Advisories · Weakness

CWE-354.

Every Advisory and CVE whose sources give the weakness CWE-354, newest first.

mdanter/ecc Packagist

CVSS 9.1 CriticalCritical · CVSS 9+

PHPECC vulnerable to multiple cryptographic side-channel attacks
- Information disclosure
- CWE-354
<=1.0.0 · no fixed version yet

GHSA-346h-749j-r28w Not analysed yet 25 Apr 2024
CVE-2024-25678 CVE record

CVSS 5.9 Medium

In LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled.
- CWE-354
Not analysed yet 9 Feb 2024
CVE-2023-42143 CVE record

CVSS 5.4 Medium

Missing Integrity Check in Shelly TRV 20220811-152343/v2.1.8@5afc928c allows malicious users to create a backdoor by redirecting the device to an attacker-controlled machine which serves the manipula…
- CWE-354
Not analysed yet 23 Jan 2024
russh +2 crates.io

CVSS 5.9 Medium

Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin
- CWE-345
- CWE-354
<0.40.2 · fixed in 0.40.2

GHSA-45x7-px36-x8w8 · CVE-2023-48795 Not analysed yet 18 Dec 2023
CVE-2023-28802 CVE record

CVSS 4.9 Medium

Disable Zscaler using machine tunnel restart
- Zscaler Client Connector
- CWE-354
Not analysed yet 21 Nov 2023
CVE-2023-28002 CVE record

CVSS 5.8 Medium

Fortinet FortiOS: An improper validation of integrity check value vulnerability [CWE-354] in FortiOS 7.2.0…
- Fortinet FortiOS
- Fortinet FortiProxy
- CWE-354
Not analysed yet 14 Nov 2023
asyncssh PyPI

CVSS 8.1 High

AsyncSSH Rogue Session Attack
- Information disclosure
- Broken access control
<2.14.1 · fixed in 2.14.1

GHSA-c35q-ffpf-5qpm · CVE-2023-46446 Not analysed yet 9 Nov 2023
asyncssh PyPI

CVSS 5.3 Medium

AsyncSSH Rogue Extension Negotiation
- CWE-345
- CWE-349
<2.14.1 · fixed in 2.14.1

GHSA-cfc2-wr2v-gxm5 · CVE-2023-46445 Not analysed yet 9 Nov 2023
CVE-2023-4929 CVE record

CVSS 6.5 Medium

NPort 5000 Series Firmware Improper Validation of Integrity Check Vulnerability
- Moxa NPort 5000AI-M12 Series
- Moxa NPort 5100 Series
- CWE-354
Not analysed yet 3 Oct 2023
CVE-2023-2975 CVE record

CVSS 5.3 Medium

AES-SIV implementation ignores empty associated data entries
- OpenSSL
- CWE-354
Not analysed yet 14 Jul 2023
CVE-2023-36537 CVE record

CVSS 7.3 High

Zoom Video Communications, Inc. Zoom Rooms for Windows: Improper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow…
- Zoom Video Communications, Inc. Zoom Rooms for Windows
- CWE-354
Not analysed yet 11 Jul 2023
@openzeppelin/contracts +1 npm

CVSS 5.3 Medium

OpenZeppelin Contracts using MerkleProof multiproofs may allow proving arbitrary leaves for specific trees
- CWE-354
>=4.7.0, <4.9.2 · fixed in 4.9.2

GHSA-wprv-93r4-jj2p · CVE-2023-34459 Not analysed yet 19 Jun 2023
CVE-2023-31437 CVE record

CVSS 5.3 Medium

An issue was discovered in systemd 253.
- CWE-354
Not analysed yet 13 Jun 2023
CVE-2023-33981 CVE record

CVSS 6.5 Medium

Briar before 1.4.22 allows attackers to spoof other users' messages in a blog, forum, or private group, but each spoofed message would need to be an exact duplicate of a legitimate message displayed…
- CWE-354
Not analysed yet 24 May 2023
CVE-2023-28386 CVE record

CVSS 8.6 High

Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly.
- Snap One OvrC Cloud
- CWE-354
Not analysed yet 22 May 2023
CVE-2023-30356 CVE record

CVSS 7.5 High

Missing Support for an Integrity Check in Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows attackers to update the device with crafted firmware
- CWE-354
Not analysed yet 10 May 2023
CVE-2016-15028 CVE record

CVSS 4.8 Medium

ICEPAY REST-API-NET Checksum Validation RestClient.cs RestClient integrity check
- ICEPAY REST-API-NET
- CWE-354
Not analysed yet 12 Mar 2023
CVE-2022-45142 CVE record

CVSS 7.5 High

The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp.
- Samba
- CWE-354
Not analysed yet 6 Mar 2023
CVE-2022-45191 CVE record

CVSS 6.5 Medium

An issue was discovered on Microchip RN4870 1.43 devices.
- CWE-354
Not analysed yet 7 Feb 2023
CVE-2023-23120 CVE record

CVSS 5.9 Medium

The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes TRENDnet TV-IP651WI Network Camera firmware version v1.07.01 and earlier vulnerable to firmware…
- CWE-354
Not analysed yet 2 Feb 2023
CVE-2023-23119 CVE record

CVSS 5.9 Medium

The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes Ubiquiti airFiber AF2X Radio firmware version 3.2.2 and earlier vulnerable to firmware modifica…
- CWE-354
Not analysed yet 2 Feb 2023
CVE-2022-46402 CVE record

CVSS 6.5 Medium

The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PairCon_rmSend with incorrect values.
- CWE-354
Not analysed yet 19 Dec 2022
CVE-2022-38955 CVE record

CVSS 7.5 High

An exploitable firmware modification vulnerability was discovered on the Netgear WPN824EXT WiFi Range Extender.
- CWE-354
Not analysed yet 20 Sept 2022
CVE-2022-38956 CVE record

CVSS 5.3 Medium

An exploitable firmware downgrade vulnerability was discovered on the Netgear WPN824EXT WiFi Range Extender.
- CWE-354
Not analysed yet 20 Sept 2022
CVE-2022-39845 CVE record

CVSS 5.5 Medium

Samsung Mobile Samsung Kies: Improper validation of integrity check vulnerability in Samsung Kies prior to version…
- Samsung Mobile Samsung Kies
- CWE-354
Not analysed yet 9 Sept 2022
CVE-2022-39844 CVE record

CVSS 5.5 Medium

Samsung Mobile Smart Switch PC: Improper validation of integrity check vulnerability in Smart Switch PC prior to version…
- Samsung Mobile Smart Switch PC
- CWE-354
Not analysed yet 9 Sept 2022
@openzeppelin/contracts +1 npm

CVSS 7.9 High

OpenZeppelin Contracts vulnerable to ECDSA signature malleability
- CWE-354
>=4.1.0, <4.7.3 · fixed in 4.7.3

GHSA-4h98-2769-gh6h · CVE-2022-35961 Not analysed yet 18 Aug 2022
CVE-2022-33711 CVE record

Samsung Mobile Samsung USB Driver Windows Installer for…: Improper validation of integrity check vulnerability in Samsung USB Driver Windows…
- Samsung Mobile Samsung USB Driver Windows Installer for Mobile Phones
- CWE-354
Not analysed yet 11 Jul 2022
github.com/theupdateframework/go-tuf Go

CVSS 8.0 High

Version rollback attack in github.com/theupdateframework/go-tuf
- CWE-354
<0.3.0 · fixed in 0.3.0

GHSA-66x3-6cw3-v5gj · CVE-2022-29173 Not analysed yet 1 Jul 2022
CVE-2021-37182 CVE record

Siemens SCALANCE XM408-4C: A vulnerability has been identified in SCALANCE XM408-4C (All versions < V6.5)…
- Siemens SCALANCE XM408-4C
- Siemens SCALANCE XM408-4C (L3 int.)
- CWE-354
Not analysed yet 14 Jun 2022
moodle/moodle Packagist

CVSS 4.3 Medium

Moodle Grade information disclosure in grade's external fetch functions
- CWE-354
>=3.8, <3.8.7 || >=3.9, <3.9.4 || >=3.10, <3.10.1 · fixed in 3.8.7, 3.9.4, 3.10.1

GHSA-mm73-86f9-5x5c · CVE-2021-20184 Not analysed yet 24 May 2022
com.nimbusds:nimbus-jose-jwt Maven

CVSS 3.1 Low

Nimbus JOSE+JWT vulnerable to padding oracle attack
- CWE-354
<4.39 · fixed in 4.39

GHSA-jfmq-4g4m-99rh · CVE-2017-12973 Not analysed yet 13 May 2022
org.bouncycastle:bcprov-jdk15on Maven

CVSS 4.4 Medium

Improper Validation of Integrity Check Value in Bouncy Castle
- Weak cryptography or TLS
- CWE-354
<1.50 · fixed in 1.50

GHSA-8477-3v39-ggpm · CVE-2018-5382 Not analysed yet 13 May 2022
CVE-2022-29898 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Remote Code Execution in all versions of various RAD-ISM-900-EN-* devices by PHOENIX CONTACT
- PHOENIX CONTACT RAD-ISM-900-EN-BD/B
- PHOENIX CONTACT RAD-ISM-900-EN-BD
- CWE-354
Not analysed yet 11 May 2022
CVE-2022-25946 CVE record

CVSS 8.7 High

On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, when running in Appli…
- F5 BIG-IP (Advanced WAF, APM, ASM)
- F5 BIG-IP Guided Configuration (GC)
- CWE-354
Not analysed yet 5 May 2022
CVE-2021-4148 CVE record

kernel: A vulnerability was found in the Linux kernel's block_invalidatepage in fs/buffer.c in…
- kernel
- CWE-354
Not analysed yet 23 Mar 2022
CVE-2021-3772 CVE record

A flaw was found in the Linux SCTP stack.
- kernel
- CWE-354
Not analysed yet 2 Mar 2022
tensorflow +2 PyPI

CVSS 7.0 High

Improper Validation of Integrity Check Value in TensorFlow
- CWE-354
<2.5.3 || >=2.6.0, <2.6.3 || >=2.7.0, <2.7.1 · fixed in 2.5.3, 2.6.3, 2.7.1

GHSA-43q8-3fv7-pr5x Not analysed yet 9 Feb 2022
github.com/sylabs/singularity Go

CVSS 7.5 High

Execution Control List (ECL) Is Insecure in Singularity
- Weak cryptography or TLS
- CWE-354
>=3.0.0, <3.6.0 · fixed in 3.6.0

GHSA-pmfr-63c2-jr5c · CVE-2020-13845 Not analysed yet 20 Dec 2021
tensorflow +2 PyPI

CVSS 7.0 High

Incomplete validation of shapes in multiple TF ops
- CWE-354
<2.4.4 || >=2.5.0, <2.5.2 || >=2.6.0, <2.6.1 · fixed in 2.4.4, 2.5.2, 2.6.1

GHSA-pgcq-h79j-2f69 · CVE-2021-41206 Not analysed yet 10 Nov 2021
CVE-2019-1163 CVE record

CVSS 5.5 Medium

Windows File Signature Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1703
- Microsoft Windows 10 Version 1803
- CWE-354
Not analysed yet 14 Aug 2019
CVE-2019-10155 CVE record

CVSS 3.1 Low

libreswan: The Libreswan Project has found a vulnerability in the processing of IKEv1 informational…
- libreswan
- CWE-354
Not analysed yet 12 Jun 2019
CVE-2017-3224 CVE record

Open Shortest Path First (OSPF) protocol implementations may improperly determine LSA recency in affected Quagga and downstream implementations (SUSE, openSUSE, and Red Hat packages)
- Open Shortest Path First (OSPF) Protocol
- CWE-354
Not analysed yet 24 Jul 2018
tlslite-ng PyPI

CVSS 5.9 Medium

tlslite-ng off-by-one error on mac checking
- CWE-354
<0.7.4 · fixed in 0.7.4

GHSA-cwh5-3cw7-4286 · CVE-2018-1000159 Not analysed yet 12 Jul 2018
CVE-2018-5441 CVE record

PHOENIX CONTACT mGuard: An Improper Validation of Integrity Check Value issue was discovered in PHOENIX CONTACT…
- PHOENIX CONTACT mGuard
- CWE-354
Not analysed yet 30 Jan 2018