CWE-345 Insufficient Verification of Data Authenticity
classThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (1286)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-38831US | high7.8 | KEV | ||
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may inc… | ||||
| CVE-2022-40139US | high7.2 | KEV | ||
Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administra… | ||||
| CVE-2022-26871US | critical9.8 | KEV | ||
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execut… | ||||
| CVE-2019-5591US | medium6.5 | KEV | ||
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server. | ||||
| CVE-2023-48795US | medium5.9 | Exploit | ||
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packet… | ||||
| CVE-2016-4553US | high8.6 | — | ||
client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-p… | ||||
| CVE-2007-1644US | high10.0 | Exploit | ||
The dynamic DNS update mechanism in the DNS Server service on Microsoft Windows does not properly authenticate clients in certain deployments or configurations, which allows remote… | ||||
| CVE-2006-0988US | high7.8 | Exploit | ||
The default configuration of the DNS Server service on Windows Server 2003 and Windows 2000, and the Microsoft DNS Server service on Windows NT 4.0, allows recursive queries and pr… | ||||
| CVE-2006-3280US | high7.5 | Exploit | ||
Cross-domain vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to access restricted information from other domains via an object tag with a data parameter th… | ||||
| CVE-2000-1221US | high10.0 | Exploit | ||
The line printer daemon (lpd) in the lpr package in multiple Linux operating systems authenticates by comparing the reverse-resolved hostname of the local machine to the hostname o… | ||||
| CVE-2014-4936US | high9.3 | Exploit | ||
The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.1012 and earlier allow man-in-the-middle at… | ||||
| CVE-1999-0730US | high10.0 | Exploit | ||
The zsoelim program in the Debian man-db package allows local users to overwrite files via a symlink attack. | ||||
| CVE-2026-45674US | critical10.0 | Exploit | ||
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to valid… | ||||
| CVE-2022-31813US | critical9.8 | Exploit | ||
Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to b… | ||||
| CVE-2022-25262US | critical9.8 | Exploit | ||
In JetBrains Hub before 2022.1.14434, SAML request takeover was possible. | ||||
| CVE-2021-43616US | critical9.8 | Exploit | ||
The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is in… | ||||
| CVE-2008-1454US | high9.4 | — | ||
Unspecified vulnerability in Microsoft DNS in Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008 allows remote attackers to conduct cache poisoning attacks via unknown vect… | ||||
| CVE-2006-0987US | medium5.0 | Exploit | ||
The default configuration of ISC BIND before 9.4.1-P1, when configured as a caching name server, allows recursive queries and provides additional delegation information to arbitrar… | ||||
| CVE-2026-39324US | critical9.8 | Exploit | ||
Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secret… | ||||
| CVE-2016-4554US | high8.6 | — | ||
mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crafted HTTP Host heade… | ||||
04
attack patterns (12)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan