CWE-494: Download of Code Without Integrity Check
The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- parse-community parse-serverParse Server - Unreviewed Code Execution via Malicious Version Tags7.7 High
- cpanelIn cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC...8.1 High
- tencent gameloopTencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP connection. A...8.1 High
- bitdefender endpoint security tools for linux, endpoint security tools +1 moreImproper Input Validation in Bitdefender Endpoint Security Tools for Linux6.4 Medium
- remotemouse emote remote mouseAn issue was discovered in Emote Remote Mouse through 4.0.0.0. It uses cleartext HTTP to check,...8.1 High
- secomea gatemanager, gatemanager 8250 firmware +1 moreAdd integrity check of GateManager firmware8.4 High
- jenkins installation manager tool, jenkins project plugin installation manager tool +1 moreJenkins Plugin Installation Manager Tool did not verify plugin downloads9.8 Critical
- appimage appimagedAppImage appimaged before 1.0.3 does not properly check whether a downloaded file is a valid...5.5 Medium
- barco wepresent wipg-1600w firmwareBarco wePresent WiPG-1600W devices download code without an Integrity Check. Affected Version(s):...9.8 Critical
- schneider-electric ecostruxure control expertA CWE-494: Download of Code Without Integrity Check vulnerability exists in PLC Simulator on...8.8 High
- trend micro security (consumer), trend micro, inc. micro security (consumer), trendmicro antivirus\+ 2019 +4 more +6 moreAn incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 ...7.5 High
- microsoft sharepoint server, sharepoint enterprise server 2013 service pack 1, sharepoint enterprise server 2016 +4 more +6 moreMicrosoft SharePoint Remote Code Execution Vulnerability9.9 Critical
- microsoft sharepoint server, sharepoint enterprise server 2013 service pack 1, sharepoint enterprise server 2016 +6 more +8 moreMicrosoft SharePoint Remote Code Execution Vulnerability8.5 High
- microsoft sharepoint server, sharepoint enterprise server 2013 service pack 1, sharepoint enterprise server 2016 +5 more +7 moreMicrosoft SharePoint Remote Code Execution Vulnerability8.6 High
- microsoft sharepoint server, sharepoint enterprise server 2013 service pack 1, sharepoint enterprise server 2016 +5 more +7 moreMicrosoft SharePoint Remote Code Execution Vulnerability8.6 High
- microsoft sharepoint server, business productivity servers 2010 service pack 2, sharepoint enterprise server 2013 service pack 1 +5 more +7 moreMicrosoft SharePoint Remote Code Execution Vulnerability9.9 Critical
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint foundation 2010 service pack 2 +4 more +6 moreMicrosoft SharePoint Remote Code Execution Vulnerability8.6 High
- inogard ebiz4u, ebiz4u cviewer object axecm.dll +1 moreA vulnerability in the web-based contract management service interface Ebiz4u of INOGARD could...8.8 High
- activesoft mybrowserplus, raonwiz k upload +1 moreMyBrowserPlus downloads the files needed to run the program through the setup file (Setup.inf)....5.5 Medium
- teltonika-networks trb245 firmwareImproper Input Validation in Teltonika firmware TRB2_R_00.02.04.01 allows a remote, authenticated...7.5 High
- netgear r6700, r6700 firmware +1 moreThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected...7.5 High
- ibm marketing operationsUsing HCL Marketing Operations 9.1.2.4, 10.1.x, 11.1.0.x, a malicious attacker could download...8.1 High
- bflysoft eyesurfer bflyinstallerx.ocx, eyesurfer bflyinstallerx.ocx +1 moreEyeSurfer BflyInstallerX.ocx v1.0.0.16 and earlier versions contain a vulnerability that could...8.8 High
- schneider-electric easergy t300 firmwareA CWE-494 Download of Code Without Integrity Check vulnerability exists in Easergy T300 (Firmware...7.2 High
- kaoni ezhttptransKaoni ezHTTPTrans Active-X File Download and Execution Vulnerability7.8 High
- kaoni ezhttptransKaoni ezHTTPTrans Active-X File Download and Execution Vulnerability7.8 High
- siedle sg 150-0 firmwareThe S. Siedle & Soehne SG 150-0 Smart Gateway before 1.2.4 allows remote code execution via the...8.8 High
- tobesoft xplatformTobesoft Xplatform ActiveX File Download Vulnerability7.8 High
- tobesoft nexacro, nexacro14 +1 moreTobesoft Nexacro14 ActiveX File Download Vulnerability7.8 High
- tobesoft xplatformTobesoft XPlatform Arbitrary File Execution Vulnerability7.8 High
- inogard activex, inogard co,,ltd ebiz4u activex of inogard co,,ltd(axecm.cab) on windows 7/8/10 +1 moreAxECM.cab(ActiveX Control) in Inogard Ebiz4u contains a vulnerability that could allow remote...7.2 High
- f5 nginx controller, netapp cloud backup +1 moreIn versions prior to 3.3.0, the NGINX Controller Agent installer script 'install.sh' uses HTTP...8.1 High
- lg weboswebOS TV Emulator privilege escalation vulnerability4.6 Medium
- trendmicro apex one, officescan, worry-free business security +2 more +4 moreTrend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0)...8.8 High
- naver cloud explorerNaver Cloud Explorer before 2.2.2.11 allows the system to download an arbitrary file from the...9.1 Critical
- gurux device language message specification directorGurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an...8.1 High
- spring framework, vmware spring framework, netapp data availability services +31 more +33 moreRFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application8.0 High
- babiloo, debian linux +1 morebabiloo 2.0.9 before 2.0.11 creates temporary files with predictable names when downloading and...5.5 Medium
- mikrotik routeros, tenable mikrotik routeros +1 moreRouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where...7.5 High
- cobham plc explorer 710, cobham explorer 710 firmware +1 moreThe Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image7.8 High
- red hat openshiftA vulnerability was found in OpenShift builds, versions 4.1 up to 4.3. Builds that extract source from a container image, bypass the TLS hostname verification. An attacker can take advantage of this f…5.7 Medium
- rust cargo, rust-lang rust +1 moreCargo prior to Rust 1.26.0 may download the wrong dependency4.6 Medium
generator-jhipsternpmHigh severity vulnerability that affects generator-jhipster8.1 High- philips intellivue mp monitors mp20-mp90 firmware, intellivue mp monitors mp2\/x2 firmware, intellivue mp monitors mp5\/5sc firmware +1 more +3 morePhilips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN...7.2 High
- yes24 viewer activex, pc viewer +1 moreYes24ViewerX ActiveX Control 1.0.327.50126 and earlier versions contains a vulnerability that...8.8 High
- upwork time trackerUpwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash of the downloaded program update...7.8 High
- sony vaio updateImproper download file verification vulnerability in VAIO Update 7.3.0.03150 and earlier allows...7.5 High
- abb board support package un31, cp620-web firmware, cp620 firmware +5 more +7 moreThe ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its...8.3 High
- grailsIncorrect Resource Transfer Between Spheres in Grails8.1 High
- printerlogic management software, print management +1 morePrinterLogic Print Management Software updates and executes the code without origin and code verification9.8 Critical
- Show moreLoading…