CWE-345.

Dependency injection in NVCaffe

• NVIDIA caffe
• CWE-345

Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault

• Authentication bypass
• CWE-345

>=0.8.1, <1.2.5 || >=1.3.0, <1.3.8 || >=1.4.0, <1.4.4 || >=1.5.0, <1.5.1 · fixed in 1.2.5, 1.3.8, 1.4.4, 1.5.1

Denial of Service in SheetJS Pro

• Denial of service
• CWE-345

<0.17.0 · fixed in 0.17.0

Insufficient verification of data authenticity in Dell PowerFlex

• Dell PowerFlex
• CWE-345

PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a substantive authentication response.

• CWE-345

Insufficient verification of data authenticity in Siemens Mendix SAML Module

• Siemens Mendix SAML Module
• CWE-345

Insufficient Verification of Data Authenticity in Pillow

• CWE-345

>=5.1.0, <8.2.0 · fixed in 8.2.0

Verified groups not reliable

• wireapp wire-ios
• CWE-345

ReDoS in Sec-Websocket-Protocol header

• Denial of service
• CWE-345

>=5.0.0, <5.2.3 || >=6.0.0, <6.2.2 || >=7.0.0, <7.4.6 · fixed in 5.2.3, 6.2.2, 7.4.6

A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can imperso...

• CWE-345

<15.3.3 || >=16.0.0, <16.3.1 || >=17.0.0, <17.1.1 · fixed in 15.3.3, 16.3.1, 17.1.1

Token reuse in Ory fosite

• Authentication bypass
• CWE-345

<0.31.0 · fixed in 0.31.0

Insufficient Verification of Data Authenticity in Eclipse Theia

• CWE-345

>=0.3.9, <0.16.0 · fixed in 0.16.0

Insufficient verification of data authenticity in rpm

• rpm
• CWE-345

Cisco IOS XE Software Web UI Cross-Site WebSocket Hijacking Vulnerability

• Cisco IOS XE Software
• CWE-345

User content sandbox can be confused into opening arbitrary documents

• CWE-345

<3.15.0 · fixed in 3.15.0

Unprotected dynamically loaded chunks

• CWE-345

<1.5.1 · fixed in 1.5.1

Cisco Umbrella Roaming Client for Windows Install Vulnerability

• Cisco Umbrella Enterprise Roaming Client for Windows
• CWE-345

Cisco AnyConnect Secure Mobility Client for Android Service Hijack Vulnerability

• Cisco AnyConnect Secure Mobility Client
• CWE-345

Invalid root may become trusted root in The Update Framework (TUF)

• Broken access control
• CWE-345

<0.12.0 · fixed in 0.12.0

Insufficient verification of data authenticity in - PCoIP Standard Agent for Windows - PCoIP Graphics Agent for Windows

• - PCoIP Standard Agent for Windows - PCoIP Graphics Agent for Windows
• CWE-345

Insufficient verification of data authenticity in Apache HTTP Server

• Apache HTTP Server
• CWE-345

Cisco IOS XE Software IPsec VPN Denial of Service Vulnerability

• Cisco IOS XE Software 16.4.1
• CWE-345

Insufficient verification of data authenticity in EcoStruxure Machine Expert (all versions)SoMachine…

• EcoStruxure Machine Expert (all versions)SoMachine, SoMachine Motion (all versions)Modicon M218 Logic Controller (all versions)Modicon M241 Logic Controller (all versions)Modicon M251 Logic Controller (all versions)Modicon M258 Logic Controller (all versions)
• CWE-345

Deprecated functionality in autoyast2 automatically imports gpg keys without checking them

• SUSE Linux Enterprise Server 12
• SUSE Linux Enterprise Server 15
• CWE-345

Insufficient Verification of Data Authenticity in python-keystoneclient

• CWE-345

>=0.2.3, <0.3.0 · fixed in 0.3.0

Cisco NX-OS Software Anycast Gateway Invalid ARP Vulnerability

• Cisco NX-OS Software 7.3(2)D1(1d)
• CWE-345

Cisco HyperFlex Software Counter Value Injection Vulnerability

• Cisco HyperFlex HX-Series
• CWE-345

Insufficient verification of data authenticity in icedtea-web

• icedtea-web
• CWE-345

Cisco Advanced Malware Protection for Endpoints Windows Command Injection Vulnerability

• Cisco AMP for Endpoints
• CWE-345

Improper Certificate Validation and Insufficient Verification of Data Authenticity in Keycloak

• Weak cryptography or TLS
• CWE-345

<=6.0.1 · no fixed version yet

Forced Logout in keycloak-connect

• Authentication bypass
• CWE-345

<4.8.3 · fixed in 4.8.3

Prototype Pollution in upmerge

• Denial of service
• CWE-345

<=0.1.8 · no fixed version yet

Cisco Unified Computing System BIOS Signature Bypass Vulnerability

• Cisco Unified Computing System (Managed)
• CWE-345

Insufficient verification of data authenticity in Hospira Plum A+ Infusion System and others

• Hospira Plum A+ Infusion System
• Hospira Plum A+3 Infusion System
• CWE-345

Cisco HyperFlex Arbitrary Statistics Write Vulnerability

• Cisco HyperFlex HX-Series
• CWE-345

Prototype Pollution in defaults-deep

• Denial of service
• CWE-345

<=0.2.4 · no fixed version yet

Insufficient verification of data authenticity in Power DNS pdns-recursor

• Power DNS pdns-recursor
• CWE-345

Spring Security vulnerable to Authorization Bypass

• CWE-345

>=5.1.0, <5.1.2 · fixed in 5.1.2

Insufficient verification of data authenticity in Schneider Electric SE Modicon M221, All Versions

• Schneider Electric SE Modicon M221, All Versions
• CWE-345

Ansible does not verify that the server hostname matches a domain name in certificates

• CWE-345

<1.9.2 · fixed in 1.9.2

Medtronic MyCareLink 24950 Patient Monitor Insufficient Verification of Data Authenticity

• Medtronic 24950 MyCareLink Monitor
• Medtronic 24952 MyCareLink Monitor
• CWE-345

GIGABYTE BRIX UEFI firmware is not cryptographically signed

• GIGABYTE GB-BSi7H-6500
• GIGABYTE GB-BXi7-5775
• CWE-345

Improper certificate validation in Akeo Consulting Rufus

• Akeo Consulting Rufus
• Weak cryptography or TLS
• CWE-345

Hospira LifeCare PCA Infusion System

• Hospira LifeCare PCA Infusion System
• CWE-345

Arbiter Systems 1094B GPS Clock Insufficient Verification of Data Authenticity

• Arbiter Systems Model 1094B GPS Substation Clock
• CWE-345