目標達成 すべての支援者に感謝 — 100%達成しました！

目標: 1000 CNY · 調達済み: 1000 CNY

100.0%
コーヒーを一杯おごる

CWE-347 密码学签名的验证不恰当 类漏洞列表 362

CWE-347 密码学签名的验证不恰当 类弱点 362 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-347 属于完整性校验缺失类漏洞，指软件未正确验证数据的加密签名。攻击者常通过篡改数据并伪造签名，实施中间人攻击或注入恶意载荷，从而绕过身份认证或数据完整性检查。开发者应确保对所有关键数据使用强加密算法进行签名验证，严格校验签名有效性，并在验证失败时拒绝处理，以保障数据真实性和系统安全。

MITRE CWE 官方描述
CWE：CWE-347 加密签名验证不当 英文：产品未验证或错误验证数据的加密签名（cryptographic signature）。
常见影响 (1)
Access Control, Integrity, ConfidentialityGain Privileges or Assume Identity, Modify Application Data, Execute Unauthorized Code or Commands
An attacker could gain access to sensitive data and possibly execute unauthorized code.
代码示例 (1)
In the following code, a JarFile object is created from a downloaded file.
File f = new File(downloadedFilePath); JarFile jf = new JarFile(f);
Bad · Java
CVE IDタイトルCVSS深刻度公開日
CVE-2026-23518 Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment — fleet 9.4AICriticalAI2026-01-21
CVE-2025-36418 Multiple vulnerabilities found in IBM ApplinX. — ApplinX 7.3 High2026-01-20
CVE-2025-12007 Supermicro BMC firmware update validation bypass — X13SEM-F 6.2 -2026-01-16
CVE-2025-12006 Supermicro BMC firmware update validation bypass — X12STW-F 7.2 High2026-01-16
CVE-2026-22817 JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass — hono 8.2 High2026-01-13
CVE-2026-22818 JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback) — hono 8.2 High2026-01-13
CVE-2025-68925 Jervis has a JWT Algorithm Confusion Vulnerability — jervis 9.8AICriticalAI2026-01-13
CVE-2026-20965 Windows Admin Center Elevation of Privilege Vulnerability — Windows Admin Center in Azure Portal 7.5 High2026-01-13
CVE-2025-68972 GNUPG 数据伪造问题漏洞 — GnuPG 5.9 Medium2025-12-27
CVE-2023-53951 Ever Gauzy v0.281.9 JWT Authentication Weakness via HMAC Secret — ever gauzy 9.8 Critical2025-12-19
CVE-2025-64786 Acrobat Reader | Improper Verification of Cryptographic Signature (CWE-347) — Acrobat Reader 3.3 Low2025-12-09
CVE-2025-64787 Acrobat Reader | Improper Verification of Cryptographic Signature (CWE-347) — Acrobat Reader 3.3 Low2025-12-09
CVE-2025-59718 Fortinet多款产品 数据伪造问题漏洞 — FortiSwitchManager 9.1 Critical2025-12-09
CVE-2025-59719 Fortinet FortiWeb 数据伪造问题漏洞 — FortiWeb 9.1 Critical2025-12-09
CVE-2025-13662 Ivanti Endpoint Manager 数据伪造问题漏洞 — Endpoint Manager 7.8 High2025-12-09
CVE-2025-66568 ruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validation — ruby-saml 7.4AIHighAI2025-12-09
CVE-2025-66567 ruby-saml has a SAML authentication bypass due to namespace handling (parser differential) — ruby-saml 9.1AICriticalAI2025-12-09
CVE-2025-65945 auth0/node-jws improper HMAC signature verification vulnerability — node-jws 7.5 High2025-12-04
CVE-2025-40934 XML-Sig prior to 0.68 for Perl improperly validates XML without signatures — XML::Sig 7.5AIHighAI2025-11-26
CVE-2025-34324 GoSign Desktop < 2.4.1 Insecure Update Mechanism RCE — GoSign Desktop 7.5AIHighAI2025-11-18
CVE-2025-64740 Zoom Workplace VDI Client for Windows - Improper Verification of Cryptographic Signature — Zoom Workplace VDI Client 7.5 High2025-11-13
CVE-2025-64186 Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves — evervault-go 8.7 High2025-11-12
CVE-2025-64456 JetBrains ReSharper 数据伪造问题漏洞 — ReSharper 8.4 High2025-11-10
CVE-2025-54549 Cryptographic validation of upgrade images could be circumventing by dropping a specifically crafted file into the upgrade ISO — DANZ Monitoring Fabric 5.9 Medium2025-10-29
CVE-2025-58356 Constellation allows insecure use of LUKS2 persistent storage partitions — constellation 6.5AIMediumAI2025-10-27
CVE-2025-12295 D-Link DAP-2695 Firmware Update sub_40C6B8 signature verification — DAP-2695 6.6 Medium2025-10-27
CVE-2025-34503 Shuffle Master Deck Mate 1 Unauthenticated EEPROM Firmware Execution — Deck Mate 1 6.8 -2025-10-24
CVE-2025-55039 Apache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacks — Apache Spark 5.9AIMediumAI2025-10-15
CVE-2025-59288 Playwright Spoofing Vulnerability — microsoft/playwright 5.3 Medium2025-10-14
CVE-2025-46774 Fortinet FortiClient MacOS installer 数据伪造问题漏洞 — FortiClientMac 6.8 High2025-10-14

CWE-347（密码学签名的验证不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 362 条 CVE 漏洞。