# CWE-354.

Every Advisory and CVE whose sources give the weakness CWE-354, newest first.

## Records, newest first (an older page)

- [PHPECC vulnerable to multiple cryptographic side-channel attacks](https://agentprime.io/advisories/GHSA-346h-749j-r28w.md)
  `GHSA-346h-749j-r28w`, `PKSA-36gf-zqdd-tq5m` · Packagist `mdanter/ecc`: affected `<=1.0.0`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Apr 2024 · Tags: Information disclosure, CWE-354
- [In LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled.](https://agentprime.io/advisories/CVE-2024-25678.md)
  `CVE-2024-25678` · CVE record · CVSS 5.9 Medium · Not analysed yet · Published 9 Feb 2024 · Tags: CWE-354
- [Missing Integrity Check in Shelly TRV 20220811-152343/v2.1.8@5afc928c allows malicious users to create a backdoor by redirecting the device to an attacker-controlled machine which serves the manipula…](https://agentprime.io/advisories/CVE-2023-42143.md)
  `CVE-2023-42143` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 23 Jan 2024 · Tags: CWE-354
- [Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin](https://agentprime.io/advisories/GHSA-45x7-px36-x8w8.md)
  `GHSA-45x7-px36-x8w8`, `CVE-2023-48795`, `GO-2023-2402`, `PYSEC-2026-1758` · crates.io `russh` and 2 more: affected `<0.40.2`, fixed in `0.40.2` · CVSS 5.9 Medium · EPSS 0.94 · Not analysed yet · Published 18 Dec 2023 · Tags: CWE-345, CWE-354
- [Disable Zscaler using machine tunnel restart](https://agentprime.io/advisories/CVE-2023-28802.md)
  `CVE-2023-28802` · CVE record: Zscaler Client Connector · CVSS 4.9 Medium · Not analysed yet · Published 21 Nov 2023 · Tags: CWE-354
- [Fortinet FortiOS: An improper validation of integrity check value vulnerability \[CWE-354\] in FortiOS 7.2.0…](https://agentprime.io/advisories/CVE-2023-28002.md)
  `CVE-2023-28002` · CVE record: Fortinet FortiOS and 1 more · CVSS 5.8 Medium · Not analysed yet · Published 14 Nov 2023 · Tags: CWE-354
- [AsyncSSH Rogue Session Attack](https://agentprime.io/advisories/GHSA-c35q-ffpf-5qpm.md)
  `GHSA-c35q-ffpf-5qpm`, `CVE-2023-46446`, `PYSEC-2023-239` · PyPI `asyncssh`: affected `<2.14.1`, fixed in `2.14.1` · CVSS 8.1 High · Not analysed yet · Published 9 Nov 2023 · Tags: Information disclosure, Broken access control, CWE-345, CWE-349
- [AsyncSSH Rogue Extension Negotiation](https://agentprime.io/advisories/GHSA-cfc2-wr2v-gxm5.md)
  `GHSA-cfc2-wr2v-gxm5`, `CVE-2023-46445`, `PYSEC-2023-237` · PyPI `asyncssh`: affected `<2.14.1`, fixed in `2.14.1` · CVSS 5.3 Medium · Not analysed yet · Published 9 Nov 2023 · Tags: CWE-345, CWE-349, CWE-354
- [NPort 5000 Series Firmware Improper Validation of Integrity Check Vulnerability](https://agentprime.io/advisories/CVE-2023-4929.md)
  `CVE-2023-4929` · CVE record: Moxa NPort 5000AI-M12 Series and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 3 Oct 2023 · Tags: CWE-354
- [AES-SIV implementation ignores empty associated data entries](https://agentprime.io/advisories/CVE-2023-2975.md)
  `CVE-2023-2975` · CVE record: OpenSSL OpenSSL · CVSS 5.3 Medium · Not analysed yet · Published 14 Jul 2023 · Tags: CWE-354
- [Zoom Video Communications, Inc. Zoom Rooms for Windows: Improper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow…](https://agentprime.io/advisories/CVE-2023-36537.md)
  `CVE-2023-36537` · CVE record: Zoom Video Communications, Inc. Zoom Rooms for Windows · CVSS 7.3 High · Not analysed yet · Published 11 Jul 2023 · Tags: CWE-354
- [OpenZeppelin Contracts using MerkleProof multiproofs may allow proving arbitrary leaves for specific trees](https://agentprime.io/advisories/GHSA-wprv-93r4-jj2p.md)
  `GHSA-wprv-93r4-jj2p`, `CVE-2023-34459` · npm `@openzeppelin/contracts` and 1 more: affected `>=4.7.0, <4.9.2`, fixed in `4.9.2` · CVSS 5.3 Medium · Not analysed yet · Published 19 Jun 2023 · Tags: CWE-354
- [An issue was discovered in systemd 253.](https://agentprime.io/advisories/CVE-2023-31437.md)
  `CVE-2023-31437` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 13 Jun 2023 · Tags: CWE-354
- [Briar before 1.4.22 allows attackers to spoof other users' messages in a blog, forum, or private group, but each spoofed message would need to be an exact duplicate of a legitimate message displayed…](https://agentprime.io/advisories/CVE-2023-33981.md)
  `CVE-2023-33981` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 24 May 2023 · Tags: CWE-354
- [Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly.](https://agentprime.io/advisories/CVE-2023-28386.md)
  `CVE-2023-28386` · CVE record: Snap One OvrC Cloud · CVSS 8.6 High · Not analysed yet · Published 22 May 2023 · Tags: CWE-354
- [Missing Support for an Integrity Check in Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows attackers to update the device with crafted firmware](https://agentprime.io/advisories/CVE-2023-30356.md)
  `CVE-2023-30356` · CVE record · CVSS 7.5 High · Not analysed yet · Published 10 May 2023 · Tags: CWE-354
- [ICEPAY REST-API-NET Checksum Validation RestClient.cs RestClient integrity check](https://agentprime.io/advisories/CVE-2016-15028.md)
  `CVE-2016-15028` · CVE record: ICEPAY REST-API-NET · CVSS 4.8 Medium · Not analysed yet · Published 12 Mar 2023 · Tags: CWE-354
- [The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp.](https://agentprime.io/advisories/CVE-2022-45142.md)
  `CVE-2022-45142` · CVE record: Samba · CVSS 7.5 High · Not analysed yet · Published 6 Mar 2023 · Tags: CWE-354
- [An issue was discovered on Microchip RN4870 1.43 devices.](https://agentprime.io/advisories/CVE-2022-45191.md)
  `CVE-2022-45191` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 7 Feb 2023 · Tags: CWE-354
- [The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes TRENDnet TV-IP651WI Network Camera firmware version v1.07.01 and earlier vulnerable to firmware…](https://agentprime.io/advisories/CVE-2023-23120.md)
  `CVE-2023-23120` · CVE record · CVSS 5.9 Medium · Not analysed yet · Published 2 Feb 2023 · Tags: CWE-354
- [The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes Ubiquiti airFiber AF2X Radio firmware version 3.2.2 and earlier vulnerable to firmware modifica…](https://agentprime.io/advisories/CVE-2023-23119.md)
  `CVE-2023-23119` · CVE record · CVSS 5.9 Medium · Not analysed yet · Published 2 Feb 2023 · Tags: CWE-354
- [The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PairCon_rmSend with incorrect values.](https://agentprime.io/advisories/CVE-2022-46402.md)
  `CVE-2022-46402` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 19 Dec 2022 · Tags: CWE-354
- [An exploitable firmware modification vulnerability was discovered on the Netgear WPN824EXT WiFi Range Extender.](https://agentprime.io/advisories/CVE-2022-38955.md)
  `CVE-2022-38955` · CVE record · CVSS 7.5 High · Not analysed yet · Published 20 Sept 2022 · Tags: CWE-354
- [An exploitable firmware downgrade vulnerability was discovered on the Netgear WPN824EXT WiFi Range Extender.](https://agentprime.io/advisories/CVE-2022-38956.md)
  `CVE-2022-38956` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 20 Sept 2022 · Tags: CWE-354
- [Samsung Mobile Samsung Kies: Improper validation of integrity check vulnerability in Samsung Kies prior to version…](https://agentprime.io/advisories/CVE-2022-39845.md)
  `CVE-2022-39845` · CVE record: Samsung Mobile Samsung Kies · CVSS 5.5 Medium · Not analysed yet · Published 9 Sept 2022 · Tags: CWE-354
- [Samsung Mobile Smart Switch PC: Improper validation of integrity check vulnerability in Smart Switch PC prior to version…](https://agentprime.io/advisories/CVE-2022-39844.md)
  `CVE-2022-39844` · CVE record: Samsung Mobile Smart Switch PC · CVSS 5.5 Medium · Not analysed yet · Published 9 Sept 2022 · Tags: CWE-354
- [OpenZeppelin Contracts vulnerable to ECDSA signature malleability](https://agentprime.io/advisories/GHSA-4h98-2769-gh6h.md)
  `GHSA-4h98-2769-gh6h`, `CVE-2022-35961` · npm `@openzeppelin/contracts` and 1 more: affected `>=4.1.0, <4.7.3`, fixed in `4.7.3` · CVSS 7.9 High · Not analysed yet · Published 18 Aug 2022 · Tags: CWE-354
- [Samsung Mobile Samsung USB Driver Windows Installer for…: Improper validation of integrity check vulnerability in Samsung USB Driver Windows…](https://agentprime.io/advisories/CVE-2022-33711.md)
  `CVE-2022-33711` · CVE record: Samsung Mobile Samsung USB Driver Windows Installer for Mobile Phones · No CVSS score · Not analysed yet · Published 11 Jul 2022 · Tags: CWE-354
- [Version rollback attack in github.com/theupdateframework/go-tuf](https://agentprime.io/advisories/GHSA-66x3-6cw3-v5gj.md)
  `GHSA-66x3-6cw3-v5gj`, `CVE-2022-29173`, `GO-2022-0444` · Go `github.com/theupdateframework/go-tuf`: affected `<0.3.0`, fixed in `0.3.0` · CVSS 8.0 High · Not analysed yet · Published 1 Jul 2022 · Tags: CWE-354
- [Siemens SCALANCE XM408-4C: A vulnerability has been identified in SCALANCE XM408-4C (All versions < V6.5)…](https://agentprime.io/advisories/CVE-2021-37182.md)
  `CVE-2021-37182` · CVE record: Siemens SCALANCE XM408-4C and 4 more · No CVSS score · Not analysed yet · Published 14 Jun 2022 · Tags: CWE-354
- [Moodle Grade information disclosure in grade's external fetch functions](https://agentprime.io/advisories/GHSA-mm73-86f9-5x5c.md)
  `GHSA-mm73-86f9-5x5c`, `BIT-moodle-2021-20184`, `CVE-2021-20184`, `PKSA-wrs3-rn1k-6ysb` · Packagist `moodle/moodle`: affected `>=3.8, <3.8.7 || >=3.9, <3.9.4 || >=3.10, <3.10.1`, fixed in `3.8.7`, `3.9.4`, `3.10.1` · CVSS 4.3 Medium · Not analysed yet · Published 24 May 2022 · Tags: CWE-354
- [Nimbus JOSE+JWT vulnerable to padding oracle attack](https://agentprime.io/advisories/GHSA-jfmq-4g4m-99rh.md)
  `GHSA-jfmq-4g4m-99rh`, `CVE-2017-12973` · Maven `com.nimbusds:nimbus-jose-jwt`: affected `<4.39`, fixed in `4.39` · CVSS 3.1 Low · Not analysed yet · Published 13 May 2022 · Tags: CWE-354
- [Improper Validation of Integrity Check Value in Bouncy Castle](https://agentprime.io/advisories/GHSA-8477-3v39-ggpm.md)
  `GHSA-8477-3v39-ggpm`, `CVE-2018-5382` · Maven `org.bouncycastle:bcprov-jdk15on`: affected `<1.50`, fixed in `1.50` · CVSS 4.4 Medium · Not analysed yet · Published 13 May 2022 · Tags: Weak cryptography or TLS, CWE-354
- [Remote Code Execution in all versions of various RAD-ISM-900-EN-\* devices by PHOENIX CONTACT](https://agentprime.io/advisories/CVE-2022-29898.md)
  `CVE-2022-29898` · CVE record: PHOENIX CONTACT RAD-ISM-900-EN-BD/B and 2 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 May 2022 · Tags: CWE-354
- [On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, when running in Appli…](https://agentprime.io/advisories/CVE-2022-25946.md)
  `CVE-2022-25946` · CVE record: F5 BIG-IP (Advanced WAF, APM, ASM) and 1 more · CVSS 8.7 High · Not analysed yet · Published 5 May 2022 · Tags: CWE-354
- [kernel: A vulnerability was found in the Linux kernel's block_invalidatepage in fs/buffer.c in…](https://agentprime.io/advisories/CVE-2021-4148.md)
  `CVE-2021-4148` · CVE record: kernel · No CVSS score · Not analysed yet · Published 23 Mar 2022 · Tags: CWE-354
- [A flaw was found in the Linux SCTP stack.](https://agentprime.io/advisories/CVE-2021-3772.md)
  `CVE-2021-3772` · CVE record: kernel · No CVSS score · Not analysed yet · Published 2 Mar 2022 · Tags: CWE-354
- [Improper Validation of Integrity Check Value in TensorFlow](https://agentprime.io/advisories/GHSA-43q8-3fv7-pr5x.md)
  `GHSA-43q8-3fv7-pr5x` · PyPI `tensorflow` and 2 more: affected `<2.5.3 || >=2.6.0, <2.6.3 || >=2.7.0, <2.7.1`, fixed in `2.5.3`, `2.6.3`, `2.7.1` · CVSS 7.0 High · Not analysed yet · Published 9 Feb 2022 · Tags: CWE-354
- [Execution Control List (ECL) Is Insecure in Singularity](https://agentprime.io/advisories/GHSA-pmfr-63c2-jr5c.md)
  `GHSA-pmfr-63c2-jr5c`, `CVE-2020-13845` · Go `github.com/sylabs/singularity`: affected `>=3.0.0, <3.6.0`, fixed in `3.6.0` · CVSS 7.5 High · Not analysed yet · Published 20 Dec 2021 · Tags: Weak cryptography or TLS, CWE-354
- [Incomplete validation of shapes in multiple TF ops](https://agentprime.io/advisories/GHSA-pgcq-h79j-2f69.md)
  `GHSA-pgcq-h79j-2f69`, `BIT-tensorflow-2021-41206`, `CVE-2021-41206`, `PYSEC-2021-843`, `PYSEC-2021-845`, `PYSEC-2021-847` · PyPI `tensorflow` and 2 more: affected `<2.4.4 || >=2.5.0, <2.5.2 || >=2.6.0, <2.6.1`, fixed in `2.4.4`, `2.5.2`, `2.6.1` · CVSS 7.0 High · Not analysed yet · Published 10 Nov 2021 · Tags: CWE-354
- [Windows File Signature Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2019-1163.md)
  `CVE-2019-1163` · CVE record: Microsoft Windows 10 Version 1703 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 14 Aug 2019 · Tags: CWE-354
- [libreswan: The Libreswan Project has found a vulnerability in the processing of IKEv1 informational…](https://agentprime.io/advisories/CVE-2019-10155.md)
  `CVE-2019-10155` · CVE record: the libreswan Project libreswan · CVSS 3.1 Low · Not analysed yet · Published 12 Jun 2019 · Tags: CWE-354
- [Open Shortest Path First (OSPF) protocol implementations may improperly determine LSA recency in affected Quagga and downstream implementations (SUSE, openSUSE, and Red Hat packages)](https://agentprime.io/advisories/CVE-2017-3224.md)
  `CVE-2017-3224` · CVE record: Open Shortest Path First (OSPF) Protocol · No CVSS score · Not analysed yet · Published 24 Jul 2018 · Tags: CWE-354
- [tlslite-ng off-by-one error on mac checking](https://agentprime.io/advisories/GHSA-cwh5-3cw7-4286.md)
  `GHSA-cwh5-3cw7-4286`, `CVE-2018-1000159`, `PYSEC-2018-31` · PyPI `tlslite-ng`: affected `<0.7.4`, fixed in `0.7.4` · CVSS 5.9 Medium · Not analysed yet · Published 12 Jul 2018 · Tags: CWE-354
- [PHOENIX CONTACT mGuard: An Improper Validation of Integrity Check Value issue was discovered in PHOENIX CONTACT…](https://agentprime.io/advisories/CVE-2018-5441.md)
  `CVE-2018-5441` · CVE record: PHOENIX CONTACT mGuard · No CVSS score · Not analysed yet · Published 30 Jan 2018 · Tags: CWE-354

Newest: <https://agentprime.io/advisories/tag/cwe-354.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-354&cursor=WyIyMDI0LTA1LTAyVDEzOjEwOjUxLjA0MjAwMFoiLCJDVkUtMjAyMy00MTk3MCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-354/?cursor=WyIyMDI0LTA1LTAyVDEzOjEwOjUxLjA0MjAwMFoiLCJDVkUtMjAyMy00MTk3MCJd>. Everything for agents: <https://agentprime.io/llms.txt>.