← Back
CWE-345

747 CVEs • Abstraction: Class

Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

JSON object

Loading...

CVEs (747)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2015-0259
1Openstack
1Nova
May 6, 2026
Apr 1, 2015
N/A· v4
N/A· v3
5.1 MEDIUM· v2
OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for acces...Show more
OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.Show less
CVE-2014-8165
1Powerpc Utils Project
1Powerpc Utils
May 6, 2026
Feb 19, 2015
N/A· v4
N/A· v3
10.0 HIGH· v2
scripts/amsvis/powerpcAMS/amsnet.py in powerpc-utils-python uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.
CVE-2014-9194
1Arbiter
11094b Gps Substation Clock
May 6, 2026
Jan 17, 2015
N/A· v4
N/A· v3
7.8 HIGH· v2
Arbiter 1094B GPS Substation Clock allows remote attackers to cause a denial of service (disruption) via crafted radio transmissions that spoof GPS satellite broadcasts.
CVE-2014-4936
1Malwarebytes
2Malwarebytes Anti Exploit
Malwarebytes Anti Malware
May 6, 2026
Dec 16, 2014
N/A· v4
N/A· v3
9.3 HIGH· v2
The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.1012 and earlier allow man-in-the-middle attackers to execute arbitrary code by spo...Show more
The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.1012 and earlier allow man-in-the-middle attackers to execute arbitrary code by spoofing the update server and uploading an executable.Show less
CVE-2014-4883
1Lwip Project
1Lwip
May 6, 2026
Nov 28, 2014
N/A· v4
N/A· v3
4.3 MEDIUM· v2
resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and source ports of DNS query packets, which makes it easier for man-in-the-middle at...Show more
resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and source ports of DNS query packets, which makes it easier for man-in-the-middle attackers to conduct cache-poisoning attacks via spoofed reply packets.Show less
CVE-2014-2718
2Asus
T Mobile
2Rt Series Firmware
Tm Ac1900
May 6, 2026
Nov 4, 2014
N/A· v4
N/A· v3
7.1 HIGH· v2
ASUS RT-AC68U, RT-AC66R, RT-AC66U, RT-AC56R, RT-AC56U, RT-N66R, RT-N66U, RT-N56R, RT-N56U, and possibly other RT-series routers before firmware 3.0.0.4.376.x do not verify the integrity of firmware (1) update information...Show more
ASUS RT-AC68U, RT-AC66R, RT-AC66U, RT-AC56R, RT-AC56U, RT-N66R, RT-N66U, RT-N56R, RT-N56U, and possibly other RT-series routers before firmware 3.0.0.4.376.x do not verify the integrity of firmware (1) update information or (2) downloaded updates, which allows man-in-the-middle (MITM) attackers to execute arbitrary code via a crafted image.Show less
CVE-2014-0364
1Igniterealtime
1Smack
May 6, 2026
Apr 30, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute...Show more
The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute.Show less