# CWE-494.

Every Advisory and CVE whose sources give the weakness CWE-494, newest first.

## Records, newest first (an older page)

- [keras Path Traversal vulnerability](https://agentprime.io/advisories/GHSA-cjgq-5qmw-rcj6.md)
  `GHSA-cjgq-5qmw-rcj6`, `CVE-2024-55459`, `PYSEC-2025-121` · PyPI `keras`: affected `<=3.7.0`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 8 Jan 2025 · Tags: Path traversal, CWE-494
- [Insufficient Integrity Verification Vulnerability in TP-Link Archer C50](https://agentprime.io/advisories/CVE-2024-54126.md)
  `CVE-2024-54126` · CVE record: TP-Link Archer C50 Wireless Router · CVSS 8.5 High · Not analysed yet · Published 5 Dec 2024 · Tags: Weak cryptography or TLS, CWE-494
- [WesHacks code includes links to Leostop tracking spyware infested files](https://agentprime.io/advisories/CVE-2024-52583.md)
  `CVE-2024-52583` · CVE record: DefinetlyNotAI WesHacks · CVSS 8.2 High · Not analysed yet · Published 18 Nov 2024 · Tags: CWE-494
- [Life2000 Ventilator does not perform proper file integrity checks when adopting firmware updates](https://agentprime.io/advisories/CVE-2024-48974.md)
  `CVE-2024-48974` · CVE record: Baxter Life2000 Ventilation System · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Nov 2024 · Tags: CWE-494
- [Potential Firmware update without integrity check](https://agentprime.io/advisories/CVE-2024-33660.md)
  `CVE-2024-33660` · CVE record: AMI AptioV · CVSS 5.2 Medium · Not analysed yet · Published 12 Nov 2024 · Tags: CWE-494
- [Gradio lacks integrity checking on the downloaded FRP client](https://agentprime.io/advisories/GHSA-8c87-gvhj-xm8m.md)
  `GHSA-8c87-gvhj-xm8m`, `CVE-2024-47867`, `PYSEC-2024-216` · PyPI `gradio`: affected `<5.0.0`, fixed in `5.0.0` · CVSS 2.1 Low · Not analysed yet · Published 10 Oct 2024 · Tags: CWE-345, CWE-494
- [The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.](https://agentprime.io/advisories/CVE-2024-45321.md)
  `CVE-2024-45321` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2024 · Tags: CWE-494
- [Artifact Hub has Incorrect Docker Hub registry check in github.com/artifacthub/hub](https://agentprime.io/advisories/GHSA-g6pq-x539-7w4j.md)
  `GHSA-g6pq-x539-7w4j`, `CVE-2023-45821`, `GO-2023-2135` · Go `github.com/artifacthub/hub`: affected `<1.16.0`, fixed in `1.16.0` · CVSS 5.4 Medium · Not analysed yet · Published 21 Aug 2024 · Tags: CWE-494
- [Zoom Workplace Apps and SDK for Windows - Improper Privilege Management](https://agentprime.io/advisories/CVE-2024-39819.md)
  `CVE-2024-39819` · CVE record: Zoom Communications, Inc Zoom Workplace Apps and SDK for Windows · CVSS 6.7 Medium · Not analysed yet · Published 15 Jul 2024 · Tags: CWE-494
- [Download of Code Without Integrity Check in Kiloview P1/P2 devices](https://agentprime.io/advisories/CVE-2023-41921.md)
  `CVE-2023-41921` · CVE record: Kiloview P1/P2 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jul 2024 · Tags: CWE-494
- [Download of code without integrity check in Synology Router Manager (SRM)](https://agentprime.io/advisories/CVE-2024-39348.md)
  `CVE-2024-39348` · CVE record: Synology Synology Router Manager (SRM) · CVSS 7.5 High · Not analysed yet · Published 28 Jun 2024 · Tags: CWE-494
- [Download of code without integrity check in Siemens SIMATIC RTLS Locating Manager](https://agentprime.io/advisories/CVE-2024-30206.md)
  `CVE-2024-30206` · CVE record: Siemens SIMATIC RTLS Locating Manager · CVSS 8.8 High · Not analysed yet · Published 14 May 2024 · Tags: CWE-494
- [LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary read vulnerability via the fileDownload method in class com.luckyframe.project.common.CommonController.](https://agentprime.io/advisories/CVE-2024-33118.md)
  `CVE-2024-33118` · CVE record · CVSS 7.5 High · Not analysed yet · Published 6 May 2024 · Tags: CWE-494
- [Inductive Automation Ignition downloadLaunchClientJar Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2023-39474.md)
  `CVE-2023-39474` · CVE record: Inductive Automation Ignition · CVSS 8.0 High · Not analysed yet · Published 3 May 2024 · Tags: CWE-494
- [IOSIX IO-1020 Micro ELD Download of Code Without Integrity Check](https://agentprime.io/advisories/CVE-2024-28878.md)
  `CVE-2024-28878` · CVE record: IOSiX IO-1020 Micro ELD · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Apr 2024 · Tags: CWE-494
- [WP Crontrol vulnerable to possible RCE when combined with a pre-condition](https://agentprime.io/advisories/GHSA-9xvf-cjvf-ff5q.md)
  `GHSA-9xvf-cjvf-ff5q`, `CVE-2024-28850`, `PKSA-rnp9-g2v1-bz2h` · Packagist `johnbillion/wp-crontrol`: affected `<1.16.2`, fixed in `1.16.2` · CVSS 8.2 High · Not analysed yet · Published 25 Mar 2024 · Tags: CWE-494
- [In Emacs before 29.3, Org mode considers contents of remote files to be trusted.](https://agentprime.io/advisories/CVE-2024-30205.md)
  `CVE-2024-30205` · CVE record · CVSS 7.1 High · Not analysed yet · Published 25 Mar 2024 · Tags: CWE-494
- [Apache Doris: Downloading arbitrary remote jar files resulting in remote command execution](https://agentprime.io/advisories/CVE-2024-27438.md)
  `CVE-2024-27438` · CVE record: Apache Software Foundation Apache Doris · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Mar 2024 · Tags: CWE-494
- [An issue in the com.oneed.dvr.service.DownloadFirmwareService component of IMOU GO v1.0.11 allows attackers to force the download of arbitrary files.](https://agentprime.io/advisories/CVE-2023-47353.md)
  `CVE-2023-47353` · CVE record · CVSS 8.8 High · Not analysed yet · Published 6 Feb 2024 · Tags: CWE-494
- [PHOENIX CONTACT: PLCnext Control prone to download of code without integrity check](https://agentprime.io/advisories/CVE-2023-46144.md)
  `CVE-2023-46144` · CVE record: PHOENIX CONTACT AXC F 1152 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 14 Dec 2023 · Tags: CWE-494
- [Phoenix Contact: Classic line industrial controllers prone to inadequate integrity check of PLC](https://agentprime.io/advisories/CVE-2023-46143.md)
  `CVE-2023-46143` · CVE record: PHOENIX CONTACT Automation Worx Software Suite and 4 more · CVSS 7.5 High · Not analysed yet · Published 14 Dec 2023 · Tags: CWE-494
- [Phoenix Contact: ProConOs prone to Download of Code Without Integrity Check](https://agentprime.io/advisories/CVE-2023-5592.md)
  `CVE-2023-5592` · CVE record: PHOENIX CONTACT MULTIPROG and 1 more · CVSS 7.5 High · Not analysed yet · Published 14 Dec 2023 · Tags: CWE-494
- [Download of code without integrity check in Schneider Electric Trio Q-Series Ethernet Data Radio and others](https://agentprime.io/advisories/CVE-2023-5630.md)
  `CVE-2023-5630` · CVE record: Schneider Electric Trio Q-Series Ethernet Data Radio and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 14 Dec 2023 · Tags: CWE-494
- [Download of code without integrity check in Buildroot](https://agentprime.io/advisories/CVE-2023-45842.md)
  `CVE-2023-45842` · CVE record: Buildroot Buildroot · CVSS 8.1 High · Not analysed yet · Published 5 Dec 2023 · Tags: CWE-494
- [Download of code without integrity check in Buildroot](https://agentprime.io/advisories/CVE-2023-45841.md)
  `CVE-2023-45841` · CVE record: Buildroot Buildroot · CVSS 8.1 High · Not analysed yet · Published 5 Dec 2023 · Tags: CWE-494
- [Download of code without integrity check in Buildroot](https://agentprime.io/advisories/CVE-2023-45840.md)
  `CVE-2023-45840` · CVE record: Buildroot Buildroot · CVSS 8.1 High · Not analysed yet · Published 5 Dec 2023 · Tags: CWE-494
- [Download of code without integrity check in Buildroot](https://agentprime.io/advisories/CVE-2023-45839.md)
  `CVE-2023-45839` · CVE record: Buildroot Buildroot · CVSS 8.1 High · Not analysed yet · Published 5 Dec 2023 · Tags: CWE-494
- [Download of code without integrity check in Buildroot](https://agentprime.io/advisories/CVE-2023-45838.md)
  `CVE-2023-45838` · CVE record: Buildroot Buildroot · CVSS 8.1 High · Not analysed yet · Published 5 Dec 2023 · Tags: CWE-494
- [Download of code without integrity check in Buildroot](https://agentprime.io/advisories/CVE-2023-43608.md)
  `CVE-2023-43608` · CVE record: Buildroot Buildroot · CVSS 8.1 High · Not analysed yet · Published 5 Dec 2023 · Tags: CWE-494
- [Download of code without integrity check in Schneider Electric ION8650 and others](https://agentprime.io/advisories/CVE-2023-5984.md)
  `CVE-2023-5984` · CVE record: Schneider Electric ION8650 and 1 more · CVSS 7.2 High · Not analysed yet · Published 15 Nov 2023 · Tags: CWE-494
- [MLSoft TCO!stream Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2023-45799.md)
  `CVE-2023-45799` · CVE record: MLSoft TCO!stream · CVSS 7.2 High · Not analysed yet · Published 30 Oct 2023 · Tags: CWE-494
- [Synel Terminals - CWE-494: Download of Code Without Integrity Check](https://agentprime.io/advisories/CVE-2023-37220.md)
  `CVE-2023-37220` · CVE record: Synel Terminals · CVSS 7.2 High · Not analysed yet · Published 3 Sept 2023 · Tags: CWE-494
- [PHOENIX CONTACT: WP 6xxx Web panels prone to download code without integrity check](https://agentprime.io/advisories/CVE-2023-37864.md)
  `CVE-2023-37864` · CVE record: PHOENIX CONTACT WP 6070-WVPS and 4 more · CVSS 7.2 High · Not analysed yet · Published 9 Aug 2023 · Tags: CWE-494
- [Improper authorization in Rocket.Chat](https://agentprime.io/advisories/CVE-2023-28317.md)
  `CVE-2023-28317` · CVE record: Rocket.Chat · CVSS 5.3 Medium · Not analysed yet · Published 9 May 2023 · Tags: Broken access control, CWE-494
- [Electra Smart Kit for Split AC – Adjacent attacker may cause the unit to load unauthorized FW](https://agentprime.io/advisories/CVE-2023-24503.md)
  `CVE-2023-24503` · CVE record: Electra OSK201 · CVSS 7.5 High · Not analysed yet · Published 17 Apr 2023 · Tags: CWE-494
- [Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW](https://agentprime.io/advisories/CVE-2023-24500.md)
  `CVE-2023-24500` · CVE record: Electra Electra Central AC unit · CVSS 7.5 High · Not analysed yet · Published 17 Apr 2023 · Tags: CWE-494
- [Download of code without integrity check in Fortinet FortiClientMac](https://agentprime.io/advisories/CVE-2023-22635.md)
  `CVE-2023-22635` · CVE record: Fortinet FortiClientMac · CVSS 6.9 Medium · Not analysed yet · Published 11 Apr 2023 · Tags: CWE-494
- [RuoYi vulnerable to arbitrary file download](https://agentprime.io/advisories/GHSA-h4c9-rr5m-32fm.md)
  `GHSA-h4c9-rr5m-32fm`, `CVE-2023-27025` · Maven `com.ruoyi:ruoyi`: affected `<4.7.7`, fixed in `4.7.7` · CVSS 7.5 High · Not analysed yet · Published 2 Apr 2023 · Tags: CWE-494
- [An issue was discovered in Veritas NetBackup IT Analytics 11 before 11.2.0.](https://agentprime.io/advisories/CVE-2023-28818.md)
  `CVE-2023-28818` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 24 Mar 2023 · Tags: CWE-494
- [ShadowsocksX-NG 1.10.0 signs with com.apple.security.get-task-allow entitlements because of CODE_SIGNING_INJECT_BASE_ENTITLEMENTS.](https://agentprime.io/advisories/CVE-2023-27574.md)
  `CVE-2023-27574` · CVE record · No CVSS score · Not analysed yet · Published 3 Mar 2023 · Tags: CWE-494
- [An exploitable firmware modification vulnerability was discovered in certain Netgear products.](https://agentprime.io/advisories/CVE-2023-23110.md)
  `CVE-2023-23110` · CVE record · CVSS 7.4 High · Not analysed yet · Published 2 Feb 2023 · Tags: CWE-494
- [In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before…](https://agentprime.io/advisories/CVE-2020-22658.md)
  `CVE-2020-22658` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jan 2023 · Tags: CWE-494
- [In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before…](https://agentprime.io/advisories/CVE-2020-22654.md)
  `CVE-2020-22654` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jan 2023 · Tags: CWE-494
- [Certain General Electric Renewable Energy products download firmware without an integrity check.](https://agentprime.io/advisories/CVE-2022-24117.md)
  `CVE-2022-24117` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Dec 2022 · Tags: CWE-494
- [TP-Link TL-WR740N V1 and V2 v3.12.4 and earlier allows authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image during the firmware…](https://agentprime.io/advisories/CVE-2022-46430.md)
  `CVE-2022-46430` · CVE record · CVSS 4.8 Medium · Not analysed yet · Published 20 Dec 2022 · Tags: CWE-494
- [TP-Link TL-WR1043ND V1 3.13.15 and earlier allows authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image during the firmware updat…](https://agentprime.io/advisories/CVE-2022-46428.md)
  `CVE-2022-46428` · CVE record · CVSS 4.8 Medium · Not analysed yet · Published 20 Dec 2022 · Tags: CWE-494
- [An exploitable firmware modification vulnerability was discovered on the Netgear WNR2000v1 router.](https://agentprime.io/advisories/CVE-2022-46423.md)
  `CVE-2022-46423` · CVE record · CVSS 8.1 High · Not analysed yet · Published 20 Dec 2022 · Tags: CWE-494
- [Rapid7 Nexpose Update Validation Issue](https://agentprime.io/advisories/CVE-2022-4261.md)
  `CVE-2022-4261` · CVE record: Rapid7 Nexpose and 1 more · CVSS 4.4 Medium · Not analysed yet · Published 7 Dec 2022 · Tags: CWE-494
- [Sinatra vulnerable to Reflected File Download attack](https://agentprime.io/advisories/GHSA-2x8x-jmrp-phxw.md)
  `GHSA-2x8x-jmrp-phxw`, `CVE-2022-45442` · RubyGems `sinatra`: affected `>=2.0.0, <2.2.3 || >=3.0, <3.0.4`, fixed in `2.2.3`, `3.0.4` · CVSS 8.8 High · Not analysed yet · Published 30 Nov 2022 · Tags: CWE-494
- [Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the device.](https://agentprime.io/advisories/CVE-2022-40799.md)
  `CVE-2022-40799` · CVE record · CVSS 8.8 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.34 · Not analysed yet · Published 29 Nov 2022 · Tags: CWE-494
- [Download of code without integrity check in Hewlett Packard Enterprise Aruba Mobility Conductor (formerly Mobility Master)…](https://agentprime.io/advisories/CVE-2022-37908.md)
  `CVE-2022-37908` · CVE record: Hewlett Packard Enterprise Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central · CVSS 5.8 Medium · Not analysed yet · Published 3 Nov 2022 · Tags: CWE-494
- [BUG-000144172 - Remote file download issue in ArcGIS Server](https://agentprime.io/advisories/CVE-2022-38199.md)
  `CVE-2022-38199` · CVE record: Esri ArcGIS Server · CVSS 6.1 Medium · Not analysed yet · Published 25 Oct 2022 · Tags: CWE-494
- [WISA Smart Wing CMS File Download Vulnerability](https://agentprime.io/advisories/CVE-2021-26639.md)
  `CVE-2021-26639` · CVE record: WISA corp. Smart Wing CMS · CVSS 8.1 High · Not analysed yet · Published 17 Aug 2022 · Tags: CWE-20, CWE-494
- [Django vulnerable to Reflected File Download attack](https://agentprime.io/advisories/GHSA-8x94-hmjh-97hq.md)
  `GHSA-8x94-hmjh-97hq`, `BIT-django-2022-36359`, `CVE-2022-36359`, `PYSEC-2022-245` · PyPI `django`: affected `<3.2.15 || >=4.0, <4.0.7`, fixed in `3.2.15`, `4.0.7` · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2022 · Tags: CWE-494
- [Firmware upload verification bypass in TXpert Hub CoreTec 4](https://agentprime.io/advisories/CVE-2021-35532.md)
  `CVE-2021-35532` · CVE record: Hitachi Energy TXpert Hub CoreTec 4 version · No CVSS score · Not analysed yet · Published 7 Jun 2022 · Tags: CWE-494
- [Jenkins Plugin Installation Manager Tool did not verify plugin downloads](https://agentprime.io/advisories/GHSA-m8r4-c7jm-w782.md)
  `GHSA-m8r4-c7jm-w782`, `CVE-2020-2320` · Maven `io.jenkins.plugin-management:plugin-management-parent-pom`: affected `<2.2.0`, fixed in `2.2.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 May 2022 · Tags: CWE-494
- [Cargo prior to Rust 1.26.0 may download the wrong dependency](https://agentprime.io/advisories/GHSA-9f3p-wvj7-q82x.md)
  `GHSA-9f3p-wvj7-q82x`, `CVE-2019-16760`, `GHSA-phjm-8x66-qw4r` · crates.io `cargo`: affected `<0.27.0`, fixed in `0.27.0` · CVSS 4.6 Medium · Not analysed yet · Published 24 May 2022 · Tags: CWE-16, CWE-494
- [Incorrect Resource Transfer Between Spheres in Grails](https://agentprime.io/advisories/GHSA-pmxf-4v8c-rwr7.md)
  `GHSA-pmxf-4v8c-rwr7`, `CVE-2019-12728` · Maven `org.grails:grails-core`: affected `<3.3.10`, fixed in `3.3.10` · CVSS 8.1 High · Not analysed yet · Published 24 May 2022 · Tags: CWE-494, CWE-669
- [Potentially compromised builds](https://agentprime.io/advisories/GHSA-rfj2-4g26-7jw5.md)
  `GHSA-rfj2-4g26-7jw5`, `CVE-2019-10249` · Maven `org.eclipse.xtend:org.eclipse.xtend.core` and 1 more: affected `<2.18.0`, fixed in `2.18.0` · CVSS 8.1 High · Not analysed yet · Published 24 May 2022 · Tags: Weak cryptography or TLS, CWE-494, CWE-829
- [Eclipse Vorto resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS](https://agentprime.io/advisories/GHSA-fg2q-v428-2gph.md)
  `GHSA-fg2q-v428-2gph`, `CVE-2019-10248` · Maven `org.eclipse.vorto:org.eclipse.vorto.core`: affected `<0.11.0`, fixed in `0.11.0` · CVSS 8.1 High · Not analysed yet · Published 24 May 2022 · Tags: CWE-494, CWE-669, CWE-829

Newest: <https://agentprime.io/advisories/tag/cwe-494.md>
Older: <https://agentprime.io/advisories/tag/cwe-494.md?cursor=WyIyMDIyLTA1LTI0VDE2OjQ0OjA4LjAwMDAwMFoiLCJHSFNBLWZnMnEtdjQyOC0yZ3BoIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-494&cursor=WyIyMDI1LTAxLTIzVDAxOjQyOjQ3LjQ5NjAwMFoiLCJDVkUtMjAyNC00MjE4MyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-494/?cursor=WyIyMDI1LTAxLTIzVDAxOjQyOjQ3LjQ5NjAwMFoiLCJDVkUtMjAyNC00MjE4MyJd>. Everything for agents: <https://agentprime.io/llms.txt>.