Advisories · Weakness

CWE-494.

Every Advisory and CVE whose sources give the weakness CWE-494, newest first.

CVE-2021-44168 CVE record

CVSS 3.3 LowCritical · KEVKEV

Download of code without integrity check in Fortinet FortiOS
- Fortinet FortiOS
- CWE-494
Not analysed yet 4 Jan 2022
CVE-2020-7883 CVE record

Download of code without integrity check in WOWSOFT Printchaser
- WOWSOFT Printchaser
- CWE-494
Not analysed yet 28 Dec 2021
CVE-2020-7875 CVE record

CVSS 7.5 High

RAONWIZ DEXT5 Upload ActiveX remote file execution vulnerability
- RAONWIZ DEXT5 Upload
- CWE-494
Not analysed yet 28 Oct 2021
CVE-2020-7874 CVE record

CVSS 8.8 High

NEXACRO14 Runtime arbitrary file download and execution vulnerability
- TOBESOFT NEXACRO14
- CWE-494
Not analysed yet 9 Sept 2021
CVE-2020-7873 CVE record

CVSS 8.8 High

Download of code without integrity check in Younglimwon Co., Ltd K-System WellComm
- Younglimwon Co., Ltd K-System WellComm
- CWE-494
Not analysed yet 9 Sept 2021
parse-server npm

CVSS 7.7 High

Incorrect version tags linked to external repository
- CWE-484
- CWE-494
>=4.0.0, <4.5.2 || >=4.6.0, <4.10.0 · fixed in 4.5.2, 4.10.0

GHSA-593v-wcqx-hq2w · CVE-2021-47986 Not analysed yet 7 Sept 2021
CVE-2021-3485 CVE record

CVSS 6.4 Medium

Improper Input Validation in Bitdefender Endpoint Security Tools for Linux
- Bitdefender Endpoint Security Tools for Linux
- CWE-494
Not analysed yet 24 May 2021
CVE-2020-29032 CVE record

CVSS 8.4 High

Add integrity check of GateManager firmware
- Secomea GateManager
- CWE-494
Not analysed yet 5 Mar 2021
CVE-2020-28213 CVE record

Download of code without integrity check in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions)
- PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions)
- CWE-494
Not analysed yet 19 Nov 2020
CVE-2020-7831 CVE record

CVSS 8.8 High

Download of code without integrity check in INOGARD Ebiz4u CViewer Object AxECM.dll
- INOGARD Ebiz4u CViewer Object AxECM.dll
- CWE-494
Not analysed yet 24 Aug 2020
CVE-2020-7817 CVE record

CVSS 5.5 Medium

Download of code without integrity check in ActiveSoft MyBrowserPlus
- ActiveSoft MyBrowserPlus
- CWE-494
Not analysed yet 6 Aug 2020
CVE-2020-10926 CVE record

CVSS 7.5 High

Download of code without integrity check in NETGEAR R6700
- NETGEAR R6700
- CWE-494
Not analysed yet 28 Jul 2020
CVE-2020-7826 CVE record

CVSS 8.8 High

Download of code without integrity check in Bflysoft EyeSurfer BflyInstallerX.ocx
- Bflysoft EyeSurfer BflyInstallerX.ocx
- CWE-494
Not analysed yet 17 Jul 2020
CVE-2020-7505 CVE record

Download of code without integrity check in Easergy T300 (Firmware version 1.5.2 and older)
- Easergy T300 (Firmware version 1.5.2 and older)
- CWE-494
Not analysed yet 16 Jun 2020
CVE-2020-7812 CVE record

CVSS 7.8 High

Kaoni ezHTTPTrans Active-X File Download and Execution Vulnerability
- Kaoni ezHTTPTrans
- CWE-494
Not analysed yet 28 May 2020
CVE-2020-7813 CVE record

CVSS 7.8 High

Kaoni ezHTTPTrans Active-X File Download and Execution Vulnerability
- Kaoni ezHTTPTrans
- CWE-494
Not analysed yet 22 May 2020
CVE-2020-7806 CVE record

CVSS 7.8 High

Tobesoft Xplatform ActiveX File Download Vulnerability
- Tobesoft Xplatform
- CWE-494
Not analysed yet 6 May 2020
CVE-2019-19167 CVE record

CVSS 7.8 High

Tobesoft Nexacro14 ActiveX File Download Vulnerability
- Tobesoft Nexacro14
- CWE-494
Not analysed yet 6 May 2020
CVE-2019-19166 CVE record

CVSS 7.8 High

Tobesoft XPlatform Arbitrary File Execution Vulnerability
- Tobesoft XPlatform
- CWE-494
Not analysed yet 6 May 2020
CVE-2019-19165 CVE record

CVSS 7.2 High

Download of code without integrity check in Ebiz4u ActiveX of Inogard Co,,LTD(AxECM.cab) on Windows 7/8/10
- Ebiz4u ActiveX of Inogard Co,,LTD(AxECM.cab) on Windows 7/8/10
- CWE-494
Not analysed yet 29 Apr 2020
CVE-2020-9751 CVE record

Download of code without integrity check in NAVER Corporation Naver Cloud Explorer
- NAVER Corporation Naver Cloud Explorer
- CWE-494
Not analysed yet 3 Mar 2020
org.springframework:spring-webflux +1 Maven

CVSS 8.0 HighCritical · CVSS 7+ and EPSS

RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application
- Cross-site scripting (XSS)
- CWE-494
>=5.2.0.RELEASE, <5.2.3.RELEASE || >=5.1.0.RELEASE, <5.1.13.RELEASE || >=5.0.0.RELEASE, <5.0.16.RELEASE · fixed in 5.2.3.RELEASE, 5.1.13.RELEASE, 5.0.16.RELEASE

GHSA-8wx2-9q48-vm9r · CVE-2020-5398 Not analysed yet 21 Jan 2020
CVE-2019-3977 CVE record

Download of code without integrity check in MikroTik RouterOS
- MikroTik RouterOS
- CWE-494
Not analysed yet 28 Oct 2019
CVE-2019-9534 CVE record

The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image
- Cobham plc Explorer 710
- CWE-494
Not analysed yet 10 Oct 2019
CVE-2019-14845 CVE record

CVSS 5.7 Medium

Download of code without integrity check in Red Hat openshift
- Red Hat openshift
- CWE-494
Not analysed yet 8 Oct 2019
generator-jhipster npm

CVSS 8.1 High

High severity vulnerability that affects generator-jhipster
- CWE-494
- CWE-829
<6.3.1 · fixed in 6.3.1

GHSA-mc84-xr9p-938r Not analysed yet 23 Sept 2019
CVE-2019-13534 CVE record

Download of code without integrity check in Philips IntelliVue WLAN, portable patient monitors
- Philips IntelliVue WLAN, portable patient monitors
- CWE-494
Not analysed yet 12 Sept 2019
CVE-2019-12809 CVE record

Download of code without integrity check in YES24 PC VIEWER
- YES24 PC VIEWER
- CWE-494
Not analysed yet 15 Aug 2019
CVE-2018-5409 CVE record

PrinterLogic Print Management Software updates and executes the code without origin and code verification
- PrinterLogic Management Software
- CWE-494
Not analysed yet 8 May 2019
CVE-2019-3801 CVE record

CVSS 8.7 High

Java Projects using HTTP to fetch dependencies
- Cloud Foundry CredHub
- Cloud Foundry UAA Release (OSS)
- CWE-494
Not analysed yet 25 Apr 2019
org.eclipse.hawkbit:hawkbit-autoconfigure +9 Maven

CVSS 8.1 High

Cleartext Transmission of Sensitive Information, Inclusion of Functionality from Untrusted Control Sphere , and Download of Code Without Integrity Check in Eclipse hawkBit
- Weak cryptography or TLS
- CWE-494
<0.3.0M2 · fixed in 0.3.0M2

GHSA-jwqm-c9f2-2cq3 · CVE-2019-10240 Not analysed yet 15 Apr 2019
CVE-2018-14620 CVE record

CVSS 4.7 Medium

Download of code without integrity check in Red Hat openstack-rabbitmq-container
- Red Hat openstack-rabbitmq-container
- CWE-494
Not analysed yet 10 Sept 2018
CVE-2016-6567 CVE record

SHDesigns' Resident Download Manager (as well as the Ethernet Download Manager) does not authenticate firmware downloads before executing code and deploying them to devices
- SHDesigns Resident Download Manager
- SHDesigns Ethernet Download Manager
- CWE-494
Not analysed yet 13 Jul 2018
CVE-2016-6564 CVE record

Ragentek Android software contains an over-the-air update mechanism that communicates over an unencrypted channel, which can allow a remote attacker to execute arbitrary code with root privileges
- Ragentek Android software
- CWE-494
Not analysed yet 13 Jul 2018
CVE-2017-12740 CVE record

Download of code without integrity check in Siemens LOGO! Soft Comfort (All versions before V8.2)
- Siemens LOGO! Soft Comfort (All versions before V8.2)
- CWE-494
Not analysed yet 26 Dec 2017
CVE-2017-13083 CVE record

CVSS 5.3 Medium

Improper certificate validation in Akeo Consulting Rufus
- Akeo Consulting Rufus
- Weak cryptography or TLS
- CWE-345
Not analysed yet 18 Oct 2017
CVE-2014-2378 CVE record

CVSS 6.5 Medium

Sensys Networks Traffic Sensor Download of Code Without Integrity Check
- Sensys Networks VSN240-F
- Sensys Networks VSN240-T
- CWE-494
Not analysed yet 5 Sept 2014
CVE-2001-1125 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Symantec LiveUpdate before 1.6 does not use cryptography to ensure the integrity of download files, which allows remote attackers to execute arbitrary code via DNS spoofing of the update.symantec.com…
- CWE-494
Not analysed yet 15 Mar 2002