CWE-354.

Bouncy Castle LTS native GCM chunking can cause bad-tag exception on decryption

• CWE-354
• CWE-1068

>=2.73.0, <2.73.11 · fixed in 2.73.11

Zebra's Transparent SIGHASH_SINGLE Handling Diverges from zcashd for Corresponding Outputs

• Weak cryptography or TLS
• CWE-354

<4.4.0 · fixed in 4.4.0

crypto: krb5enc - fix async decrypt skipping hash verification

• Linux kernel
• CWE-354

Lockfile checksums not verified in Hex allows dependency integrity bypass

• hex
• CWE-354
• CWE-494

xrdp: RDP MAC signature (dataSignature) never verified on receive — integrity bypass in non-TLS mode

• neutrinolabs xrdp
• CWE-354

SP1 V6 Recursion Circuit Row-Count Binding Gap

• CWE-345
• CWE-354

>=6.0.0, <6.1.0 · fixed in 6.1.0

wolfSSL EVP ChaCha20-Poly1305 AEAD authentication tag

• wolfSSL
• CWE-354

PKCS7 CBC Padding Oracle — Plaintext Recovery

• wolfSSL
• CWE-354

Lack of Dynamic Library Validation in SzafirHost

• Krajowa Izba Rozliczeniowa SzafirHost
• CWE-354

nginx-ui Backup Restore Allows Tampering with Encrypted Backups

• Information disclosure
• Weak cryptography or TLS

<1.9.10-0.20260315015203-f61bcec547c0 · fixed in 1.9.10-0.20260315015203-f61bcec547c0

Incus does not verify combined fingerprint when downloading images from simplestreams servers

• Weak cryptography or TLS
• CWE-354

<6.23.0 · fixed in 6.23.0

Cryptomator for Android: Tampered vault configuration allows MITM attack on Hub API

• cryptomator android
• CWE-346
• CWE-354

Cryptomator for IOS: Tampered vault configuration allows MITM attack on Hub API

• cryptomator ios
• CWE-346
• CWE-354

Cryptomator: Tampered vault configuration allows MITM attack on Hub API

• cryptomator
• CWE-346
• CWE-354

Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding

• CWE-325
• CWE-354

<1.6.9 · fixed in 1.6.9

simplesamlphp/xml-security: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption

• CWE-354

<1.13.9 || >=2.0.0, <2.3.1 · fixed in 1.13.9, 2.3.1

xmlseclibs: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption

• CWE-354

<3.1.5 · fixed in 3.1.5

Striae has a hash validation utility vulnerability

• Weak cryptography or TLS
• CWE-353

>=0.9.22-0, <3.0.0 · fixed in 3.0.0

nimiq/core-rs-albatross's nimiq-blockchain missing proposal body root verification

• nimiq core-rs-albatross
• CWE-354

Improper Digest Verification in httpsig-hyper May Allow Message Integrity Bypass

• CWE-354
• CWE-697

<0.0.23 · fixed in 0.0.23

rPGP's integrity protection of encrypted data was not always checked

• CWE-354

>=0.16.0-alpha.0, <0.19.0 · fixed in 0.19.0

cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

• CWE-345
• CWE-354

<46.0.5 · fixed in 46.0.5

go-git improperly verifies data integrity values for .idx and .pack files

• CWE-354

<5.16.5 · fixed in 5.16.5

Improper Validation of Integrity Check Value vulnerability in Sharp Display Solutions projectors allows a attacker may create and run unauthorized firmware.

• Sharp Display Solutions, Ltd. NP-P502HL-2, NP-P502WL-2, NP-P502HLG-2, NP-P502WLG, NP-P502H, NP-P502W, NP-P452H, NP-P452W, NP-P502HG, NP-P502WG, NP-P452HG, NP-P452WG, NP-P502H+, NP-P502W+, NP-CR5450H, NP-CR5450W, NP-P502HL, NP-P502WL, NP-P502HLG, NP-P502WLG, NP-P502HL+, NP-P502WL+, NP-CR5450HL, NP-CR5450WL, NP-UM352W, NP-UM352WG, NP-UM352W+
• CWE-354

NVIDIA DGX Spark: NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware…

• NVIDIA DGX Spark
• CWE-354

Prisma Browser: Insufficient Validation of Untrusted Input Vulnerability in Prisma Browser

• Palo Alto Networks Prisma Browser
• CWE-354

Protobuf Maven Plugin protocDigest is ignored when using protoc from PATH

• CWE-354
• CWE-693

>=4.0.0, <4.0.2 || <3.10.2 · fixed in 4.0.2, 3.10.2

MantisBT lacks verification when changing a user's email address

• Information disclosure
• CWE-345

<2.27.2 · fixed in 2.27.2

Netskope Client Configuration Tampering with Local MITM

• Netskope Client
• CWE-354

JWE is missing AES-GCM authentication tag validation in encrypted JWE

• CWE-354

<1.1.1 · fixed in 1.1.1

Comodo Internet Security Premium Manifest File cis_update_x64.xml integrity check

• Comodo Internet Security Premium
• CWE-345
• CWE-354

electron ASAR Integrity bypass by just modifying the content

• CWE-354

>=30.0.0-alpha.1, <30.0.5 || >=31.0.0-alpha.1, <31.0.0-beta.1 · fixed in 30.0.5, 31.0.0-beta.1

A vulnerability exists in the IEC 61850 of the MicroSCADA X SYS600 product.

• Hitachi Energy MicroSCADA X SYS600
• CWE-354

AVEVA PI Connector for CygNet Improper Validation of Integrity Check Value

• AVEVA PI Connector for CygNet
• CWE-354

Forminator <= 1.42.0 - Order Replay Vulnerability

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• CWE-354

Contact Form 7 <= 6.0.5 - Order Replay Vulnerability

• rocklobsterinc Contact Form 7
• CWE-354

This issue was addressed with improved handling of executable types.

• Apple macOS
• CWE-354

Fortinet FortiNDR: An improper validation of integrity check value vulnerability [CWE-354] in FortiNDR…

• Fortinet FortiNDR
• CWE-354

TXOne Networks StellarProtect (Legacy Mode), StellarEnforce, and Safe Lock Improper Validation of Integrity Check Value Vulnerability

• TXOne Networks StellarProtect (Legacy Mode)
• TXOne Networks StellarEnforce
• CWE-354

vLLM uses Python 3.12 built-in hash() which leads to predictable hash collisions in prefix cache

• CWE-354

<0.7.2 · fixed in 0.7.2

A firmware downgrade prevention vulnerability has been identified in newer Lexmark devices.

• Lexmark Printer Firmware
• CWE-354
• CWE-1328

Lodestar snappy checksum issue

• CWE-354

<1.25.0 · fixed in 1.25.0

There is an insufficient integrity vulnerability in Huawei products.

• Huawei Myna
• CWE-354

A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0.

• CWE-354

An issue in TOTOLINK Bluetooth Wireless Adapter A600UB allows a local attacker to execute arbitrary code via the WifiAutoInstallDriver.exe and MSASN1.dll components.

• CWE-354

Rebuilding a run with revoked script approval allowed by Jenkins Pipeline: Groovy Plugin

• Broken access control
• CWE-354

<3993.v3e20a · fixed in 3993.v3e20a

2N Access Commander: In 2N Access Commander versions 3.1.1.2 and prior…

• 2N Access Commander
• CWE-354

secp256k1-node allows private key extraction over ECDH

• Information disclosure
• CWE-354

<3.8.1 || >=4.0.0, <4.0.4 || >=5.0.0, <5.0.1 · fixed in 3.8.1, 4.0.4, 5.0.1

OpenStack Ironic fails to verify checksums of supplied image_source URLs

• CWE-354

<=21.4.3 || >=22.0.0, <23.0.3 || >=23.1.0, <24.1.3 || >=25.0.0, <26.1.1 · fixed in 23.0.3, 24.1.3, 26.1.1

Unauthorized Transaction Manipulation Vulnerability

• Apex Softcell LD Geo
• CWE-354

Parameter Tampering Vulnerability

• Reedos Software Solutions Mutual Fund Distribution Product (aiM-Star)
• CWE-354

Apache MINA SSHD: integrity check bypass

• CWE-354

<2.12.0 · fixed in 2.12.0

Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR10 fails to validate /etc/mtab during the Pre-Boot Authorization (PBA) process.

• CWE-354

An issue was discovered in Samsung Mobile Processor EExynos 2200, Exynos 1480, Exynos 2400.

• CWE-354

MCUboot Injection attack of unprotected TLV values in github.com/mcu-tools/mcuboot

• CWE-354

* · no fixed version yet

github.com/containers/image allows unexpected authenticated registry accesses

• CWE-354

<5.30.1 · fixed in 5.30.1

Hoppscotch Extension responds to calls made by origins not in the domain list

• hoppscotch-extension
• CWE-354

ZCC Mac validinstaller file integrity check missing

• Zscaler Client Connector
• CWE-354

ZCC macOS Upgrade ZIP Bomb DoS

• Zscaler Client Connector
• CWE-354

Repair App local code execution with arbitrary privileges

• Zscaler Client Connector
• CWE-354