CWE-494: Download of Code Without Integrity Check
The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- iteachyou dreamer cmsIn Dreamer CMS before 4.0.1, the backend attachment management office has an Arbitrary File...7.5 High
- schneider electric ion8650, ion8800, schneider-electric ion8650 firmware +1 more +3 moreA CWE-494 Download of Code Without Integrity Check vulnerability exists that could allow...7.2 High
- mlsoft tco!stream, tco\!stream +1 moreMLSoft TCO!stream Remote Code Execution Vulnerability7.2 High
- artifacthub hubIncorrect Docker Hub registry check in Artifact Hub5.4 Medium
- synel terminals, bioentry-w2 firmware, bioentry p2 firmware +19 more +21 moreSynel Terminals - CWE-494: Download of Code Without Integrity Check7.2 High
- silabs gecko bootloaderSecond Stage Gecko Bootloader GBL Parser Buffer Overrun Vulnerability9.8 Critical
- genians genian nac suite v5.0, genian nac v4.0, genian nac v5.0 +2 more +4 moreDownload of Code Without Integrity Check vulnerability in Genians Genian NAC V4.0, Genians Genian...7.5 High
- phoenix contact wp 6070-wvps, wp 6101-wxps, wp 6121-wxps +9 more +11 morePHOENIX CONTACT: WP 6xxx Web panels prone to download code without integrity check7.2 High
- gin-gonic gin, github.com/gin-gonic/gin +1 moreImproper handling of filenames in Content-Disposition HTTP header in github.com/gin-gonic/gin4.3 Medium
- rocket.chatA vulnerability has been discovered in Rocket.Chat, where editing messages can change the...5.3 Medium
- electra-air smart kit for split ac, electra osk201 +1 moreElectra Smart Kit for Split AC – Adjacent attacker may cause the unit to load unauthorized FW7.5 High
- electra central ac unit, electra-air central ac unit firmware +1 moreElectra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW7.5 High
- fortinet forticlient, forticlientmac +1 moreA download of code without Integrity check vulnerability [CWE-494] in FortiClientMac version 7.0...6.9 Medium
- ruoyiRuoYi vulnerable to arbitrary file download7.5 High
- veritas netbackup it analytics, aptare it analytics +1 moreAn issue was discovered in Veritas NetBackup IT Analytics 11 before 11.2.0. The application...5.3 Medium
- shadowsocks shadowsocksx-ngShadowsocksX-NG 1.10.0 signs with com.apple.security.get-task-allow entitlements because of...9.8 Critical
- netgear d6100 firmware, dgn1000v3 firmware, r8900 firmware +6 more +8 moreAn exploitable firmware modification vulnerability was discovered in WNR612v2 Wireless Routers...7.4 High
- ruckuswireless r310 firmware, r500 firmware, r600 firmware +11 more +13 moreIn Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5...9.8 Critical
- ruckuswireless r310 firmware, r500 firmware, r600 firmware +11 more +13 moreIn Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5...9.8 Critical
- ge inet 900 firmware, inet ii 900 firmware, sd1 firmware +5 more +7 moreCertain General Electric Renewable Energy products download firmware without an integrity check....9.8 Critical
- tp-link tl-wr740n v1 firmware, tl-wr740n v2 firmware, tl-wr741nd v1 firmware +1 more +3 moreTP-Link TL-WR740N V1 and V2 v3.12.4 and earlier allows authenticated attackers to execute...4.8 Medium
- tp-link tl-wr1043nd v1 firmwareTP-Link TL-WR1043ND V1 3.13.15 and earlier allows authenticated attackers to execute arbitrary...4.8 Medium
- netgear wnr2000 firmwareAn exploitable firmware modification vulnerability was discovered on the Netgear WNR2000v1 router...8.1 High
- rapid7 insightvm, nexpose +1 moreRapid7 Nexpose Update Validation Issue4.4 Medium
- d-link dnr-322l, dlink dnr-322l firmware +1 moreData Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated...8.8 High
- sinatra, debian linux +1 moreSinatra vulnerable to Reflected File Download attack8.8 High
- arubanetworks arubaos, sd-wan, hewlett packard enterprise aruba mobility conductor (formerly mobility master); aruba mobility controllers; wlan gateways and sd-wan gateways managed by aruba central +2 moreAn authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series...5.8 Medium
- esri arcgis serverBUG-000144172 - Remote file download issue in ArcGIS Server6.1 Medium
- pentasecurity wapplesAn arbitrary file download vulnerability in the downloadAction() function of Penta Security...6.5 Medium
- softlinkint oliver v5 libraryAn arbitrary file download vulnerability in Oliver v5 Library Server Versions < 5.00.008.053 via...7.5 High
- xxyopen novel-plusNovel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the...7.5 High
- wisa smart wing cmsWISA Smart Wing CMS File Download Vulnerability8.1 High
- djangoproject django, debian linux +1 moreDjango vulnerable to Reflected File Download attack8.8 High
- honeywell safety manager firmwareHoneywell Experion PKS Safety Manager (SM and FSC) through 2022-05-06 has Insufficient...9.8 Critical
- iobit advanced system care, driver booster, itop screen recorder +2 more +4 moreIOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop...6.6 Medium
- hitachi energy txpert hub coretec 4 version, hitachienergy txpert hub coretec 4 firmware +1 moreFirmware upload verification bypass in TXpert Hub CoreTec 46.7 Medium
- caphyon advanced installer, 3cx call flow designer, crm template generator +67 more +69 moreCaphyon Ltd Advanced Installer 19.2 was discovered to contain a remote code execution (RCE)...8.1 High
- emcosoftware msi package builder, network inventory, network software scanner +5 more +7 moreCertain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check...8.8 High
- tipaskIn Tipask < 3.5.9, path parameters entered by the user are not validated when downloading...7.7 High
- zoom meetings, rooms, zoom video communications inc client for meetings for windows +1 more +3 moreUpdate package downgrade in Zoom Client for Meetings for Windows7.5 High
- zzinc keymouse firmwareZZ Inc. KeyMouse Windows 3.08 and prior is affected by a remote code execution vulnerability...8.8 High
- fortinet fortiosA download of code without integrity check vulnerability in the "execute restore src-vis" command...3.3 Low
- wowsoft printchaserPrintchaser v2.2021.804.1 and earlier versions contain a vulnerability, which could allow remote...9.8 Critical
- raonwiz dext5 upload, dext5 dext5upload +1 moreRAONWIZ DEXT5 Upload ActiveX remote file execution vulnerability7.5 High
- tobesoft nexacro, nexacro14 +1 moreNEXACRO14 Runtime arbitrary file download and execution vulnerability8.8 High
- ksystem k-system wellcommDownload of code without integrity check vulnerability in ActiveX control of Younglimwon Co., Ltd...8.8 High
- apple macos, mac os x +1 moreA logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur...5.5 Medium
- apple macosThis issue was addressed with improved handling of file metadata. This issue is fixed in macOS...5.5 Medium
- apple macos, mac os x +1 moreA logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur...5.5 Medium
- parse-community parse-serverParse Server - Arbitrary Code Execution via Malicious Version Tags7.7 High
- Show moreLoading…