CWE-494 · Download of Code Without Integrity Check (page 3)
Page 3 of 3 — CVEs classified under CWE-494, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-7806 | High | 7.8 | 2020-05-06 | Tobesoft Xplatform 9.2.2.250 and earlier version have an arbitrary code execution vulnerability by using method supported by Xplatform ActiveX Control. It allo… |
CVE-2019-19167 | High | 7.8 | 2020-05-06 | Tobesoft Nexacro v2019.9.25.1 and earlier version have an arbitrary code execution vulnerability by using method supported by Nexacro14 ActiveX Control. It all… |
CVE-2019-19166 | High | 7.8 | 2020-05-06 | Tobesoft XPlatform v9.1, 9.2.0, 9.2.1 and 9.2.2 have a vulnerability that can load unauthorized DLL files. It allows attacker to cause remote code execution. |
CVE-2019-19165 | High | 7.2 | 2020-04-29 | AxECM.cab(ActiveX Control) in Inogard Ebiz4u contains a vulnerability that could allow remote files to be downloaded and executed by setting arguments to the a… |
CVE-2020-5867 | High | 8.1 | 2020-04-23 | In versions prior to 3.3.0, the NGINX Controller Agent installer script 'install.sh' uses HTTP instead of HTTPS to check and install packages |
CVE-2020-9759 | Medium | 4.6 | 2020-03-23 | A Vulnerability of LG Electronic web OS TV Emulator could allow an attacker to escalate privileges and overwrite certain files. This vulnerability is due to wr… |
CVE-2020-9751 | Critical | 9.1 | 2020-03-03 | Naver Cloud Explorer before 2.2.2.11 allows the system to download an arbitrary file from the attacker's server and execute it during the upgrade. |
CVE-2020-8809 | High | 8.1 | 2020-02-25 | Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection. A man-in-the-middle attacker can p… |
CVE-2020-5398 | High | 7.5 | 2020-01-17 | In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a refle… |
CVE-2010-3440 | Medium | 5.5 | 2019-11-12 | babiloo 2.0.9 before 2.0.11 creates temporary files with predictable names when downloading and unpacking dictionary files, allowing a local attacker to overwr… |
CVE-2019-3977 | High | 7.5 | 2019-10-29 | RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using the autoupgrade featur… |
CVE-2019-9534 | High | 7.8 | 2019-10-10 | The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image. Development scripts left in the firmware can be used to upload a custom f… |
CVE-2019-14845 | Medium | 5.3 | 2019-10-08 | A vulnerability was found in OpenShift builds, versions 4.1 up to 4.3. Builds that extract source from a container image, bypass the TLS hostname verification… |
CVE-2019-16760 | Medium | 4.6 | 2019-09-30 | Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration key. Usage of the `package` key to rena… |
CVE-2019-13534 | High | 7.2 | 2019-09-12 | Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501, WLAN Version B, Fi… |
CVE-2019-12809 | High | 8.8 | 2019-08-15 | Yes24ViewerX ActiveX Control 1.0.327.50126 and earlier versions contains a vulnerability that could allow remote attackers to download and execute arbitrary fi… |
CVE-2019-12162 | High | 7.8 | 2019-07-23 | Upwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash of the downloaded program update before running it, which could lead to code execution or local pr… |
CVE-2019-5982 | High | 7.5 | 2019-07-05 | Improper download file verification vulnerability in VAIO Update 7.3.0.03150 and earlier allows remote attackers to conduct a man-in-the-middle attack via a ma… |
CVE-2019-7229 | High | 8.3 | 2019-06-24 | The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: "Utilization of USB/SD Card to flash the device"… |
CVE-2019-12728 | High | 8.1 | 2019-06-04 | Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP. |
CVE-2018-5409 | Critical | 9.8 | 2019-05-08 | The PrinterLogic Print Management software, versions up to and including 18.3.1.96, updates and executes the code without sufficiently verifying the origin and… |
CVE-2019-10249 | High | 8.1 | 2019-05-06 | All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been compromised. |
CVE-2019-3801 | Critical | 9.8 | 2019-04-25 | Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote… |
CVE-2019-10248 | High | 8.1 | 2019-04-22 | Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. Any of these dependent artifacts could ha… |
CVE-2018-4009 | High | 7.8 | 2019-04-15 | An exploitable privilege escalation vulnerability exists in the Shimo VPN helper service due to improper validation of code signing. A user with local access c… |
CVE-2019-10240 | High | 8.1 | 2019-04-03 | Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts c… |
CVE-2018-19234 | High | 8.8 | 2018-12-20 | The Miss Marple Updater Service in COMPAREX Miss Marple Enterprise Edition before 2.0 allows remote attackers to execute arbitrary code with SYSTEM privileges… |
CVE-2018-14620 | Medium | 4.7 | 2018-09-10 | The OpenStack RabbitMQ container image insecurely retrieves the rabbitmq_clusterer component over HTTP during the build stage. This could potentially allow an… |
CVE-2016-6567 | Critical | 9.8 | 2018-07-13 | SHDesigns' Resident Download Manager provides firmware update capabilities for Rabbit 2000/3000 CPU boards, which according to the reporter may be used in some… |
CVE-2016-6564 | High | 8.1 | 2018-07-13 | Android devices with code from Ragentek contain a privileged binary that performs over-the-air (OTA) update checks. Additionally, there are multiple techniques… |
CVE-2018-13012 | High | 8.1 | 2018-06-29 | Download of code with improper integrity check in snsupd.exe and upd.exe in SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft TPSecure, and Soft… |
CVE-2017-12740 | Medium | 5.9 | 2017-12-26 | Siemens LOGO! Soft Comfort (All versions before V8.2) lacks integrity verification of software packages downloaded via an unprotected communication channel. Th… |
CVE-2017-2739 | Low | 3.1 | 2017-11-22 | The upgrade package of Huawei Vmall APP Earlier than HwVmall 1.5.3.0 versions is transferred through HTTP. A man in the middle (MITM) can tamper with the upgra… |
CVE-2017-2707 | High | 7.1 | 2017-11-22 | Mate 9 smartphones with software MHA-AL00AC00B125 have a privilege escalation vulnerability in Push module. An attacker tricks a user to save a rich media into… |
CVE-2017-12306 | Medium | 4.4 | 2017-11-16 | A vulnerability in the upgrade process of Cisco Spark Board could allow an authenticated, local attacker to install an unverified upgrade package, aka Signatur… |
CVE-2017-13083 | Medium | 5.3 | 2017-10-18 | Akeo Consulting Rufus prior to version 2.17.1187 does not adequately validate the integrity of updates downloaded over HTTP, allowing an attacker to easily con… |
CVE-2014-2378 | | 2014-09-05 | Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not verify the integrity of downloaded updates, which allows re… | |
CVE-2008-3324 | High | 8.1 | 2008-08-18 | The PartyGaming PartyPoker client program 121/120 does not properly verify the authenticity of updates, which allows remote man-in-the-middle attackers to exec… |
CVE-2008-3438 | High | 8.1 | 2008-08-01 | Apple Mac OS X does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse upda… |
CVE-2002-0671 | Critical | 9.8 | 2002-07-23 | Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 downloads phone applications from a web site but can not verify the integrity of the applic… |
CVE-2001-1125 | Critical | 9.8 | 2001-10-05 | Symantec LiveUpdate before 1.6 does not use cryptography to ensure the integrity of download files, which allows remote attackers to execute arbitrary code via… |