CWE-494 Download of Code Without Integrity Check
baseThe product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (312)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-3502US | —OT kritisch | KEV | ||
TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tam… | ||||
| CVE-2025-15556US | high7.5OT kritisch | KEV | ||
Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cry… | ||||
| CVE-2022-40799US | high8.8OT kritisch | KEV | ||
Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the device. | ||||
| CVE-2021-44168US | high7.8OT kritisch | KEV | ||
A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbit… | ||||
| CVE-2021-30657US | medium5.5OT kritisch | KEV | ||
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. A malicious application may bypass Gatekee… | ||||
| CVE-2020-5398US | high7.5OT hoch | Exploit | ||
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (R… | ||||
| CVE-2000-0854US | high10.0OT hoch | Exploit | ||
When a Microsoft Office 2000 document is launched, the directory of that document is first used to locate DLL's such as riched20.dll and msi.dll, which could allow an attacker to e… | ||||
| CVE-2026-42249US | critical9.8OT hoch | Exploit | ||
Ollama for Windows contains a Remote Code Execution vulnerability in its update mechanism due to improper handling of attacker‑controlled HTTP response headers. When downloading up… | ||||
| CVE-2026-42248US | critical9.8OT hoch | Exploit | ||
Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables. Unlike other platforms, the Windows implementation of the update verifi… | ||||
| CVE-2021-44223US | critical9.8OT hoch | — | ||
WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress… | ||||
| CVE-2022-28944US | high8.8OT hoch | Exploit | ||
Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check. This affects MSI Package Builder for Windows 9.1.4 and Remote Installer for Windo… | ||||
| CVE-2022-24644US | high8.8OT hoch | Exploit | ||
ZZ Inc. KeyMouse Windows 3.08 and prior is affected by a remote code execution vulnerability during an unauthenticated update. To exploit this vulnerability, a user must trigger an… | ||||
| CVE-2026-33075US | high8.8OT hoch | Exploit | ||
FastGPT is an AI Agent building platform. In versions 4.14.8.3 and below, the fastgpt-preview-image.yml workflow is vulnerable to arbitrary code execution and secret exfiltration b… | ||||
| CVE-2022-45442US | high8.8OT hoch | Exploit | ||
Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable… | ||||
| CVE-2024-7344US | high8.2OT erhöht | Exploit | ||
Howyar UEFI Application "Reloader" (32-bit and 64-bit) is vulnerable to execution of unsigned software in a hardcoded path. | ||||
| CVE-2022-27438US | high8.1OT erhöht | Exploit | ||
Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affected by a remote code execution vulnerabil… | ||||
| CVE-2013-1537US | high10.0OT erhöht | — | ||
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and Ope… | ||||
| CVE-2021-37160US | critical9.8OT erhöht | — | ||
A firmware validation issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. There i… | ||||
| CVE-2021-33879US | high8.1OT erhöht | Exploit | ||
Tencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP connection. A malicious attacker in an MITM position could spoof the contents of an XML document describi… | ||||
| CVE-2020-8809US | high8.1OT erhöht | Exploit | ||
Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection. A man-in-the-middle attacker can prompt the user to dow… | ||||
03
Angriffsmuster (12)
CAPEC-Angriffsmuster, die dies ausnutzen.
04
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan