CWE-347 · 799 kayıt
Kriptografik imzanın hatalı doğrulanması
Neden olur?
Doğrulayıcı, hangi algoritmayla doğrulama yapacağını token’ın kendi beyanından alıyor. Güvenilmeyen veri, kendi doğrulama kuralını belirlemiş olur.
Hatalı ve düzeltilmiş kod
Temsili ders örneği. Vurgulu satırlar hatanın ve düzeltmenin yeridir.
Hatalı
const claims = jwt.verify(token, publicKey);Düzeltilmiş
const claims = jwt.verify(token, publicKey, { algorithms: ["RS256"], issuer: "https://kimlik.ornek.com", audience: "portal",});Nasıl önlenir?
- 01Kabul edilen algoritmayı sunucuda sabitleyin.
- 02Veren (iss), hedef (aud) ve süre (exp) alanlarını zorunlu doğrulayın.
- 03Asimetrik ve simetrik doğrulama ailelerini aynı uçta karıştırmayın.
Bu sınıftaki CVE’ler
800 kayıt
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
89Hemen | CVE-2025-59718Silahlaştırılmış | A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, Fortifortinet · fortiproxy · CWE-347 | Kritik9,8 | KEV | %68,3 | 9 Ara 2025 |
73Bu hafta | CVE-2020-1464Silahlaştırılmış | Windows Spoofing Vulnerabilitymicrosoft · windows 10 1507 · CWE-347 | Yüksek7,8 | KEV | %38,9 | 17 Ağu 2020 |
71Bu hafta | CVE-2020-2021Silahlaştırılmış | PAN-OS: Authentication Bypass in SAML Authenticationpaloaltonetworks · pan-os · CWE-347 | Kritik10,0 | KEV | %4,4 | 29 Haz 2020 |
70Bu hafta | CVE-2026-48558Silahlaştırılmış | SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verificationsimple-help · simplehelp · CWE-347 | Kritik9,5 | KEV | %5,7 | 12 Haz 2026 |
70Bu hafta | CVE-2026-5430Silahlaştırılmış | Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeoverwso2 · api control plane · CWE-347 | Kritik10,0 | KEV | %0,6 | 6 Ağu 2026 |
65Bu hafta | CVE-2013-3900Silahlaştırılmış | WinVerifyTrust Signature Validation Vulnerabilitymicrosoft · windows 10 1507 · CWE-347 | Orta5,5 | KEV | %44,6 | 10 Ara 2013 |
57Planlayın | CVE-2025-25292İstismar yok | Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)omniauth · omniauth saml · CWE-347 | Kritik9,3 | — | %65,1 | 12 Mar 2025 |
55Planlayın | CVE-2021-22160İstismar yok | Authentication with JWT allows use of “none”-algorithmapache · pulsar · CWE-347 | Kritik9,8 | — | %52,9 | 26 May 2021 |
51Planlayın | CVE-2018-16042İstismar yok | Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earadobe · acrobat dc · CWE-347 | Orta6,5 | — | %82,4 | 18 Oca 2019 |
49Planlayın | CVE-2025-47827Silahlaştırılmış | In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature.igel · igel os · CWE-347 | Orta4,6 | KEV | %4,9 | 5 Haz 2025 |
48Planlayın | CVE-2025-59719İstismar yok | An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 tfortinet · fortiweb · CWE-347 | Kritik9,8 | — | %29,2 | 9 Ara 2025 |
46Planlayın | CVE-2024-9487Kavram kanıtı | An Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassedgithub · enterprise server · CWE-347 | Kritik9,5 | — | %25,6 | 10 Eki 2024 |
43Planlayın | CVE-2018-0114Kavram kanıtı | A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens ucisco · node-jose · CWE-347 | Yüksek7,5 | — | %42,7 | 4 Oca 2018 |
43Planlayın | CVE-2025-25291Kavram kanıtı | ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)omniauth · omniauth saml · CWE-347 | Kritik9,3 | — | %20,6 | 12 Mar 2025 |
42Planlayın | CVE-2024-45409Kavram kanıtı | The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selectoronelogin · ruby-saml · CWE-347 | Kritik9,8 | — | %10,7 | 10 Eyl 2024 |
41Planlayın | CVE-2021-37160İstismar yok | A firmware validation issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of softwarswisslog-healthcare · hmi-3 control panel firmware · CWE-347 | Kritik9,8 | — | %8,2 | 2 Ağu 2021 |
41Planlayın | CVE-2021-33885İstismar yok | An Insufficient Verification of Data Authenticity vulnerability in B.bbraun · spacecom2 · CWE-347 | Kritik9,8 | — | %5,6 | 25 Ağu 2021 |
40Planlayın | CVE-2025-29775Kavram kanıtı | xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Commentnode-saml · xml-crypto · CWE-347 | Kritik9,3 | — | %9,5 | 14 Mar 2025 |
40Planlayın | CVE-2025-29774Kavram kanıtı | xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo Referencesnode-saml · xml-crypto · CWE-347 | Kritik9,3 | — | %9,1 | 14 Mar 2025 |
40Planlayın | CVE-2018-12356İstismar yok | An issue was discovered in password-store.sh in pass in Simple Password Store 1.7.x before 1.7.2.simple password store project · simple password store · CWE-347 | Kritik9,8 | — | %4,6 | 14 Haz 2018 |
40Planlayın | CVE-2018-8955İstismar yok | The installer for BitDefender GravityZone relies on an encoded string in a filename to determine the URL for installation metadata, which albitdefender · gravityzone · CWE-347 | Kritik9,8 | — | %4,3 | 24 Eki 2018 |
40Planlayın | CVE-2018-1000076İstismar yok | RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 seriesrubygems · rubygems · CWE-347 | Kritik9,8 | — | %2,9 | 13 Mar 2018 |
40Planlayın | CVE-2019-6318İstismar yok | HP LaserJet Enterprise printers, HP PageWide Enterprise printers, HP LaserJet Managed printers, HP Officejet Enterprise printers have an inshp · color laserjet cm4540 mfp firmware · CWE-347 | Kritik9,8 | — | %2,6 | 11 Nis 2019 |
40Planlayın | CVE-2018-5923İstismar yok | In HP LaserJet Enterprise, HP PageWide Enterprise, HP LaserJet Managed, and HP OfficeJet Enterprise Printers, solution application signaturehp · color laserjet cm4540 mfp firmware · CWE-347 | Kritik9,8 | — | %2,6 | 27 Mar 2019 |
40Planlayın | CVE-2021-37927İstismar yok | Zoho ManageEngine ADManager Plus version 7110 and prior allows account takeover via SSO.zohocorp · manageengine admanager plus · CWE-347 | Kritik9,8 | — | %2,2 | 22 Eyl 2021 |
- CVE-2025-5971889Hemen
A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, Forti
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %68fortinet · fortiproxy9 Ara 2025
- CVE-2020-146473Bu hafta
Windows Spoofing Vulnerability
YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %39microsoft · windows 10 150717 Ağu 2020
- CVE-2020-202171Bu hafta
PAN-OS: Authentication Bypass in SAML Authentication
KritikCVSS 10,0KEVSilahlaştırılmışEPSS %4paloaltonetworks · pan-os29 Haz 2020
- CVE-2026-4855870Bu hafta
SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification
KritikCVSS 9,5KEVSilahlaştırılmışEPSS %6simple-help · simplehelp12 Haz 2026
- CVE-2026-543070Bu hafta
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
KritikCVSS 10,0KEVSilahlaştırılmışEPSS %1wso2 · api control plane6 Ağu 2026
- CVE-2013-390065Bu hafta
WinVerifyTrust Signature Validation Vulnerability
OrtaCVSS 5,5KEVSilahlaştırılmışEPSS %45microsoft · windows 10 150710 Ara 2013
- CVE-2025-2529257Planlayın
Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)
KritikCVSS 9,3İstismar yokEPSS %65omniauth · omniauth saml12 Mar 2025
- CVE-2021-2216055Planlayın
Authentication with JWT allows use of “none”-algorithm
KritikCVSS 9,8İstismar yokEPSS %53apache · pulsar26 May 2021
- CVE-2018-1604251Planlayın
Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and ear
OrtaCVSS 6,5İstismar yokEPSS %82adobe · acrobat dc18 Oca 2019
- CVE-2025-4782749Planlayın
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature.
OrtaCVSS 4,6KEVSilahlaştırılmışEPSS %5igel · igel os5 Haz 2025
- CVE-2025-5971948Planlayın
An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 t
KritikCVSS 9,8İstismar yokEPSS %29fortinet · fortiweb9 Ara 2025
- CVE-2024-948746Planlayın
An Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed
KritikCVSS 9,5Kavram kanıtıEPSS %26github · enterprise server10 Eki 2024
- CVE-2018-011443Planlayın
A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens u
YüksekCVSS 7,5Kavram kanıtıEPSS %43cisco · node-jose4 Oca 2018
- CVE-2025-2529143Planlayın
ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)
KritikCVSS 9,3Kavram kanıtıEPSS %21omniauth · omniauth saml12 Mar 2025
- CVE-2024-4540942Planlayın
The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector
KritikCVSS 9,8Kavram kanıtıEPSS %11onelogin · ruby-saml10 Eyl 2024
- CVE-2021-3716041Planlayın
A firmware validation issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of softwar
KritikCVSS 9,8İstismar yokEPSS %8swisslog-healthcare · hmi-3 control panel firmware2 Ağu 2021
- CVE-2021-3388541Planlayın
An Insufficient Verification of Data Authenticity vulnerability in B.
KritikCVSS 9,8İstismar yokEPSS %6bbraun · spacecom225 Ağu 2021
- CVE-2025-2977540Planlayın
xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment
KritikCVSS 9,3Kavram kanıtıEPSS %10node-saml · xml-crypto14 Mar 2025
- CVE-2025-2977440Planlayın
xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References
KritikCVSS 9,3Kavram kanıtıEPSS %9node-saml · xml-crypto14 Mar 2025
- CVE-2018-1235640Planlayın
An issue was discovered in password-store.sh in pass in Simple Password Store 1.7.x before 1.7.2.
KritikCVSS 9,8İstismar yokEPSS %5simple password store project · simple password store14 Haz 2018
- CVE-2018-895540Planlayın
The installer for BitDefender GravityZone relies on an encoded string in a filename to determine the URL for installation metadata, which al
KritikCVSS 9,8İstismar yokEPSS %4bitdefender · gravityzone24 Eki 2018
- CVE-2018-100007640Planlayın
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series
KritikCVSS 9,8İstismar yokEPSS %3rubygems · rubygems13 Mar 2018
- CVE-2019-631840Planlayın
HP LaserJet Enterprise printers, HP PageWide Enterprise printers, HP LaserJet Managed printers, HP Officejet Enterprise printers have an ins
KritikCVSS 9,8İstismar yokEPSS %3hp · color laserjet cm4540 mfp firmware11 Nis 2019
- CVE-2018-592340Planlayın
In HP LaserJet Enterprise, HP PageWide Enterprise, HP LaserJet Managed, and HP OfficeJet Enterprise Printers, solution application signature
KritikCVSS 9,8İstismar yokEPSS %3hp · color laserjet cm4540 mfp firmware27 Mar 2019
- CVE-2021-3792740Planlayın
Zoho ManageEngine ADManager Plus version 7110 and prior allows account takeover via SSO.
KritikCVSS 9,8İstismar yokEPSS %2zohocorp · manageengine admanager plus22 Eyl 2021