CWE-494 · Download of Code Without Integrity Check (page 2)
Page 2 of 3 — CVEs classified under CWE-494, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-42183 | Low | 2.5 | 2025-01-23 | BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability. It could allow a malicious operator to download files from arbitrary… |
CVE-2024-55459 | Medium | 6.5 | 2025-01-08 | An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the get_file function. |
CVE-2024-54126 | | 2024-12-05 | This vulnerability exists in the TP-Link Archer C50 due to improper signature verification mechanism in the firmware upgrade process at its web interface. An a… | |
CVE-2024-52583 | High | 8.2 | 2024-11-18 | The WesHacks GitHub repository provides the official Hackathon competition website source code for the Muweilah Wesgreen Hackathon. The page `schedule.html` be… |
CVE-2024-48974 | Critical | 9.3 | 2024-11-14 | The ventilator does not perform proper file integrity checks when adopting firmware updates. This makes it possible for an attacker to force unauthorized chang… |
CVE-2024-33660 | Medium | 4.3 | 2024-11-12 | An exploit is possible where an actor with physical access can manipulate SPI flash without being detected. |
CVE-2024-45321 | High | 8.1 | 2024-08-27 | The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers. |
CVE-2024-39819 | Medium | 6.7 | 2024-07-15 | Integrity check in the installer for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct a privilege escalation via local… |
CVE-2023-41921 | Critical | 9.8 | 2024-07-02 | A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin… |
CVE-2024-39348 | High | 7.5 | 2024-06-28 | Download of code without integrity check vulnerability in AirPrint functionality in Synology Router Manager (SRM) before 1.2.5-8227-11 and 1.3.1-9346-8 allows… |
CVE-2024-30206 | High | 8.8 | 2024-05-14 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (… |
CVE-2024-33118 | High | 7.5 | 2024-05-06 | LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary read vulnerability via the fileDownload method in class com.luckyframe.project.common.CommonControl… |
CVE-2023-39474 | High | 8.8 | 2024-05-03 | Inductive Automation Ignition downloadLaunchClientJar Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2024-28878 | Critical | 9.6 | 2024-04-12 | IO-1020 Micro ELD downloads source code or an executable from an adjacent location and executes the code without sufficiently verifying the origin or integr… |
CVE-2024-28850 | High | 8.1 | 2024-03-25 | WP Crontrol controls the cron events on WordPress websites. WP Crontrol includes a feature that allows administrative users to create events in the WP-Cron sy… |
CVE-2024-30205 | High | 7.1 | 2024-03-25 | In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode before 9.6.23. |
CVE-2024-27438 | Critical | 9.8 | 2024-03-21 | Download of Code Without Integrity Check vulnerability in Apache Doris. The jdbc driver files used for JDBC catalog is not checked and may resulting in remote… |
CVE-2023-47353 | High | 8.8 | 2024-02-06 | An issue in the com.oneed.dvr.service.DownloadFirmwareService component of IMOU GO v1.0.11 allows attackers to force the download of arbitrary files. |
CVE-2023-5592 | High | 7.5 | 2023-12-14 | Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attac… |
CVE-2023-46144 | Medium | 6.5 | 2023-12-14 | A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affec… |
CVE-2023-46143 | High | 7.5 | 2023-12-14 | Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all app… |
CVE-2023-5630 | Medium | 6.5 | 2023-12-14 | A CWE-494: Download of Code Without Integrity Check vulnerability exists that could allow a privileged user to install an untrusted firmware. |
CVE-2023-45842 | High | 8.1 | 2023-12-05 | Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A special… |
CVE-2023-45841 | High | 8.1 | 2023-12-05 | Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A special… |
CVE-2023-45840 | High | 8.1 | 2023-12-05 | Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A special… |
CVE-2023-45839 | High | 8.1 | 2023-12-05 | Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A special… |
CVE-2023-45838 | High | 8.1 | 2023-12-05 | Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A special… |
CVE-2023-43608 | High | 8.1 | 2023-12-05 | A data integrity vulnerability exists in the BR_NO_CHECK_HASH_FOR functionality of Buildroot 2023.08.1 and dev commit 622698d7847. A specially crafted man-in-t… |
CVE-2023-46887 | High | 7.5 | 2023-11-29 | In Dreamer CMS before 4.0.1, the backend attachment management office has an Arbitrary File Download vulnerability. |
CVE-2023-5984 | High | 7.2 | 2023-11-15 | A CWE-494 Download of Code Without Integrity Check vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins… |
CVE-2023-45799 | High | 7.2 | 2023-10-30 | In MLSoft TCO!stream versions 8.0.22.1115 and below, a vulnerability exists due to insufficient permission validation. This allows an attacker to make the vict… |
CVE-2023-45821 | Medium | 5.4 | 2023-10-19 | Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit… |
CVE-2023-37220 | High | 7.2 | 2023-09-03 | Synel Terminals - CWE-494: Download of Code Without Integrity Check |
CVE-2023-4041 | Critical | 9.8 | 2023-08-23 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability in Silicon… |
CVE-2023-40254 | High | 7.5 | 2023-08-11 | Download of Code Without Integrity Check vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA… |
CVE-2023-37864 | High | 7.2 | 2023-08-09 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with SNMPv2 write privileges may use an a special SNMP request to g… |
CVE-2023-29401 | Medium | 4.3 | 2023-06-08 | The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition heade… |
CVE-2023-28317 | Medium | 5.3 | 2023-05-09 | A vulnerability has been discovered in Rocket.Chat, where editing messages can change the original timestamp, causing the UI to display messages in an incorrec… |
CVE-2023-24503 | High | 7.5 | 2023-04-17 | Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW. |
CVE-2023-24500 | High | 7.5 | 2023-04-17 | Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW. |
CVE-2023-22635 | High | 7.3 | 2023-04-11 | A download of code without Integrity check vulnerability [CWE-494] in FortiClientMac version 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all versions, 6.0 all… |
CVE-2023-27025 | High | 7.5 | 2023-04-02 | An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the serv… |
CVE-2023-28818 | Medium | 5.3 | 2023-03-24 | An issue was discovered in Veritas NetBackup IT Analytics 11 before 11.2.0. The application upgrade process included unsigned files that could be exploited and… |
CVE-2023-27574 | Critical | 9.8 | 2023-03-03 | ShadowsocksX-NG 1.10.0 signs with com.apple.security.get-task-allow entitlements because of CODE_SIGNING_INJECT_BASE_ENTITLEMENTS. |
CVE-2023-23110 | High | 7.4 | 2023-02-02 | An exploitable firmware modification vulnerability was discovered in certain Netgear products. The data integrity of the uploaded firmware image is ensured wit… |
CVE-2020-22658 | Critical | 9.8 | 2023-01-20 | In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199… |
CVE-2020-22654 | Critical | 9.8 | 2023-01-20 | In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199… |
CVE-2022-24117 | Critical | 9.8 | 2022-12-26 | Certain General Electric Renewable Energy products download firmware without an integrity check. This affects iNET and iNET II before 8.3.0, SD before 6.4.7, T… |
CVE-2022-46430 | Medium | 4.8 | 2022-12-20 | TP-Link TL-WR740N V1 and V2 v3.12.4 and earlier allows authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a cra… |
CVE-2022-46428 | Medium | 4.8 | 2022-12-20 | TP-Link TL-WR1043ND V1 3.13.15 and earlier allows authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted… |
CVE-2022-46423 | High | 8.1 | 2022-12-20 | An exploitable firmware modification vulnerability was discovered on the Netgear WNR2000v1 router. An attacker can conduct a MITM (Man-in-the-Middle) attack to… |
CVE-2022-37908 | Medium | 5.8 | 2022-12-12 | An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers. Successful exploitation can compromise the hardware ch… |
CVE-2022-4261 | Medium | 4.4 | 2022-12-08 | Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to… |
CVE-2022-40799 | High | 8.8 | 2022-11-29 | Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the device. |
CVE-2022-45442 | High | 8.8 | 2022-11-28 | Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An appli… |
CVE-2022-38199 | Medium | 6.1 | 2022-10-25 | A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cases allow a remote, unauthenticated atta… |
CVE-2022-31324 | Medium | 6.5 | 2022-09-13 | An arbitrary file download vulnerability in the downloadAction() function of Penta Security Systems Inc WAPPLES v6.0 r3 4.10-hotfix1 allows attackers to downlo… |
CVE-2021-45027 | High | 7.5 | 2022-09-01 | An arbitrary file download vulnerability in Oliver v5 Library Server Versions < 5.00.008.053 via the FileServlet function allows for arbitrary file download by… |
CVE-2022-36671 | High | 7.5 | 2022-09-01 | Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API. |
CVE-2021-26639 | High | 8.1 | 2022-08-17 | This vulnerability is caused by the lack of validation of input values for specific functions if WISA Smart Wing CMS. Remote attackers can use this vulnerabili… |
CVE-2022-36359 | High | 8.8 | 2022-08-03 | An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file downl… |
CVE-2022-24140 | Medium | 6.6 | 2022-07-06 | IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot sends HTTP requests in their update procedure in o… |
CVE-2021-35532 | Medium | 6.7 | 2022-06-07 | A vulnerability exists in the file upload validation part of Hitachi Energy TXpert Hub CoreTec 4 product. The vulnerability allows an attacker or malicious age… |
CVE-2022-27438 | High | 8.1 | 2022-06-06 | Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affected by a remote code… |
CVE-2022-28944 | High | 8.8 | 2022-05-23 | Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check. This affects MSI Package Builder for Windows 9.1.4 and Remot… |
CVE-2021-41714 | High | 7.7 | 2022-05-23 | In Tipask < 3.5.9, path parameters entered by the user are not validated when downloading attachments, a registered user can download arbitrary files on the Ti… |
CVE-2022-22786 | High | 7.5 | 2022-05-18 | The Zoom Client for Meetings for Windows before version 5.10.0 and Zoom Rooms for Conference Room for Windows before version 5.10.0, fails to properly check th… |
CVE-2022-24644 | High | 8.8 | 2022-03-10 | ZZ Inc. KeyMouse Windows 3.08 and prior is affected by a remote code execution vulnerability during an unauthenticated update. To exploit this vulnerability, a… |
CVE-2021-44168 | Low | 3.3 | 2022-01-04 | A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attac… |
CVE-2020-7883 | Critical | 9.8 | 2021-12-28 | Printchaser v2.2021.804.1 and earlier versions contain a vulnerability, which could allow remote attacker to download and execute remote file by setting the ar… |
CVE-2020-7875 | High | 7.5 | 2021-10-28 | DEXT5 Upload 5.0.0.117 and earlier versions contain a vulnerability, which could allow remote attacker to download and execute remote file by setting the argum… |
CVE-2020-7874 | High | 8.8 | 2021-09-09 | Download of code without integrity check vulnerability in NEXACRO14 Runtime ActiveX control of tobesoft Co., Ltd allows the attacker to cause an arbitrary file… |
CVE-2020-7873 | High | 8.8 | 2021-09-09 | Download of code without integrity check vulnerability in ActiveX control of Younglimwon Co., Ltd allows the attacker to cause a arbitrary file download and ex… |
CVE-2021-30669 | Medium | 5.5 | 2021-09-08 | A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-… |
CVE-2021-30658 | Medium | 5.5 | 2021-09-08 | This issue was addressed with improved handling of file metadata. This issue is fixed in macOS Big Sur 11.3. A malicious application may bypass Gatekeeper chec… |
CVE-2021-38588 | High | 8.1 | 2021-08-11 | In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587). |
CVE-2021-33879 | High | 8.1 | 2021-06-06 | Tencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP connection. A malicious attacker in an MITM position could spoof the contents of an… |
CVE-2021-3485 | Medium | 6.4 | 2021-05-24 | An Improper Input Validation vulnerability in the Product Update feature of Bitdefender Endpoint Security Tools for Linux allows a man-in-the-middle attacker t… |
CVE-2020-29032 | High | 8.4 | 2021-03-05 | Upload of Code Without Integrity Check vulnerability in firmware archive of Secomea GateManager allows authenticated attacker to execute malicious code on serv… |
CVE-2020-2320 | Critical | 9.8 | 2020-12-03 | Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads. |
CVE-2020-25266 | Medium | 5.5 | 2020-12-02 | AppImage appimaged before 1.0.3 does not properly check whether a downloaded file is a valid appimage. For example, it will accept a crafted mp3 file that cont… |
CVE-2020-28332 | Critical | 9.8 | 2020-11-24 | Barco wePresent WiPG-1600W devices download code without an Integrity Check. Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19. The Barco wePresent Wi… |
CVE-2020-28213 | High | 8.8 | 2020-11-19 | A CWE-494: Download of Code Without Integrity Check vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that co… |
CVE-2020-15604 | High | 7.5 | 2020-09-24 | An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to c… |
CVE-2020-1595 | Critical | 9.9 | 2020-09-11 | <p>A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input. An attacker who successful… |
CVE-2020-1576 | High | 8.5 | 2020-09-11 | <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attack… |
CVE-2020-1453 | High | 8.6 | 2020-09-11 | <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attack… |
CVE-2020-1452 | High | 8.6 | 2020-09-11 | <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attack… |
CVE-2020-1210 | Critical | 9.9 | 2020-09-11 | <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attack… |
CVE-2020-1200 | High | 8.6 | 2020-09-11 | <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attack… |
CVE-2020-7831 | High | 8.8 | 2020-08-24 | A vulnerability in the web-based contract management service interface Ebiz4u of INOGARD could allow an victim user to download any file. The attacker is able… |
CVE-2020-7817 | Medium | 5.5 | 2020-08-06 | MyBrowserPlus downloads the files needed to run the program through the setup file (Setup.inf). At this time, there is a vulnerability in downloading arbitrary… |
CVE-2020-5772 | High | 7.5 | 2020-08-03 | Improper Input Validation in Teltonika firmware TRB2_R_00.02.04.01 allows a remote, authenticated attacker to gain root privileges by uploading a malicious pac… |
CVE-2020-10926 | High | 8.8 | 2020-07-28 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentica… |
CVE-2020-4125 | High | 8.1 | 2020-07-20 | Using HCL Marketing Operations 9.1.2.4, 10.1.x, 11.1.0.x, a malicious attacker could download files from the RHEL environment by doing some modification in the… |
CVE-2020-7826 | High | 8.8 | 2020-07-17 | EyeSurfer BflyInstallerX.ocx v1.0.0.16 and earlier versions contain a vulnerability that could allow remote files to be download by setting the arguments to th… |
CVE-2020-7505 | High | 7.2 | 2020-06-16 | A CWE-494 Download of Code Without Integrity Check vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to inj… |
CVE-2020-7812 | High | 7.8 | 2020-05-28 | Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allow remote attacker to download arbitrary… |
CVE-2020-7813 | High | 7.8 | 2020-05-22 | Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allow remote attacker to download and execu… |
CVE-2020-9474 | High | 8.8 | 2020-05-07 | The S. Siedle & Soehne SG 150-0 Smart Gateway before 1.2.4 allows remote code execution via the backup functionality in the web frontend. By using an exploit c… |