CWE-494: Download of Code Without Integrity Check
The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- eclipse xtend, xtext, the eclipse foundation eclipse xtext +2 morePotentially compromised builds8.1 High
- cloud foundry cf-deployment, credhub, uaa release (oss) +2 more +4 moreJava Projects using HTTP to fetch dependencies8.7 High
- eclipse vorto, the eclipse foundation eclipse vorto +1 moreEclipse Vorto resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS8.1 High
- shimovpn shimo vpnAn exploitable privilege escalation vulnerability exists in the Shimo VPN helper service due to...8.8 High
- eclipse hawkbit, the eclipse foundation eclipse hawkbit +1 moreCleartext Transmission of Sensitive Information, Inclusion of Functionality from Untrusted Control Sphere , and Download of Code Without Integrity Check in Eclipse hawkBit8.1 High
- comparex miss marpleThe Miss Marple Updater Service in COMPAREX Miss Marple Enterprise Edition before 2.0 allows...8.8 High
- red hat openstack-rabbitmq-container, redhat openstack +1 moreThe OpenStack RabbitMQ container image insecurely retrieves the rabbitmq_clusterer component over...4.7 Medium
- shdesigns ethernet download manager, resident download manager +1 moreSHDesigns' Resident Download Manager (as well as the Ethernet Download Manager) does not authenticate firmware downloads before executing code and deploying them to devices9.8 Critical
- ragentek android software, beeline pro 2 firmware, bluproducts studio 6.0 hd firmware +17 more +19 moreRagentek Android software contains an over-the-air update mechanism that communicates over an unencrypted channel, which can allow a remote attacker to execute arbitrary code with root privileges8.1 High
- safensoft softcontrol enterprise suite, softcontrol syswatch, softcontrol tpsecure +2 moreDownload of code with improper integrity check in snsupd.exe and upd.exe in SAFE'N'SEC...8.1 High
- siemens logo\! soft comfortSiemens LOGO! Soft Comfort (All versions before V8.2) lacks integrity verification of software...5.9 Medium
- huawei vmallThe upgrade package of Huawei Vmall APP Earlier than HwVmall 1.5.3.0 versions is transferred...3.1 Low
- huawei technologies co., ltd. mate 9, huawei mate 9 firmware +1 moreMate 9 smartphones with software MHA-AL00AC00B125 have a privilege escalation vulnerability in...7.1 High
- cisco conference directorA vulnerability in the upgrade process of Cisco Spark Board could allow an authenticated, local...4.4 Medium
- akeo rufusAkeo Consulting Rufus prior to version 2.17.1187 does not adequately validate the integrity of...5.3 Medium
- sensys networks vsn240-f, vsn240-t, sensysnetworks trafficdot +1 more +3 moreSensys Networks Traffic Sensor Download of Code Without Integrity Check6.5
- party gaming poker clientThe PartyGaming PartyPoker client program 121/120 does not properly verify the authenticity of...8.1 High
- apple mac os xApple Mac OS X does not properly verify the authenticity of updates, which allows man-in-the...8.1 High
- pingtel xpressa firmwarePingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 downloads phone applications...9.8 Critical
- symantec liveupdateSymantec LiveUpdate before 1.6 does not use cryptography to ensure the integrity of download...9.8 Critical