CWE-345 Insufficient Verification of Data Authenticity
classThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (1286)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-38831US | high7.8 | KEV | ||
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may inc… | ||||
| CVE-2022-40139US | high7.2 | KEV | ||
Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administra… | ||||
| CVE-2022-26871US | critical9.8 | KEV | ||
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execut… | ||||
| CVE-2019-5591US | medium6.5 | KEV | ||
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server. | ||||
| CVE-2023-48795US | medium5.9 | Exploit | ||
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packet… | ||||
| CVE-2016-4553US | high8.6 | — | ||
client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-p… | ||||
| CVE-2007-1644US | high10.0 | Exploit | ||
The dynamic DNS update mechanism in the DNS Server service on Microsoft Windows does not properly authenticate clients in certain deployments or configurations, which allows remote… | ||||
| CVE-2006-0988US | high7.8 | Exploit | ||
The default configuration of the DNS Server service on Windows Server 2003 and Windows 2000, and the Microsoft DNS Server service on Windows NT 4.0, allows recursive queries and pr… | ||||
| CVE-2006-3280US | high7.5 | Exploit | ||
Cross-domain vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to access restricted information from other domains via an object tag with a data parameter th… | ||||
| CVE-2000-1221US | high10.0 | Exploit | ||
The line printer daemon (lpd) in the lpr package in multiple Linux operating systems authenticates by comparing the reverse-resolved hostname of the local machine to the hostname o… | ||||
| CVE-2014-4936US | high9.3 | Exploit | ||
The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.1012 and earlier allow man-in-the-middle at… | ||||
| CVE-1999-0730US | high10.0 | Exploit | ||
The zsoelim program in the Debian man-db package allows local users to overwrite files via a symlink attack. | ||||
| CVE-2026-45674US | critical10.0 | Exploit | ||
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to valid… | ||||
| CVE-2022-31813US | critical9.8 | Exploit | ||
Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to b… | ||||
| CVE-2022-25262US | critical9.8 | Exploit | ||
In JetBrains Hub before 2022.1.14434, SAML request takeover was possible. | ||||
| CVE-2021-43616US | critical9.8 | Exploit | ||
The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is in… | ||||
| CVE-2008-1454US | high9.4 | — | ||
Unspecified vulnerability in Microsoft DNS in Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008 allows remote attackers to conduct cache poisoning attacks via unknown vect… | ||||
| CVE-2006-0987US | medium5.0 | Exploit | ||
The default configuration of ISC BIND before 9.4.1-P1, when configured as a caching name server, allows recursive queries and provides additional delegation information to arbitrar… | ||||
| CVE-2026-39324US | critical9.8 | Exploit | ||
Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secret… | ||||
| CVE-2016-4554US | high8.6 | — | ||
mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crafted HTTP Host heade… | ||||
04
Angriffsmuster (12)
CAPEC-Angriffsmuster, die dies ausnutzen.
05
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan