A vulnerability in the anycast function of the Cisco NX-OS operating system, which allows a attacker to compromise the integrity of protected information.

The vulnerability in the anycast function of the Cisco NX-OS operating system is related to insufficient verification of data authenticity. Exploiting this vulnerability can allow a malicious actor to compromise the integrity of protected information...

The vulnerability of the Cisco HyperFlex hyper-converged infrastructure’s statistical collection service allows a attacker to compromise the integrity of the protected information.

The vulnerability of the Cisco HyperFlex hyper-converged infrastructure’s statistical collection service is related to insufficient verification of data authenticity. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the protected information...

The vulnerability of the IcedTea-Web plugin, which stems from insufficient verification of data authenticity, allows a hacker to inject arbitrary code into the JAR file.

The vulnerability of the IcedTea-Web plugin is related to insufficient verification of data authenticity. Exploiting this vulnerability allows a remote attacker to inject arbitrary code into the JAR file...

CVE-2019-7323

GUP generic update process in LightySoft LogMX before 7.4.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update. The update process relies on cleartext HTTP. The attacker could replace the...

CVE-2018-7798

A Insufficient Verification of Data Authenticity CWE-345 vulnerability exists in the Modicon M221, all versions, which could cause a change of IPv4 configuration IP address, mask and gateway when remotely connected to the device...

Cross-Site Request Forgery (CSRF)

tribalsystems/zenario is vulnerable to cross-site request forgery CSRF. The application does not verify the authenticity of a request to admin/organizer.ajax.php?path=zenariocontent%2Fpanels%2Fcontent, which allows an attacker to submit a request on behalf of the victim when the victim visits a...

Design/Logic Flaw

A vulnerability was discovered in all versions of Medtronic MyCareLink 24950 and 24952 Patient Monitor. The affected product's update service does not sufficiently verify the authenticity of the data uploaded. An attacker who obtains per-product credentials from the monitor and paired implantable...

Trend Micro Email Encryption Gateway Multiple Vulnerabilities

1. Advisory Information Title: Trend Micro Email Encryption Gateway Multiple Vulnerabilities Advisory ID: CORE-2017-0006 Advisory URL:http://www.coresecurity.com/core-labs/advisories/trend-micro-email-encryption-gateway-multiple-vulnerabilities Date published: 2018-02-21 Date of last update:...

The vulnerability of the Antivirus Kasperksy 8.0 web console for Linux File Servers allows an attacker to send commands to the antivirus software on behalf of its user.

The vulnerability of the Antivirus Kaspersky 8.0 web console for Linux File Servers arises from the lack of authenticity verification for the creators of the web consoles. Exploiting this vulnerability allows a malicious actor to send an antivirus command on behalf of the user who visits the...

Vulnerability of the Windows operating system, allowing a perpetrator to execute arbitrary code

The vulnerability of the Windows Reader component of the Windows operating system is related to insufficient verification of data authenticity. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created Reader file from a remote location...

HackerOne: Substantially weakened authenticity verification when using 'Remember me for a week'

Hello HackerOne, I noticed that in order to access data bound to a user's permissions, say their own bug reports, or CSRF-token, you only need one certain cookie, which is rememberusertoken, and although it is sent when the user uses HackerOne in a normal fashion, the session cookie is ignored an...

Mac OS X : Cisco AnyConnect Secure Mobility Client 2.x / 3.x < 3.0(629) Multiple Vulnerabilities

The remote host has a version of Cisco AnyConnect 2.x or 3.x prior to 3.0629 and is, therefore, affected by the following vulnerabilities : - When the client is obtained from the VPN headend using a web browser, a helper application performs the download and installation. This helper application...

CVE-2012-5003

nxapplet.jar in No Machine NX Web Companion 3.x and earlier does not properly verify the authenticity of updates, which allows user-assisted remote attackers to execute arbitrary code via a crafted 1 SiteUrl or 2 RedirectUrl parameter that points to a Trojan Horse client.zip update file...

iTunes < 10.5.1 Update Authenticity Verification Weakness (Mac OS X)

The version of iTunes installed on the remote Mac OS X host is earlier than 10.5.1. As such, it uses an unsecured HTTP connection when checking for or retrieving software updates, which could allow a man-in-the-middle attacker to provide a Trojan horse update that appears to originate from Apple....

Apple iTunes < 10.5.1 Update Authenticity Verification Weakness (credentialed check)

The version of Apple iTunes installed on the remote Mac OS X host is earlier than 10.5.1. As such, it uses an unsecured HTTP connection when checking for or retrieving software updates, which could allow a man-in-the-middle attacker to provide a Trojan horse update that appears to originate from...

Apple iTunes < 10.5.1 Update Authenticity Verification Weakness (uncredentialed check)

The version of Apple iTunes on the remote host is prior to version 10.5.1. It is, therefore, affected by a man-in-the-middle vulnerability due to using unsecured HTTP connections when checking for or retrieving software updates. A remote attacker can exploit this to execute arbitrary code by mean...

iTunes < 10.5.1 Update Authenticity Verification Weakness

Binary data 6098.prm...

Code injection

ICQ 7 does not verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a crafted file that is fetched through an automatic-update mechanism...

PT-2008-4730 · Partygaming · Partypoker

Name of the Vulnerable Software and Affected Versions: PartyGaming PartyPoker client program version 121/120 Description: The issue concerns the PartyGaming PartyPoker client program, which fails to properly verify the authenticity of updates. This allows remote man-in-the-middle attackers to...

CVE-2008-3438

Apple Mac OS X does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning...