitor Insufficient Verification of Data Authenticity](https://agentprime.io/advisories/CVE-2018-10626.md)
  `CVE-2018-10626` · CVE record: Medtronic 24950 MyCareLink Monitor and 1 more · CVSS 4.4 Medium · Not analysed yet · Published 10 Aug 2018 · Tags: CWE-345
- [GIGABYTE BRIX UEFI firmware is not cryptographically signed](https://agentprime.io/advisories/CVE-2017-3198.md)
  `CVE-2017-3198` · CVE record: GIGABYTE GB-BSi7H-6500 and 1 more · No CVSS score · Not analysed yet · Published 9 Jul 2018 · Tags: CWE-345
- [Improper certificate validation in Akeo Consulting Rufus](https://agentprime.io/advisories/CVE-2017-13083.md)
  `CVE-2017-13083` · CVE record: Akeo Consulting Rufus · CVSS 5.3 Medium · Not analysed yet · Published 18 Oct 2017 · Tags: Weak cryptography or TLS, CWE-345, CWE-494
- [Hospira LifeCare PCA Infusion System](https://agentprime.io/advisories/CVE-2014-5406.md)
  `CVE-2014-5406` · CVE record: Hospira LifeCare PCA Infusion System · CVSS 7.6 High · Not analysed yet · Published 6 Jul 2015 · Tags: CWE-345
- [Arbiter Systems 1094B GPS Clock Insufficient Verification of Data Authenticity](https://agentprime.io/advisories/CVE-2014-9194.md)
  `CVE-2014-9194` · CVE record: Arbiter Systems Model 1094B GPS Substation Clock · CVSS 5.4 Medium · Not analysed yet · Published 17 Jan 2015 · Tags: CWE-345

Newest: <https://agentprime.io/advisories/tag/cwe-345.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-345&cursor=WyIyMDIxLTA4LTI1VDE5OjEwOjU5LjYzOTAwMFoiLCJDVkUtMjAyMS0xNTg2Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-345/?cursor=WyIyMDIxLTA4LTI1VDE5OjEwOjU5LjYzOTAwMFoiLCJDVkUtMjAyMS0xNTg2Il0>. Everything for agents: <https://agentprime.io/llms.txt>.