CWE-345 · 724 записей
Insufficient Verification of Data Authenticity
CVE этого класса
732 записей
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
91Срочно | CVE-2023-38831Готовый эксплойт | RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive.rarlab · winrar · CWE-345 | Высокая7,8 | KEV | 99,8 % | 23 авг. 2023 г. |
75На этой неделе | CVE-2022-26871Готовый эксплойт | An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary filtrendmicro · apex central · CWE-345 | Критическая9,8 | KEV | 19,5 % | 29 мар. 2022 г. |
58В плане | CVE-2016-4553Эксплойта нет | client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which alcanonical · ubuntu linux · CWE-345 | Высокая8,6 | — | 80,0 % | 10 мая 2016 г. |
46В плане | CVE-2016-4554Эксплойта нет | mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisonioracle · linux · CWE-345 | Высокая8,6 | — | 38,9 % | 10 мая 2016 г. |
42В плане | CVE-2014-4936Готовый эксплойт | The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.101malwarebytes · malwarebytes anti-exploit · CWE-345 | Критическая9,3 | — | 16,8 % | 16 дек. 2014 г. |
41В плане | CVE-2014-8165Эксплойта нет | scripts/amsvis/powerpcAMS/amsnet.py in powerpc-utils-python uses the pickle Python module unsafely, which allows remote attackers to executepowerpc-utils project · powerpc-utils · CWE-345 | Критическая10,0 | — | 2,8 % | 19 февр. 2015 г. |
40В плане | CVE-2019-11235Эксплойта нет | FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group efreeradius · freeradius · CWE-345 | Критическая9,8 | — | 3,6 % | 22 апр. 2019 г. |
40В плане | CVE-2020-28900Эксплойта нет | Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of Pnagios · fusion · CWE-345 | Критическая9,8 | — | 3,1 % | 24 мая 2021 г. |
40В плане | CVE-2018-19971Эксплойта нет | JFrog Artifactory Pro 6.5.9 has Incorrect Access Control.jfrog · artifactory · CWE-345 | Критическая9,8 | — | 3,0 % | 16 апр. 2019 г. |
40В плане | CVE-2021-43616Proof of concept | The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differnpmjs · npm · CWE-345 | Критическая9,8 | — | 2,7 % | 13 нояб. 2021 г. |
40В плане | CVE-2021-37421Эксплойта нет | Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass.zohocorp · manageengine adselfservice plus · CWE-345 | Критическая9,8 | — | 2,5 % | 30 авг. 2021 г. |
40В плане | CVE-2013-2167Эксплойта нет | python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypassopenstack · python-keystoneclient · CWE-345 | Критическая9,8 | — | 2,0 % | 10 дек. 2019 г. |
40В плане | CVE-2022-22994Эксплойта нет | Insufficient Verification of Data Authenticity Remote Code Execution Vulnerability on Western Digital My Cloud devices.westerndigital · my cloud os · CWE-345 | Критическая9,8 | — | 1,9 % | 28 янв. 2022 г. |
40В плане | CVE-2026-47691Эксплойта нет | Netty has Insufficient Bailiwick Validation for NS Recordsnetty · netty · CWE-345 | Критическая10,0 | — | 0,4 % | 12 июн. 2026 г. |
40В плане | CVE-2022-3703Эксплойта нет | ETIC Telecom Remote Access Server Insufficient Verification of Data Authenticityetictelecom · remote access server firmware · CWE-345 | Критическая10,0 | — | 0,3 % | 10 нояб. 2022 г. |
40В плане | CVE-2026-45674Proof of concept | Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Recordsnetty · netty · CWE-345 | Критическая10,0 | — | 0,3 % | 12 июн. 2026 г. |
39Наблюдать | CVE-2017-3198Эксплойта нет | GIGABYTE BRIX UEFI firmware is not cryptographically signedgigabyte · gb-bsi7h-6500 firmware · CWE-345 | Критическая9,8 | — | 1,6 % | 9 июл. 2018 г. |
39Наблюдать | CVE-2022-31800Эксплойта нет | Insufficient Verification of Data Vulnerability in PHOENIX CONTACT classic line industrial controllersphoenixcontact · axc 1050 firmware · CWE-345 | Критическая9,8 | — | 1,6 % | 21 июн. 2022 г. |
39Наблюдать | CVE-2022-25262Proof of concept | In JetBrains Hub before 2022.1.14434, SAML request takeover was possible.jetbrains · hub · CWE-345 | Критическая9,8 | — | 1,4 % | 25 февр. 2022 г. |
39Наблюдать | CVE-2020-14115Эксплойта нет | A command injection vulnerability exists in the Xiaomi Router AX3600.mi · ax3600 firmware · CWE-345 | Критическая9,8 | — | 1,1 % | 10 мар. 2022 г. |
39Наблюдать | CVE-2022-31801Эксплойта нет | Insufficient Verification of Data Vulnerability in ProConOS/ProConOS eCLR SDK and MULTIPROG Engineering toolphoenixcontact · multiprog · CWE-345 | Критическая9,8 | — | 1,1 % | 21 июн. 2022 г. |
39Наблюдать | CVE-2022-30315Эксплойта нет | Honeywell Experion PKS Safety Manager (SM and FSC) through 2022-05-06 has Insufficient Verification of Data Authenticity.honeywell · safety manager firmware · CWE-345 | Критическая9,8 | — | 1,0 % | 28 июл. 2022 г. |
39Наблюдать | CVE-2015-3956Эксплойта нет | Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, versionpifzer · plum a\+ infusion system firmware · CWE-345 | Критическая9,8 | — | 1,0 % | 25 мар. 2019 г. |
39Наблюдать | CVE-2019-18835Эксплойта нет | Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs.matrix · synapse · CWE-345 | Критическая9,8 | — | 0,9 % | 7 нояб. 2019 г. |
39Наблюдать | CVE-2019-6695Эксплойта нет | Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below may allow an attacker tfortinet · fortimanager · CWE-345 | Критическая9,8 | — | 0,8 % | 23 авг. 2019 г. |
- CVE-2023-3883191Срочно
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive.
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 100 %rarlab · winrar23 авг. 2023 г.
- CVE-2022-2687175На этой неделе
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary fil
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 19 %trendmicro · apex central29 мар. 2022 г.
- CVE-2016-455358В плане
client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which al
ВысокаяCVSS 8,6Эксплойта нетEPSS 80 %canonical · ubuntu linux10 мая 2016 г.
- CVE-2016-455446В плане
mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoni
ВысокаяCVSS 8,6Эксплойта нетEPSS 39 %oracle · linux10 мая 2016 г.
- CVE-2014-493642В плане
The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.101
КритическаяCVSS 9,3Готовый эксплойтEPSS 17 %malwarebytes · malwarebytes anti-exploit16 дек. 2014 г.
- CVE-2014-816541В плане
scripts/amsvis/powerpcAMS/amsnet.py in powerpc-utils-python uses the pickle Python module unsafely, which allows remote attackers to execute
КритическаяCVSS 10,0Эксплойта нетEPSS 3 %powerpc-utils project · powerpc-utils19 февр. 2015 г.
- CVE-2019-1123540В плане
FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group e
КритическаяCVSS 9,8Эксплойта нетEPSS 4 %freeradius · freeradius22 апр. 2019 г.
- CVE-2020-2890040В плане
Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of P
КритическаяCVSS 9,8Эксплойта нетEPSS 3 %nagios · fusion24 мая 2021 г.
- CVE-2018-1997140В плане
JFrog Artifactory Pro 6.5.9 has Incorrect Access Control.
КритическаяCVSS 9,8Эксплойта нетEPSS 3 %jfrog · artifactory16 апр. 2019 г.
- CVE-2021-4361640В плане
The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differ
КритическаяCVSS 9,8Proof of conceptEPSS 3 %npmjs · npm13 нояб. 2021 г.
- CVE-2021-3742140В плане
Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass.
КритическаяCVSS 9,8Эксплойта нетEPSS 2 %zohocorp · manageengine adselfservice plus30 авг. 2021 г.
- CVE-2013-216740В плане
python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass
КритическаяCVSS 9,8Эксплойта нетEPSS 2 %openstack · python-keystoneclient10 дек. 2019 г.
- CVE-2022-2299440В плане
Insufficient Verification of Data Authenticity Remote Code Execution Vulnerability on Western Digital My Cloud devices.
КритическаяCVSS 9,8Эксплойта нетEPSS 2 %westerndigital · my cloud os28 янв. 2022 г.
- CVE-2026-4769140В плане
Netty has Insufficient Bailiwick Validation for NS Records
КритическаяCVSS 10,0Эксплойта нетEPSS 0 %netty · netty12 июн. 2026 г.
- CVE-2022-370340В плане
ETIC Telecom Remote Access Server Insufficient Verification of Data Authenticity
КритическаяCVSS 10,0Эксплойта нетEPSS 0 %etictelecom · remote access server firmware10 нояб. 2022 г.
- CVE-2026-4567440В плане
Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records
КритическаяCVSS 10,0Proof of conceptEPSS 0 %netty · netty12 июн. 2026 г.
- CVE-2017-319839Наблюдать
GIGABYTE BRIX UEFI firmware is not cryptographically signed
КритическаяCVSS 9,8Эксплойта нетEPSS 2 %gigabyte · gb-bsi7h-6500 firmware9 июл. 2018 г.
- CVE-2022-3180039Наблюдать
Insufficient Verification of Data Vulnerability in PHOENIX CONTACT classic line industrial controllers
КритическаяCVSS 9,8Эксплойта нетEPSS 2 %phoenixcontact · axc 1050 firmware21 июн. 2022 г.
- CVE-2022-2526239Наблюдать
In JetBrains Hub before 2022.1.14434, SAML request takeover was possible.
КритическаяCVSS 9,8Proof of conceptEPSS 1 %jetbrains · hub25 февр. 2022 г.
- CVE-2020-1411539Наблюдать
A command injection vulnerability exists in the Xiaomi Router AX3600.
КритическаяCVSS 9,8Эксплойта нетEPSS 1 %mi · ax3600 firmware10 мар. 2022 г.
- CVE-2022-3180139Наблюдать
Insufficient Verification of Data Vulnerability in ProConOS/ProConOS eCLR SDK and MULTIPROG Engineering tool
КритическаяCVSS 9,8Эксплойта нетEPSS 1 %phoenixcontact · multiprog21 июн. 2022 г.
- CVE-2022-3031539Наблюдать
Honeywell Experion PKS Safety Manager (SM and FSC) through 2022-05-06 has Insufficient Verification of Data Authenticity.
КритическаяCVSS 9,8Эксплойта нетEPSS 1 %honeywell · safety manager firmware28 июл. 2022 г.
- CVE-2015-395639Наблюдать
Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version
КритическаяCVSS 9,8Эксплойта нетEPSS 1 %pifzer · plum a\+ infusion system firmware25 мар. 2019 г.
- CVE-2019-1883539Наблюдать
Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs.
КритическаяCVSS 9,8Эксплойта нетEPSS 1 %matrix · synapse7 нояб. 2019 г.
- CVE-2019-669539Наблюдать
Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below may allow an attacker t
КритическаяCVSS 9,8Эксплойта нетEPSS 1 %fortinet · fortimanager23 авг. 2019 г.