CWE-494.

keras Path Traversal vulnerability

• Path traversal
• CWE-494

<=3.7.0 · no fixed version yet

Insufficient Integrity Verification Vulnerability in TP-Link Archer C50

• TP-Link Archer C50 Wireless Router
• Weak cryptography or TLS
• CWE-494

WesHacks code includes links to Leostop tracking spyware infested files

• DefinetlyNotAI WesHacks
• CWE-494

Life2000 Ventilator does not perform proper file integrity checks when adopting firmware updates

• Baxter Life2000 Ventilation System
• CWE-494

Potential Firmware update without integrity check

• AMI AptioV
• CWE-494

Gradio lacks integrity checking on the downloaded FRP client

• CWE-345
• CWE-494

<5.0.0 · fixed in 5.0.0

The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.

• CWE-494

Artifact Hub has Incorrect Docker Hub registry check in github.com/artifacthub/hub

• CWE-494

<1.16.0 · fixed in 1.16.0

Zoom Workplace Apps and SDK for Windows - Improper Privilege Management

• Zoom Communications, Inc Zoom Workplace Apps and SDK for Windows
• CWE-494

Download of Code Without Integrity Check in Kiloview P1/P2 devices

• Kiloview P1/P2
• CWE-494

Download of code without integrity check in Synology Router Manager (SRM)

• Synology Router Manager (SRM)
• CWE-494

Download of code without integrity check in Siemens SIMATIC RTLS Locating Manager

• Siemens SIMATIC RTLS Locating Manager
• CWE-494

LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary read vulnerability via the fileDownload method in class com.luckyframe.project.common.CommonController.

• CWE-494

Inductive Automation Ignition downloadLaunchClientJar Remote Code Execution Vulnerability

• Inductive Automation Ignition
• CWE-494

IOSIX IO-1020 Micro ELD Download of Code Without Integrity Check

• IOSiX IO-1020 Micro ELD
• CWE-494

WP Crontrol vulnerable to possible RCE when combined with a pre-condition

• CWE-494

<1.16.2 · fixed in 1.16.2

In Emacs before 29.3, Org mode considers contents of remote files to be trusted.

• CWE-494

Apache Doris: Downloading arbitrary remote jar files resulting in remote command execution

• Apache Software Foundation Apache Doris
• CWE-494

An issue in the com.oneed.dvr.service.DownloadFirmwareService component of IMOU GO v1.0.11 allows attackers to force the download of arbitrary files.

• CWE-494

PHOENIX CONTACT: PLCnext Control prone to download of code without integrity check

• PHOENIX CONTACT AXC F 1152
• PHOENIX CONTACT AXC F 2152
• CWE-494

Phoenix Contact: Classic line industrial controllers prone to inadequate integrity check of PLC

• PHOENIX CONTACT Automation Worx Software Suite
• PHOENIX CONTACT AXC 1050
• CWE-494

Phoenix Contact: ProConOs prone to Download of Code Without Integrity Check

• PHOENIX CONTACT MULTIPROG
• PHOENIX CONTACT ProConOS eCLR (SDK)
• CWE-494

Download of code without integrity check in Schneider Electric Trio Q-Series Ethernet Data Radio and others

• Schneider Electric Trio Q-Series Ethernet Data Radio
• Schneider Electric Trio E-Series Ethernet Data Radio
• CWE-494

Download of code without integrity check in Buildroot

• Buildroot
• CWE-494

Download of code without integrity check in Buildroot

• Buildroot
• CWE-494

Download of code without integrity check in Buildroot

• Buildroot
• CWE-494

Download of code without integrity check in Buildroot

• Buildroot
• CWE-494

Download of code without integrity check in Buildroot

• Buildroot
• CWE-494

Download of code without integrity check in Buildroot

• Buildroot
• CWE-494

Download of code without integrity check in Schneider Electric ION8650 and others

• Schneider Electric ION8650
• Schneider Electric ION8800
• CWE-494

MLSoft TCO!stream Remote Code Execution Vulnerability

• MLSoft TCO!stream
• CWE-494

Synel Terminals - CWE-494: Download of Code Without Integrity Check

• Synel Terminals
• CWE-494

PHOENIX CONTACT: WP 6xxx Web panels prone to download code without integrity check

• PHOENIX CONTACT WP 6070-WVPS
• PHOENIX CONTACT WP 6101-WXPS
• CWE-494

Improper authorization in Rocket.Chat

• Rocket.Chat
• Broken access control
• CWE-494

Electra Smart Kit for Split AC – Adjacent attacker may cause the unit to load unauthorized FW

• Electra OSK201
• CWE-494

Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW

• Electra Central AC unit
• CWE-494

Download of code without integrity check in Fortinet FortiClientMac

• Fortinet FortiClientMac
• CWE-494

RuoYi vulnerable to arbitrary file download

• CWE-494

<4.7.7 · fixed in 4.7.7

An issue was discovered in Veritas NetBackup IT Analytics 11 before 11.2.0.

• CWE-494

ShadowsocksX-NG 1.10.0 signs with com.apple.security.get-task-allow entitlements because of CODE_SIGNING_INJECT_BASE_ENTITLEMENTS.

• CWE-494

An exploitable firmware modification vulnerability was discovered in certain Netgear products.

• CWE-494

In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before…

• CWE-494

In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before…

• CWE-494

Certain General Electric Renewable Energy products download firmware without an integrity check.

• CWE-494

TP-Link TL-WR740N V1 and V2 v3.12.4 and earlier allows authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image during the firmware…

• CWE-494

TP-Link TL-WR1043ND V1 3.13.15 and earlier allows authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image during the firmware updat…

• CWE-494

An exploitable firmware modification vulnerability was discovered on the Netgear WNR2000v1 router.

• CWE-494

Rapid7 Nexpose Update Validation Issue

• Rapid7 Nexpose
• Rapid7 InsightVM
• CWE-494

Sinatra vulnerable to Reflected File Download attack

• CWE-494

>=2.0.0, <2.2.3 || >=3.0, <3.0.4 · fixed in 2.2.3, 3.0.4

Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the device.

• CWE-494

Download of code without integrity check in Hewlett Packard Enterprise Aruba Mobility Conductor (formerly Mobility Master)…

• Hewlett Packard Enterprise Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central
• CWE-494

BUG-000144172 - Remote file download issue in ArcGIS Server

• Esri ArcGIS Server
• CWE-494

WISA Smart Wing CMS File Download Vulnerability

• WISA corp. Smart Wing CMS
• CWE-20
• CWE-494

Django vulnerable to Reflected File Download attack

• CWE-494

<3.2.15 || >=4.0, <4.0.7 · fixed in 3.2.15, 4.0.7

Firmware upload verification bypass in TXpert Hub CoreTec 4

• Hitachi Energy TXpert Hub CoreTec 4 version
• CWE-494

Jenkins Plugin Installation Manager Tool did not verify plugin downloads

• CWE-494

<2.2.0 · fixed in 2.2.0

Cargo prior to Rust 1.26.0 may download the wrong dependency

• CWE-16
• CWE-494

<0.27.0 · fixed in 0.27.0

Incorrect Resource Transfer Between Spheres in Grails

• CWE-494
• CWE-669

<3.3.10 · fixed in 3.3.10

Potentially compromised builds

• Weak cryptography or TLS
• CWE-494

<2.18.0 · fixed in 2.18.0

Eclipse Vorto resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS

• CWE-494
• CWE-669

<0.11.0 · fixed in 0.11.0