CWE-494 · Download of Code Without Integrity Check (page 2)
Page 2 of 3 — CVEs classified under CWE-494, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-45839 | High | 8.1 | 2023-12-05 | Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A special… |
CVE-2023-45838 | High | 8.1 | 2023-12-05 | Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A special… |
CVE-2023-43608 | High | 8.1 | 2023-12-05 | A data integrity vulnerability exists in the BR_NO_CHECK_HASH_FOR functionality of Buildroot 2023.08.1 and dev commit 622698d7847. A specially crafted man-in-t… |
CVE-2023-46887 | High | 7.5 | 2023-11-29 | In Dreamer CMS before 4.0.1, the backend attachment management office has an Arbitrary File Download vulnerability. |
CVE-2023-5984 | High | 7.2 | 2023-11-15 | A CWE-494 Download of Code Without Integrity Check vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins… |
CVE-2023-45799 | High | 7.2 | 2023-10-30 | In MLSoft TCO!stream versions 8.0.22.1115 and below, a vulnerability exists due to insufficient permission validation. This allows an attacker to make the vict… |
CVE-2023-45821 | Medium | 5.4 | 2023-10-19 | Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit… |
CVE-2023-37220 | High | 7.2 | 2023-09-03 | Synel Terminals - CWE-494: Download of Code Without Integrity Check |
CVE-2023-4041 | Critical | 9.8 | 2023-08-23 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability in Silicon… |
CVE-2023-40254 | High | 7.5 | 2023-08-11 | Download of Code Without Integrity Check vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA… |
CVE-2023-37864 | High | 7.2 | 2023-08-09 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with SNMPv2 write privileges may use an a special SNMP request to g… |
CVE-2023-29401 | Medium | 4.3 | 2023-06-08 | The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition heade… |
CVE-2023-28317 | Medium | 5.3 | 2023-05-09 | A vulnerability has been discovered in Rocket.Chat, where editing messages can change the original timestamp, causing the UI to display messages in an incorrec… |
CVE-2023-24503 | High | 7.5 | 2023-04-17 | Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW. |
CVE-2023-24500 | High | 7.5 | 2023-04-17 | Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW. |
CVE-2023-22635 | High | 7.3 | 2023-04-11 | A download of code without Integrity check vulnerability [CWE-494] in FortiClientMac version 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all versions, 6.0 all… |
CVE-2023-27025 | High | 7.5 | 2023-04-02 | An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the serv… |
CVE-2023-28818 | Medium | 5.3 | 2023-03-24 | An issue was discovered in Veritas NetBackup IT Analytics 11 before 11.2.0. The application upgrade process included unsigned files that could be exploited and… |
CVE-2023-27574 | Critical | 9.8 | 2023-03-03 | ShadowsocksX-NG 1.10.0 signs with com.apple.security.get-task-allow entitlements because of CODE_SIGNING_INJECT_BASE_ENTITLEMENTS. |
CVE-2023-23110 | High | 7.4 | 2023-02-02 | An exploitable firmware modification vulnerability was discovered in certain Netgear products. The data integrity of the uploaded firmware image is ensured wit… |
CVE-2020-22658 | Critical | 9.8 | 2023-01-20 | In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199… |
CVE-2020-22654 | Critical | 9.8 | 2023-01-20 | In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199… |
CVE-2022-24117 | Critical | 9.8 | 2022-12-26 | Certain General Electric Renewable Energy products download firmware without an integrity check. This affects iNET and iNET II before 8.3.0, SD before 6.4.7, T… |
CVE-2022-46430 | Medium | 4.8 | 2022-12-20 | TP-Link TL-WR740N V1 and V2 v3.12.4 and earlier allows authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a cra… |
CVE-2022-46428 | Medium | 4.8 | 2022-12-20 | TP-Link TL-WR1043ND V1 3.13.15 and earlier allows authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted… |
CVE-2022-46423 | High | 8.1 | 2022-12-20 | An exploitable firmware modification vulnerability was discovered on the Netgear WNR2000v1 router. An attacker can conduct a MITM (Man-in-the-Middle) attack to… |
CVE-2022-37908 | Medium | 5.8 | 2022-12-12 | An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers. Successful exploitation can compromise the hardware ch… |
CVE-2022-4261 | Medium | 4.4 | 2022-12-08 | Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to… |
CVE-2022-40799 | High | 8.8 | 2022-11-29 | Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the device. |
CVE-2022-45442 | High | 8.8 | 2022-11-28 | Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An appli… |
CVE-2022-38199 | Medium | 6.1 | 2022-10-25 | A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cases allow a remote, unauthenticated atta… |
CVE-2022-31324 | Medium | 6.5 | 2022-09-13 | An arbitrary file download vulnerability in the downloadAction() function of Penta Security Systems Inc WAPPLES v6.0 r3 4.10-hotfix1 allows attackers to downlo… |
CVE-2021-45027 | High | 7.5 | 2022-09-01 | An arbitrary file download vulnerability in Oliver v5 Library Server Versions < 5.00.008.053 via the FileServlet function allows for arbitrary file download by… |
CVE-2022-36671 | High | 7.5 | 2022-09-01 | Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API. |
CVE-2021-26639 | High | 8.1 | 2022-08-17 | This vulnerability is caused by the lack of validation of input values for specific functions if WISA Smart Wing CMS. Remote attackers can use this vulnerabili… |
CVE-2022-36359 | High | 8.8 | 2022-08-03 | An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file downl… |
CVE-2022-24140 | Medium | 6.6 | 2022-07-06 | IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot sends HTTP requests in their update procedure in o… |
CVE-2021-35532 | Medium | 6.7 | 2022-06-07 | A vulnerability exists in the file upload validation part of Hitachi Energy TXpert Hub CoreTec 4 product. The vulnerability allows an attacker or malicious age… |
CVE-2022-27438 | High | 8.1 | 2022-06-06 | Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affected by a remote code… |
CVE-2022-28944 | High | 8.8 | 2022-05-23 | Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check. This affects MSI Package Builder for Windows 9.1.4 and Remot… |
CVE-2021-41714 | High | 7.7 | 2022-05-23 | In Tipask < 3.5.9, path parameters entered by the user are not validated when downloading attachments, a registered user can download arbitrary files on the Ti… |
CVE-2022-22786 | High | 7.5 | 2022-05-18 | The Zoom Client for Meetings for Windows before version 5.10.0 and Zoom Rooms for Conference Room for Windows before version 5.10.0, fails to properly check th… |
CVE-2022-24644 | High | 8.8 | 2022-03-10 | ZZ Inc. KeyMouse Windows 3.08 and prior is affected by a remote code execution vulnerability during an unauthenticated update. To exploit this vulnerability, a… |
CVE-2021-44168 | Low | 3.3 | 2022-01-04 | A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attac… |
CVE-2020-7883 | Critical | 9.8 | 2021-12-28 | Printchaser v2.2021.804.1 and earlier versions contain a vulnerability, which could allow remote attacker to download and execute remote file by setting the ar… |
CVE-2020-7875 | High | 7.5 | 2021-10-28 | DEXT5 Upload 5.0.0.117 and earlier versions contain a vulnerability, which could allow remote attacker to download and execute remote file by setting the argum… |
CVE-2020-7874 | High | 8.8 | 2021-09-09 | Download of code without integrity check vulnerability in NEXACRO14 Runtime ActiveX control of tobesoft Co., Ltd allows the attacker to cause an arbitrary file… |
CVE-2020-7873 | High | 8.8 | 2021-09-09 | Download of code without integrity check vulnerability in ActiveX control of Younglimwon Co., Ltd allows the attacker to cause a arbitrary file download and ex… |
CVE-2021-30669 | Medium | 5.5 | 2021-09-08 | A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-… |
CVE-2021-30658 | Medium | 5.5 | 2021-09-08 | This issue was addressed with improved handling of file metadata. This issue is fixed in macOS Big Sur 11.3. A malicious application may bypass Gatekeeper chec… |
CVE-2021-38588 | High | 8.1 | 2021-08-11 | In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587). |
CVE-2021-33879 | High | 8.1 | 2021-06-06 | Tencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP connection. A malicious attacker in an MITM position could spoof the contents of an… |
CVE-2021-3485 | Medium | 6.4 | 2021-05-24 | An Improper Input Validation vulnerability in the Product Update feature of Bitdefender Endpoint Security Tools for Linux allows a man-in-the-middle attacker t… |
CVE-2020-29032 | High | 8.4 | 2021-03-05 | Upload of Code Without Integrity Check vulnerability in firmware archive of Secomea GateManager allows authenticated attacker to execute malicious code on serv… |
CVE-2020-2320 | Critical | 9.8 | 2020-12-03 | Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads. |
CVE-2020-25266 | Medium | 5.5 | 2020-12-02 | AppImage appimaged before 1.0.3 does not properly check whether a downloaded file is a valid appimage. For example, it will accept a crafted mp3 file that cont… |
CVE-2020-28332 | Critical | 9.8 | 2020-11-24 | Barco wePresent WiPG-1600W devices download code without an Integrity Check. Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19. The Barco wePresent Wi… |
CVE-2020-28213 | High | 8.8 | 2020-11-19 | A CWE-494: Download of Code Without Integrity Check vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that co… |
CVE-2020-15604 | High | 7.5 | 2020-09-24 | An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to c… |
CVE-2020-1595 | Critical | 9.9 | 2020-09-11 | <p>A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input. An attacker who successful… |
CVE-2020-1576 | High | 8.5 | 2020-09-11 | <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attack… |
CVE-2020-1453 | High | 8.6 | 2020-09-11 | <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attack… |
CVE-2020-1452 | High | 8.6 | 2020-09-11 | <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attack… |
CVE-2020-1210 | Critical | 9.9 | 2020-09-11 | <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attack… |
CVE-2020-1200 | High | 8.6 | 2020-09-11 | <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attack… |
CVE-2020-7831 | High | 8.8 | 2020-08-24 | A vulnerability in the web-based contract management service interface Ebiz4u of INOGARD could allow an victim user to download any file. The attacker is able… |
CVE-2020-7817 | Medium | 5.5 | 2020-08-06 | MyBrowserPlus downloads the files needed to run the program through the setup file (Setup.inf). At this time, there is a vulnerability in downloading arbitrary… |
CVE-2020-5772 | High | 7.5 | 2020-08-03 | Improper Input Validation in Teltonika firmware TRB2_R_00.02.04.01 allows a remote, authenticated attacker to gain root privileges by uploading a malicious pac… |
CVE-2020-10926 | High | 8.8 | 2020-07-28 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentica… |
CVE-2020-4125 | High | 8.1 | 2020-07-20 | Using HCL Marketing Operations 9.1.2.4, 10.1.x, 11.1.0.x, a malicious attacker could download files from the RHEL environment by doing some modification in the… |
CVE-2020-7826 | High | 8.8 | 2020-07-17 | EyeSurfer BflyInstallerX.ocx v1.0.0.16 and earlier versions contain a vulnerability that could allow remote files to be download by setting the arguments to th… |
CVE-2020-7505 | High | 7.2 | 2020-06-16 | A CWE-494 Download of Code Without Integrity Check vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to inj… |
CVE-2020-7812 | High | 7.8 | 2020-05-28 | Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allow remote attacker to download arbitrary… |
CVE-2020-7813 | High | 7.8 | 2020-05-22 | Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allow remote attacker to download and execu… |
CVE-2020-9474 | High | 8.8 | 2020-05-07 | The S. Siedle & Soehne SG 150-0 Smart Gateway before 1.2.4 allows remote code execution via the backup functionality in the web frontend. By using an exploit c… |
CVE-2020-7806 | High | 7.8 | 2020-05-06 | Tobesoft Xplatform 9.2.2.250 and earlier version have an arbitrary code execution vulnerability by using method supported by Xplatform ActiveX Control. It allo… |
CVE-2019-19167 | High | 7.8 | 2020-05-06 | Tobesoft Nexacro v2019.9.25.1 and earlier version have an arbitrary code execution vulnerability by using method supported by Nexacro14 ActiveX Control. It all… |
CVE-2019-19166 | High | 7.8 | 2020-05-06 | Tobesoft XPlatform v9.1, 9.2.0, 9.2.1 and 9.2.2 have a vulnerability that can load unauthorized DLL files. It allows attacker to cause remote code execution. |
CVE-2019-19165 | High | 7.2 | 2020-04-29 | AxECM.cab(ActiveX Control) in Inogard Ebiz4u contains a vulnerability that could allow remote files to be downloaded and executed by setting arguments to the a… |
CVE-2020-5867 | High | 8.1 | 2020-04-23 | In versions prior to 3.3.0, the NGINX Controller Agent installer script 'install.sh' uses HTTP instead of HTTPS to check and install packages |
CVE-2020-9759 | Medium | 4.6 | 2020-03-23 | A Vulnerability of LG Electronic web OS TV Emulator could allow an attacker to escalate privileges and overwrite certain files. This vulnerability is due to wr… |
CVE-2020-9751 | Critical | 9.1 | 2020-03-03 | Naver Cloud Explorer before 2.2.2.11 allows the system to download an arbitrary file from the attacker's server and execute it during the upgrade. |
CVE-2020-8809 | High | 8.1 | 2020-02-25 | Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection. A man-in-the-middle attacker can p… |
CVE-2020-5398 | High | 7.5 | 2020-01-17 | In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a refle… |
CVE-2010-3440 | Medium | 5.5 | 2019-11-12 | babiloo 2.0.9 before 2.0.11 creates temporary files with predictable names when downloading and unpacking dictionary files, allowing a local attacker to overwr… |
CVE-2019-3977 | High | 7.5 | 2019-10-29 | RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using the autoupgrade featur… |
CVE-2019-9534 | High | 7.8 | 2019-10-10 | The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image. Development scripts left in the firmware can be used to upload a custom f… |
CVE-2019-14845 | Medium | 5.3 | 2019-10-08 | A vulnerability was found in OpenShift builds, versions 4.1 up to 4.3. Builds that extract source from a container image, bypass the TLS hostname verification… |
CVE-2019-16760 | Medium | 4.6 | 2019-09-30 | Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration key. Usage of the `package` key to rena… |
CVE-2019-13534 | High | 7.2 | 2019-09-12 | Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501, WLAN Version B, Fi… |
CVE-2019-12809 | High | 8.8 | 2019-08-15 | Yes24ViewerX ActiveX Control 1.0.327.50126 and earlier versions contains a vulnerability that could allow remote attackers to download and execute arbitrary fi… |
CVE-2019-12162 | High | 7.8 | 2019-07-23 | Upwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash of the downloaded program update before running it, which could lead to code execution or local pr… |
CVE-2019-5982 | High | 7.5 | 2019-07-05 | Improper download file verification vulnerability in VAIO Update 7.3.0.03150 and earlier allows remote attackers to conduct a man-in-the-middle attack via a ma… |
CVE-2019-7229 | High | 8.3 | 2019-06-24 | The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: "Utilization of USB/SD Card to flash the device"… |
CVE-2019-12728 | High | 8.1 | 2019-06-04 | Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP. |
CVE-2018-5409 | Critical | 9.8 | 2019-05-08 | The PrinterLogic Print Management software, versions up to and including 18.3.1.96, updates and executes the code without sufficiently verifying the origin and… |
CVE-2019-10249 | High | 8.1 | 2019-05-06 | All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been compromised. |
CVE-2019-3801 | Critical | 9.8 | 2019-04-25 | Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote… |
CVE-2019-10248 | High | 8.1 | 2019-04-22 | Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. Any of these dependent artifacts could ha… |
CVE-2018-4009 | High | 7.8 | 2019-04-15 | An exploitable privilege escalation vulnerability exists in the Shimo VPN helper service due to improper validation of code signing. A user with local access c… |