CWE-354 · Improper Validation of Integrity Check Value (page 2)
Page 2 of 2 — CVEs classified under CWE-354, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-45191 | Medium | 6.5 | 2023-02-08 | An issue was discovered on Microchip RN4870 1.43 devices. An attacker within BLE radio range can cause a denial of service by sending a pair confirm message wi… |
CVE-2023-23120 | Medium | 5.9 | 2023-02-02 | The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes TRENDnet TV-IP651WI Network Camera firmware version v1… |
CVE-2023-23119 | Medium | 5.9 | 2023-02-02 | The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes Ubiquiti airFiber AF2X Radio firmware version 3.2.2 and… |
CVE-2022-46402 | Medium | 6.5 | 2022-12-19 | The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PairCon_rmSend with incorrect values. |
CVE-2022-36360 | High | 7.5 | 2022-10-11 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Affected devices load firmware updates without checking the au… |
CVE-2022-38956 | Medium | 5.3 | 2022-09-20 | An exploitable firmware downgrade vulnerability was discovered on the Netgear WPN824EXT WiFi Range Extender. An attacker can conduct a MITM attack to replace t… |
CVE-2022-38955 | High | 7.5 | 2022-09-20 | An exploitable firmware modification vulnerability was discovered on the Netgear WPN824EXT WiFi Range Extender. An attacker can conduct a MITM attack to modify… |
CVE-2022-36174 | High | 8.1 | 2022-09-12 | FreshService Windows Agent < 2.11.0 and FreshService macOS Agent < 4.2.0 and FreshService Linux Agent < 3.3.0. are vulnerable to Broken integrity checking via… |
CVE-2022-39845 | Medium | 5.5 | 2022-09-09 | Improper validation of integrity check vulnerability in Samsung Kies prior to version 2.6.4.22074 allows local attackers to delete arbitrary directory using di… |
CVE-2022-39844 | Medium | 5.5 | 2022-09-09 | Improper validation of integrity check vulnerability in Smart Switch PC prior to version 4.3.22083 allows local attackers to delete arbitrary directory using d… |
CVE-2022-29549 | High | 7.3 | 2022-08-18 | An issue was discovered in Qualys Cloud Agent 4.8.0-49. It executes programs at various full pathnames without first making ownership and permission checks (e… |
CVE-2022-35961 | High | 7.9 | 2022-08-15 | OpenZeppelin Contracts is a library for secure smart contract development. The functions `ECDSA.recover` and `ECDSA.tryRecover` are vulnerable to a kind of sig… |
CVE-2022-30316 | Medium | 6.8 | 2022-07-28 | Honeywell Experion PKS Safety Manager 5.02 has Insufficient Verification of Data Authenticity. According to FSCT-2022-0054, there is a Honeywell Experion PKS S… |
CVE-2022-33711 | Medium | 5.5 | 2022-07-12 | Improper validation of integrity check vulnerability in Samsung USB Driver Windows Installer for Mobile Phones prior to version 1.7.56.0 allows local attackers… |
CVE-2021-37182 | High | 7.5 | 2022-06-14 | A vulnerability has been identified in SCALANCE XM408-4C (All versions < V6.5), SCALANCE XM408-4C (L3 int.) (All versions < V6.5), SCALANCE XM408-8C (All versi… |
CVE-2022-21757 | High | 7.5 | 2022-06-06 | In WIFI Firmware, there is a possible system crash due to a missing count check. This could lead to remote denial of service with no additional execution privi… |
CVE-2022-29898 | Critical | 9.1 | 2022-05-11 | On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root… |
CVE-2022-29173 | High | 8.0 | 2022-05-05 | go-tuf is a Go implementation of The Update Framework (TUF). go-tuf does not correctly implement the client workflow for updating the metadata files for roles… |
CVE-2022-25946 | High | 8.7 | 2022-05-05 | On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configuration (GC) all vers… |
CVE-2022-22781 | High | 7.5 | 2022-04-28 | The Zoom Client for Meetings for MacOS (Standard and for IT Admin) prior to version 5.9.6 failed to properly check the package version during the update proces… |
CVE-2020-14120 | High | 8.8 | 2022-04-21 | Some Xiaomi models have a vulnerability in a certain application. The vulnerability is caused by the lack of checksum when using a three-party application to p… |
CVE-2022-22253 | High | 7.5 | 2022-04-11 | The DFX module has a vulnerability of improper validation of integrity check values.Successful exploitation of this vulnerability may affect system stability. |
CVE-2021-4148 | Medium | 5.5 | 2022-03-23 | A vulnerability was found in the Linux kernel's block_invalidatepage in fs/buffer.c in the filesystem. A missing sanity check may allow a local attacker with u… |
CVE-2021-3772 | Medium | 6.5 | 2022-03-02 | A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP… |
CVE-2021-41067 | High | 7.5 | 2021-12-14 | An issue was discovered in Listary through 6. Improper implementation of the update process leads to the download of software updates with a /check-update HTTP… |
CVE-2021-41206 | High | 7.0 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions several TensorFlow operations are missing validation for the shapes of the ten… |
CVE-2021-22276 | Medium | 6.1 | 2021-09-23 | The vulnerability allows a successful attacker to bypass the integrity check of FW uploaded to the free@home System Access Point. |
CVE-2021-22442 | High | 7.5 | 2021-08-02 | There is an Improper Validation of Integrity Check Value Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system… |
CVE-2020-4610 | High | 7.8 | 2021-06-25 | IBM Security Secret Server (IBM Security Verify Privilege Manager 10.8.2 ) could allow a local user to execute code due to improper integrity checks. IBM X-For… |
CVE-2021-25388 | High | 7.1 | 2021-06-11 | Improper caller check vulnerability in Knox Core prior to SMR MAY-2021 Release 1 allows attackers to install arbitrary app. |
CVE-2020-26141 | Medium | 6.5 | 2021-05-11 | An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation does not verify the Message Integrity Check (authentic… |
CVE-2021-31913 | High | 7.5 | 2021-05-11 | In JetBrains TeamCity before 2020.2.3, insufficient checks of the redirect_uri were made during GitHub SSO token exchange. |
CVE-2020-14009 | Medium | 6.3 | 2021-05-07 | Proofpoint Enterprise Protection (PPS/PoD) before 8.16.4 contains a vulnerability that could allow an attacker to deliver an email message with a malicious att… |
CVE-2021-20709 | High | 7.2 | 2021-04-26 | Improper validation of integrity check value vulnerability in NEC Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1.3.3 and earlier, a… |
CVE-2020-9118 | Medium | 6.8 | 2021-02-06 | There is an insufficient integrity check vulnerability in Huawei Sound X Product. The system does not check certain software package's integrity sufficiently… |
CVE-2021-20184 | Medium | 4.3 | 2021-01-28 | It was found in Moodle before version 3.10.1, 3.9.4 and 3.8.7 that a insufficient capability checks in some grade related web services meant students were able… |
CVE-2020-25758 | High | 8.8 | 2020-12-15 | An issue was discovered on D-Link DSR-250 3.17 devices. Insufficient validation of configuration file checksums could allow a remote, authenticated attacker to… |
CVE-2020-5637 | Medium | 6.8 | 2020-12-14 | Improper validation of integrity check value vulnerability in Aterm SA3500G firmware versions prior to Ver. 3.5.9 allows an attacker with an administrative pri… |
CVE-2020-5798 | High | 7.8 | 2020-12-07 | inSync Client installer for macOS versions v6.8.0 and prior could allow an attacker to gain privileges of a root user from a lower privileged user due to impro… |
CVE-2020-28656 | Medium | 6.8 | 2020-11-16 | The update functionality of the Discover Media infotainment system in Volkswagen Polo 2019 vehicles allows physically proximate attackers to execute arbitrary… |
CVE-2020-26896 | High | 8.2 | 2020-10-21 | Prior to 0.11.0-beta, LND (Lightning Network Daemon) had a vulnerability in its invoice database. While claiming on-chain a received HTLC output, it didn't ver… |
CVE-2020-26895 | Medium | 5.3 | 2020-10-21 | Prior to 0.10.0-beta, LND (Lightning Network Daemon) would have accepted a counterparty high-S signature and broadcast tx-relay invalid local commitment/HTLC t… |
CVE-2020-25862 | High | 7.5 | 2020-10-06 | In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the TCP dissector could crash. This was addressed in epan/dissectors/packet-tcp.c by changin… |
CVE-2020-7807 | Medium | 5.6 | 2020-09-14 | A vulnerability that can hijack a DLL file that is loaded during products(LGPCSuite_Setup, IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup) installation into a… |
CVE-2020-11497 | High | 7.5 | 2020-08-26 | An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. An online payment system bypass allows orders to be marke… |
CVE-2020-7810 | High | 8.8 | 2020-08-07 | hslogin2.dll ActiveX Control in Groupware contains a vulnerability that could allow remote files to be downloaded and executed by setting the arguments to the… |
CVE-2020-13847 | High | 7.5 | 2020-07-14 | Sylabs Singularity 3.0 through 3.5 lacks support for an Integrity Check. Singularity's sign and verify commands do not sign metadata found in the global header… |
CVE-2020-13845 | High | 7.5 | 2020-07-14 | Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value. Image integrity is not validated when an ECL policy is enforced. The fi… |
CVE-2020-1834 | Medium | 4.6 | 2020-06-18 | HUAWEI P30 and HUAWEI P30 Pro with versions earlier than 10.1.0.135(C00E135R2P11) and versions earlier than 10.1.0.135(C00E135R2P8) have an insufficient integr… |
CVE-2020-6228 | High | 7.5 | 2020-04-14 | SAP Business Client, versions 6.5, 7.0, does not perform necessary integrity checks which could be exploited by an attacker under certain conditions to modify… |
CVE-2020-1802 | Medium | 4.6 | 2020-04-10 | There is an insufficient integrity validation vulnerability in several products. The device does not sufficiently validate the integrity of certain file in cer… |
CVE-2018-21070 | High | 8.4 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x), O(8.0) devices (MSM8998 or SDM845 chipsets) software. An attacker can bypass Secure Boot and obt… |
CVE-2017-18689 | High | 7.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with M(6.0) and N(7.0) (Exynos5433, Exynos7420, or Exynos7870 chipsets) software. An attacker can bypass a ko… |
CVE-2017-18649 | High | 7.2 | 2020-04-07 | An issue was discovered on Samsung mobile devices with N(7.x) software. An attacker can boot a device with root privileges because the bootloader for the Qualc… |
CVE-2020-8838 | Medium | 6.4 | 2020-03-23 | An issue was discovered in Zoho ManageEngine AssetExplorer 6.5. During an upgrade of the Windows agent, it does not validate the source and binary downloaded… |
CVE-2020-1879 | Low | 3.9 | 2020-03-20 | There is an improper integrity checking vulnerability on some huawei products. The software of the affected product has an improper integrity check which may a… |
CVE-2019-5272 | Medium | 4.9 | 2019-12-26 | USG9500 with versions of V500R001C30;V500R001C60 have a missing integrity checking vulnerability. The software of the affected products does not check the inte… |
CVE-2019-18672 | High | 7.5 | 2019-12-06 | Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cryptographic secrets… |
CVE-2012-1170 | High | 7.5 | 2019-11-14 | Moodle before 2.2.2 has an external enrolment plugin context check issue where capability checks are not thorough |
CVE-2019-13496 | High | 8.1 | 2019-11-04 | One Identity Cloud Access Manager before 8.1.4 Hotfix 1 allows OTP bypass via vectors involving a man in the middle, the One Identity Defender product, and rep… |
CVE-2019-1166 | Medium | 5.9 | 2019-10-10 | A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) p… |
CVE-2019-0071 | High | 7.8 | 2019-10-09 | Veriexec is a kernel-based file integrity subsystem in Junos OS that ensures only authorized binaries are able to be executed. Due to a flaw in specific versio… |
CVE-2019-11753 | High | 7.8 | 2019-09-27 | The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from manipulation by unprivileged users or malw… |
CVE-2019-1163 | Medium | 5.5 | 2019-08-14 | A security feature bypass exists when Windows incorrectly validates CAB file signatures. An attacker who successfully exploited this vulnerability could inject… |
CVE-2019-10155 | Low | 3.1 | 2019-06-12 | The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the… |
CVE-2019-12097 | High | 7.8 | 2019-06-03 | Telerik Fiddler v5.0.20182.28034 doesn't verify the hash of EnableLoopback.exe before running it, which could lead to code execution or local privilege escalat… |
CVE-2018-6336 | High | 7.8 | 2018-12-31 | An issue was discovered in osquery. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of… |
CVE-2017-3224 | High | 8.2 | 2018-07-24 | Open Shortest Path First (OSPF) protocol implementations may improperly determine Link State Advertisement (LSA) recency for LSAs with MaxSequenceNumber. Accor… |
CVE-2018-1000159 | Medium | 5.9 | 2018-04-18 | tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vu… |
CVE-2018-5382 | Medium | 4.4 | 2018-04-16 | The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle releas… |
CVE-2018-5441 | High | 7.8 | 2018-01-30 | An Improper Validation of Integrity Check Value issue was discovered in PHOENIX CONTACT mGuard firmware versions 7.2 to 8.6.0. mGuard devices rely on internal… |
CVE-2017-15994 | Critical | 9.8 | 2017-10-29 | rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to bypass intended access restrictions. NOTE… |
CVE-2017-3760 | High | 8.1 | 2017-10-17 | The Lenovo Service Framework Android application uses a set of nonsecure credentials when performing integrity verification of downloaded applications and/or d… |
CVE-2017-12973 | Low | 3.1 | 2017-08-20 | Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attackers to conduct a pad… |
CVE-2017-9498 | Medium | 5.5 | 2017-07-31 | The Comcast firmware on Motorola MX011ANM (firmware version MX011AN_2.9p6s1_PROD_sey) and Xfinity XR11-20 Voice Remote devices allows local users to upload arb… |
CVE-2017-9606 | High | 7.3 | 2017-06-15 | Infotecs ViPNet Client and Coordinator before 4.3.2-42442 allow local users to gain privileges by placing a Trojan horse ViPNet update file in the update folde… |
CVE-2017-4961 | High | 8.8 | 2017-06-13 | An issue was discovered in Cloud Foundry Foundation BOSH Release 261.x versions prior to 261.3 and all 260.x versions. In certain cases an authenticated Direct… |