CWE-345.

Insufficient verification of data authenticity in Google Android

• Google Android
• CWE-345
• CWE-356

Belkin AX1800 Firmware Update data authenticity

• Belkin AX1800
• CWE-345

Picklescan is missing detection when calling pytorch function torch.utils._config_module.load_config

• Insecure deserialization
• CWE-345

<0.0.28 · fixed in 0.0.28

Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper

• Insecure deserialization
• CWE-345

<0.0.28 · fixed in 0.0.28

Picklescan missing detection when calling pytorch function torch.utils.collect_env.run

• Insecure deserialization
• CWE-345

<0.0.28 · fixed in 0.0.28

Picklescan missing detection when calling pytorch function torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression

• Insecure deserialization
• CWE-345

<0.0.28 · fixed in 0.0.28

Picklescan missing detection when calling pytorch function torch._dynamo.guards.GuardBuilder.get

• Insecure deserialization
• CWE-345

<0.0.28 · fixed in 0.0.28

Picklescan missing detection when calling pytorch function torch.utils.bottleneck.__main__.run_cprofile

• Insecure deserialization
• CWE-345

<0.0.28 · fixed in 0.0.28

Tenda G1 Firmware Update check_upload_file data authenticity

• Tenda G1
• CWE-345

Tenda AC15 Firmware Update check_fw data authenticity

• Tenda AC15
• CWE-345

D-Link DIR-619L boa FirmwareUpgrade data authenticity

• D-Link DIR-619L
• CWE-345

LocalSend is Vulnerable to Man-in-the-Middle Attacks, Leading to File Interception

• localsend
• CWE-300
• CWE-345

Ceph is vulnerable to authentication bypass through RadosGW

• ceph
• CWE-345

Possibilities of IP Spoofing via X-Forwarded-For (XFF) Header

• Progress Software Hybrid Data Pipeline
• CWE-345

Ollama vulnerable to Cross-Domain Token Exposure

• Authentication bypass
• CWE-345

<=0.9.6 · no fixed version yet

CSP frame-src was not correctly enforced for paths

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-345

A Recursor configured to send out ECS enabled queries can be sensitive to spoofing attempts

• PowerDNS Recursor
• CWE-345

Eluktronics Control Center REG File data authenticity

• Eluktronics Control Center
• CWE-345

@clerk/backend Performs Insufficient Verification of Data Authenticity

• CWE-345

>=2.9.0, <2.10.2 · fixed in 2.10.2

Comodo Internet Security Premium Manifest File cis_update_x64.xml integrity check

• Comodo Internet Security Premium
• CWE-345
• CWE-354

Pioneer DMH-WT7600NEX Root Filesystem Insufficient Verification of Data Authenticity Vulnerability

• Pioneer DMH-WT7600NEX
• CWE-345

Pioneer DMH-WT7600NEX Software Update Signing Insufficient Verification of Data Authenticity Vulnerability

• Pioneer DMH-WT7600NEX
• CWE-345

No warning when opening executable terminal files on macOS

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-345

zkVM Underconstrained Vulnerability

• CWE-345

>=2.0.0, <2.0.4 · fixed in 2.0.4

Taylored webhook validation vulnerabilities

• Path traversal
• Authentication bypass

>=7.0.5, <7.0.8 · fixed in 7.0.8

Backup files can be modified and uploaded

• SICK AG SICK Field Analytics
• CWE-345

Fabio allows HTTP clients to manipulate custom headers it adds

• CWE-345
• CWE-348

<1.6.6 · fixed in 1.6.6

Gradio CORS Origin Validation Bypass Vulnerability

• CWE-345
• CWE-346

>=5.0.0, <=5.29.1 · no fixed version yet

IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks.

• CWE-345

Mithril snapshots for Cardano database could be compromised by an adversary

• CWE-345

<0.12.2 · fixed in 0.12.2

React Router allows pre-render data spoofing on React-Router framework mode

• CWE-345

>=7.0.0-pre.0, <7.5.2 · fixed in 7.5.2

Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability

• Microsoft Windows 10 Version 1507
• Microsoft Windows 10 Version 1607
• CWE-345

WildFly Elytron OpenID Connect Client ExtensionOIDC authorization code injection attack

• CWE-345

>=1.17.0.Final, <2.2.9.Final || >=2.3.0.Final, <2.6.2.Final · fixed in 2.2.9.Final, 2.6.2.Final

Fast-JWT Improperly Validates iss Claims

• Authentication bypass
• CWE-345

<5.0.6 · fixed in 5.0.6

IROAD Dash Cam X5/Dash Cam X6 Domain origin validation

• IROAD Dash Cam X5
• IROAD Dash Cam X6
• CWE-345
• CWE-346

Vela Server Has Insufficient Webhook Payload Data Verification in github.com/go-vela/server

• Authentication bypass
• CWE-345

<0.25.3 || >=0.26.0, <0.26.3 · fixed in 0.25.3, 0.26.3

Zoom Apps - Insufficient Verification of Data Authenticity

• Zoom Communications, Inc Zoom Apps
• CWE-345

Zip Exploit Crashes Picklescan But Not PyTorch

• CWE-345

<0.0.23 · fixed in 0.0.23

Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch

• CWE-345

<0.0.23 · fixed in 0.0.23

Duplicate Advisory: Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch

• CWE-345

<0.0.23 · fixed in 0.0.23

Duplicate Advisory: Zip Exploit Crashes Picklescan But Not PyTorch

• CWE-345

<0.0.23 · fixed in 0.0.23

Insufficient verification of data authenticity in GE Vernova N60 multilin and others

• GE Vernova N60 multilin
• GE Vernova B30 Multilin
• CWE-345

Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.750 Application 20.0.1442 allows Insecure Firmware Image with Insufficient Verification of Data Authenticity V-2024-004.

• CWE-345

libsignal-service-rs Doesn't Check Origin of Sync Messages

• whisperfish libsignal-service-rs
• CWE-345

Insufficient verification of data authenticity in Intel(R) DSA software

• Intel(R) DSA software
• CWE-345

Fast DDS does not verify Permissions CA

• eProsima Fast-DDS
• CWE-345

Hickory DNS failure to verify self-signed RRSIG for DNSKEYs

• CWE-345

>=0.8.0, <0.24.3 || >=0.25.0-alpha.1, <0.25.0-alpha.5 · fixed in 0.24.3, 0.25.0-alpha.5

Hickory DNS's DNSSEC validation may accept broken authentication chains

• CWE-345

>=0.8.0, <0.24.3 · fixed in 0.24.3

Insufficient data authenticity vulnerability in Janto

• Impronta Janto
• CWE-345

BIG-IP APM Endpoint Inspection vulnerability

• F5 BIG-IP
• CWE-345

Address of e-mail sender can be spoofed by malicious email

• Mozilla Thunderbird
• CWE-345

SMC BMC Firmware Image Authentication Design Issue

• SMCI MBD-X12DPG-OA6
• Weak cryptography or TLS
• CWE-345

Mail spoofing

• Xerox Workplace Suite
• CWE-345

Local Privilege Escalation via Exposed XPC Method Due to Client Verification Failure in stats

• exelban stats
• CWE-345

Insufficient verification of data authenticity in Huawei HarmonyOS

• Huawei HarmonyOS
• CWE-345

Duplicate Advisory: WildFly Elytron OpenID Connect Client Extension authorization code injection attack

• CWE-345

<=34.0.1.Final · no fixed version yet

Lorex 2K Indoor Wi-Fi Security Camera - Code signing bypass

• Lorex 2K Indoor Wi-Fi Security Camera
• CWE-345

quic-go affected by an ICMP Packet Too Large Injection Attack on Linux

• CWE-345

<0.48.2 · fixed in 0.48.2

sigstore-java has vulnerability with bundle verification

• Weak cryptography or TLS
• CWE-345

>=1.0.0, <1.1.0 · fixed in 1.1.0

Insufficient verification of authenticity in IPP

• Eaton Intelligent Power Protector
• CWE-345