CWE-494: Download of Code Without Integrity Check
The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- thorsten phpmyfaqphpMyFAQ before 4.1.6 Remote Code Execution via Configuration API9.4 Critical
- labring fastgptFastGPT: Untrusted PR artifacts are pushed and deployed by privileged preview workflows9.3 Critical
- pnpmpnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes8.8 High
- pnpmpnpm: Repository-controlled configDependencies can select a pacquet native install engine7.5 High
- angular, angular language service +1 moreAngular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code Extension8.7 High
esbuildRoot,@rootio/esbuildRoot +1 moreWithdrawn Advisory: esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY8.1 High- eidetic-labs stigmemstigmem Plugin Signature Enforcement Bypass via Configuration7.3 High
- xcharge c6Download of code without integrity check in XCharge C69.3 Critical
- connectwise automateThe ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained...8.8 High
- electermelecterm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmark9.4 Critical
- chainguard-dev apkoapko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)7.5 High
- hexLockfile checksums not verified in Hex allows dependency integrity bypass8.9 High
- ollamaRemote Code Execution in Ollama via Update Mechanism7.7 High
- ollamaMissing Signature Verification for Updates in Ollama7.7 High
- desktime time tracking app, draugiemgroup desktime time tracking +1 moreImproper TLS Certificate Validation RCE via Malicious Update in DeskTime Time Tracking App4.8 Medium
- anviz cx2 lite firmware, cx7 firmware +1 moreAnviz Products Download of Code Without Integrity Check8.8 High
- asus member center(华硕大厅)A Download of Code Without Integrity Check vulnerability in the update modules in ASUS Member...5.4 Medium
- usebruno brunoAxios npm Supply Chain Incident Impacting @usebruno/cli9.8 Critical
- No product listedAn issue in the firmware update mechanism of Qianniao QN-L23PA0904 v20250721.1640 allows...6.8 Medium
- trueconf client, trueconf +1 moreTrueConf Client Update Integrity Verification Bypass7.8 High
- fastgptFastGPT has Arbitrary Code Execution in GitHub Actions via pull_request_target in fastgpt-preview-image.yml9.4 Critical
- linuxfoundation onnx, red hat openshift ai (rhoai), openshift ai 2.25 +2 moreONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack8.6 High
- asus driver( headset ), driver( keyboard & mouse ) +1 moreAn Insufficient Integrity Verification vulnerability in the ASUS ROG peripheral driver...5.4 Medium
- changing idexpert windows logon agent, changingtec idexpert +1 moreChanging｜IDExpert Windows Logon Agent - Remote Code Execution9.3 Critical
- changing idexpert windows logon agent, changingtec idexpert +1 moreChanging｜IDExpert Windows Logon Agent - Remote Code Execution9.3 Critical
- microchip time provider 4100, timeprovider 4100 firmware +1 moreUnsigned upgrade package5.7 Medium
- mjdm majordomoMajorDoMo Supply Chain Remote Code Execution via Update URL Poisoning9.3 Critical
- solax power pocket wifi 3.0, pocket wifi 4.0, pocket wifi+4gm +2 more +4 moreMissing Firmware Authenticity Checks in Solax Power Pocket WiFi models5.3 Medium
- sumatrapdfreader sumatrapdfSumatraPDF Update MITM -> Arbitrary Code Execution7.5 High
- cisco secure web applianceCisco Secure Web Appliance TBD Bypass Vulnerability4.0 Medium
- notepad++, notepad-plus-plus, notepad-plus-plus notepad\+\+ +2 moreNotepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification7.7 High
- gradleGradle's failure to disable repositories failing to answer can expose builds to malicious artifacts8.6 High
- gradleGradle fails to disable repositories which can expose builds to malicious artifacts8.6 High
- pnpm, red hat jboss enterprise application platform 8, jboss enterprise application platform expansion pack +2 morepnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependencies7.5 High
- churchcrm, churchcrm crm +1 moreChurchCRM vulnerable to RCE with database restore functionality9.1 Critical
- netun helpflash iot firmwareThe OTA firmware update mechanism in Netun Solutions HelpFlash IoT (firmware...6.6 Medium
- connectwise screenconnectImproper server-side validation in ScreenConnect extension framework9.1 Critical
- foxit pdf editor, pdf reader +1 moreAn issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before...7.3 High
- huawei harmonyosDenial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of...3.3 Low
- huawei harmonyosDenial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of...3.3 Low
- huawei harmonyosDenial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of...3.3 Low
- huawei harmonyosDenial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of...3.3 Low
- shirt-pocket superduper\!An issue in Shirt Pocket SuperDuper! V.3.10 and before allows a local attacker to execute...7.8 High
- xtooltech xtool anyscanThe update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure...8.8 High
- sonicwall email security, email security appliance 5000 firmware, email security appliance 5050 firmware +3 more +5 moreDownload of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance...9.8 Critical
- sound4 first firmwareThe Sound4 FIRST web-based management interface is vulnerable to Remote Code Execution (RCE) via...7.2 High
- sound4 impact firmwareThe Sound4 IMPACT web-based management interface is vulnerable to Remote Code Execution (RCE) via...7.2 High
- No product listedAn issue in the Web Configuration module of Startcharge Artemis AC Charger 7-22 kW v1.0.4 allows...8.0 High
- connectwise automateSelf-Update Verification Mechanism Process in ConnectWise Automate8.8 High
- gtone changeflowFile Download in GTONE ChangeFlow7.1 High
- Show moreLoading…