CWE-345.

AsyncSSH Rogue Extension Negotiation

• CWE-345
• CWE-349

<2.14.1 · fixed in 2.14.1

Insufficient verification of data authenticity in Google Chrome

• Google Chrome
• CWE-345

Fake websocket server installation permits full takeover in Home Assistant Core

• home-assistant core
• CWE-345

Arbitrary URL load in Android WebView in `MyActivity.kt` in Home Assistant Companion for Android

• home-assistant core
• Code injection
• CWE-345

Arduino Create Agent Insufficient Verification of Data Authenticity vulnerability

• CWE-345

<1.3.3 · fixed in 1.3.3

Insufficient Verification of Data Authenticity in Apache InLong

• CWE-345

>=1.4.0, <1.9.0 · fixed in 1.9.0

Insufficient verification of data authenticity in Fortinet FortiAnalyzer

• Fortinet FortiAnalyzer
• CWE-345

BIG-IP Edge Client for macOS vulnerability

• F5 BIG-IP Edge Client
• CWE-345

Openvswitch don't match packets on nd_target field

• openvswitch
• Red Hat Fast Datapath for RHEL 7
• CWE-345

Kubernetes users may update Pod labels to bypass network policy

• CWE-345

<1.12.14 || >=1.13.0, <1.13.7 || >=1.14.0, <1.14.2 · fixed in 1.12.14, 1.13.7, 1.14.2

Composer allows cache poisoning from other projects built on the same host

• CWE-345

<1.0.0 · fixed in 1.0.0

Duplicate Advisory: EVE Doesn't Protect Rootfs

• CWE-345

<0.0.0-20220708121648-5fef4d92e758 · fixed in 0.0.0-20220708121648-5fef4d92e758

sidekiq Denial of Service vulnerability

• Denial of service
• CWE-345

<6.5.10 || >=7.0.0, <7.1.3 · fixed in 6.5.10, 7.1.3

Insufficient verification of data authenticity vulnerability in Delinea Secret Server

• Delinea Secret Server
• CWE-345

ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability

• ManageEngine ADSelfService Plus
• CWE-345

Insufficient verification of data authenticity in Zoom Video Communications, Inc. Zoom Desktop Client for Windows

• Zoom Video Communications, Inc. Zoom Desktop Client for Windows
• CWE-345

BIG-IP Edge Client for Windows and macOS vulnerability

• F5 BIG-IP Edge Client
• CWE-345

Removal of e-Tugra root certificate

• CWE-345

>=2015.4.28, <2023.7.22 · fixed in 2023.7.22

Lack of Dataset Integrity Checking

• Becton Dickinson & Co BD Alarisâ„¢ Guardrailsâ„¢ Editor
• CWE-345

Wireless Card Firmware Improperly Signed

• Becton Dickinson & Co BD Alaris™ Point-of-Care Unit (PCU) Model 8015
• CWE-20
• CWE-345

Controller design flaw - unsigned firmware

• Honeywell C300
• CWE-345

Pipelines do not validate child UIDs

• CWE-345

>=0.35.0, <=0.52.0 · no fixed version yet

Graylog vulnerable to insecure source port usage for DNS queries

• CWE-345

>=5.1.0, <5.1.3 || <5.0.9 · fixed in 5.1.3, 5.0.9

CMS Commander <= 2.287 - Authorization Bypass through Use of Insufficiently Unique Cryptographic Signature

• thoefter CMS Commander – Manage Multiple Sites
• CWE-345

Improper backend communication allows access and manipulation of the telemetry data

• Hangzhou Hopechart IoT Technology Co., Ltd. HQT401
• Authentication bypass
• Weak cryptography or TLS

Wordapp <= 1.6.0 - Authorization Bypass through Use of Insufficiently Unique Cryptographic Signature

• Wordapp
• CWE-345

Jenkins SAML Single Sign On(SSO) Plugin missing hostname validation

• CWE-345
• CWE-346

<2.1.0 · fixed in 2.1.0

AMI MegaRAC SPx12 and SPx13 devices have Insufficient Verification of Data Authenticity.

• CWE-345

BlackVue DR750-2CH LTE v.1.012_2022.10.26 does not employ authenticity check for uploaded firmware.

• CWE-345

Insufficient verification of data authenticity in Pegasystems RPA: Synchronization Engine

• Pegasystems RPA: Synchronization Engine
• CWE-345

Insufficient verification of data authenticity in JetBrains IntelliJ IDEA

• JetBrains IntelliJ IDEA
• CWE-345

Insufficient verification of data authenticity in Schneider Electric IGSS Data Server(IGSSdataServer.exe) and others

• Schneider Electric IGSS Data Server(IGSSdataServer.exe)
• Schneider Electric IGSS Dashboard (DashBoard.exe)
• CWE-345

Insufficient verification of data authenticity in Schneider Electric IGSS Data Server(IGSSdataServer.exe) and others

• Schneider Electric IGSS Data Server(IGSSdataServer.exe)
• Schneider Electric IGSS Dashboard (DashBoard.exe)
• CWE-345

Insufficient verification of data authenticity in Schneider Electric IGSS Data Server(IGSSdataServer.exe) and others

• Schneider Electric IGSS Data Server(IGSSdataServer.exe)
• Schneider Electric IGSS Dashboard (DashBoard.exe)
• CWE-345

Zerocoin libzerocoin Proof CoinSpend.cpp CoinSpend data authenticity

• libzerocoin
• CWE-345

Insufficient user check in FlowTokens by Email stage

• authentik
• CWE-345

Keycloak vulnerable to user impersonation via stolen UUID code

• Authentication bypass
• CWE-345

<21.0.1 · fixed in 21.0.1

Insufficient verification of data authenticity in Samsung Mobile Routine

• Samsung Mobile Routine
• CWE-345

Payment information sent to PayPal not necessarily identical to created order

• CWE-345

<5.4.4 · fixed in 5.4.4

OpenZeppelin Contracts contains Improper Verification of Cryptographic Signature

• Weak cryptography or TLS
• CWE-345

>=0.2.0, <0.6.1 · fixed in 0.6.1

Insufficient verification of data authenticity in Snap One Wattbox WB-300-IP-3

• Snap One Wattbox WB-300-IP-3
• CWE-345

Rumpus - FTP server Improper Token Verification

• Rumpus FTP server
• CWE-345

Insufficient verification of data authenticity in AMD 1st Gen EPYC and others

• AMD 1st Gen EPYC
• AMD 2nd Gen EPYC
• CWE-345

Insufficient verification of data authenticity in AMD 3rd Gen EPYC

• AMD 3rd Gen EPYC
• CWE-345

Insufficient verification of data authenticity in NVIDIA GPU Display Driver for Windows

• NVIDIA GPU Display Driver for Windows
• CWE-345

Improper validation of UUIDs in github.com/codenotary/immudb

• CWE-345

<1.4.1 · fixed in 1.4.1

CodeIgniter4 allows spoofing of IP address when using proxy

• CWE-345

<4.2.11 · fixed in 4.2.11

Insufficient verification of data authenticity in Mozilla Firefox

• Mozilla Firefox
• CWE-345

Insufficient verification of data authenticity in Mozilla Firefox

• Mozilla Firefox
• CWE-345

Insufficient verification of data authenticity in Mozilla Firefox

• Mozilla Firefox
• CWE-345

An issue in Netgear WNR2000 v1 1.2.3.7 and earlier allows authenticated attackers to cause a Denial of Service (DoS) via uploading a crafted firmware image during the firmware update process.

• CWE-345

TP-Link TL-WR940N V4 3.16.9 and earlier allows authenticated attackers to cause a Denial of Service (DoS) via uploading a crafted firmware image during the firmware update process.

• CWE-345

D-Link devices DAP-2310 v2.10rc036 and earlier, DAP-2330 v1.06rc020 and earlier, DAP-2360 v2.10rc050 and earlier, DAP-2553 v3.10rc031 and earlier, DAP-2660 v1.15rc093 and earlier, DAP-2690 v3.20rc106…

• CWE-345

BigBlueButton subject to Ineffective user bans

• bigbluebutton
• CWE-345
• CWE-346

PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow a root privileged attacker to install unsigned packages.

• CWE-345

BigBlueButton contains DoS via failed authToken validation

• bigbluebutton
• CWE-345

RSFirewall < 1.1.25 - IP Block Bypass

• RSFirewall!
• CWE-345

Insufficient verification of data authenticity in Apple iCloud for Windows and others

• Apple iCloud for Windows
• Apple tvOS
• CWE-345

Insufficient verification of data authenticity in Samsung Mobile Samsung Gear IconX PC Manager

• Samsung Mobile Samsung Gear IconX PC Manager
• CWE-345

Certifi removing TrustCor root certificate

• CWE-345

>=2017.11.05, <2022.12.07 · fixed in 2022.12.07