CWE-494 Download of Code Without Integrity Check
baseThe product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (312)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-3502US | —OT critical | KEV | ||
TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tam… | ||||
| CVE-2025-15556US | high7.5OT critical | KEV | ||
Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cry… | ||||
| CVE-2022-40799US | high8.8OT critical | KEV | ||
Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the device. | ||||
| CVE-2021-44168US | high7.8OT critical | KEV | ||
A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbit… | ||||
| CVE-2021-30657US | medium5.5OT critical | KEV | ||
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. A malicious application may bypass Gatekee… | ||||
| CVE-2020-5398US | high7.5OT high | Exploit | ||
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (R… | ||||
| CVE-2000-0854US | high10.0OT high | Exploit | ||
When a Microsoft Office 2000 document is launched, the directory of that document is first used to locate DLL's such as riched20.dll and msi.dll, which could allow an attacker to e… | ||||
| CVE-2026-42249US | critical9.8OT high | Exploit | ||
Ollama for Windows contains a Remote Code Execution vulnerability in its update mechanism due to improper handling of attacker‑controlled HTTP response headers. When downloading up… | ||||
| CVE-2026-42248US | critical9.8OT high | Exploit | ||
Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables. Unlike other platforms, the Windows implementation of the update verifi… | ||||
| CVE-2021-44223US | critical9.8OT high | — | ||
WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress… | ||||
| CVE-2022-28944US | high8.8OT high | Exploit | ||
Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check. This affects MSI Package Builder for Windows 9.1.4 and Remote Installer for Windo… | ||||
| CVE-2022-24644US | high8.8OT high | Exploit | ||
ZZ Inc. KeyMouse Windows 3.08 and prior is affected by a remote code execution vulnerability during an unauthenticated update. To exploit this vulnerability, a user must trigger an… | ||||
| CVE-2026-33075US | high8.8OT high | Exploit | ||
FastGPT is an AI Agent building platform. In versions 4.14.8.3 and below, the fastgpt-preview-image.yml workflow is vulnerable to arbitrary code execution and secret exfiltration b… | ||||
| CVE-2022-45442US | high8.8OT high | Exploit | ||
Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable… | ||||
| CVE-2024-7344US | high8.2OT elevated | Exploit | ||
Howyar UEFI Application "Reloader" (32-bit and 64-bit) is vulnerable to execution of unsigned software in a hardcoded path. | ||||
| CVE-2022-27438US | high8.1OT elevated | Exploit | ||
Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affected by a remote code execution vulnerabil… | ||||
| CVE-2013-1537US | high10.0OT elevated | — | ||
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and Ope… | ||||
| CVE-2021-37160US | critical9.8OT elevated | — | ||
A firmware validation issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. There i… | ||||
| CVE-2021-33879US | high8.1OT elevated | Exploit | ||
Tencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP connection. A malicious attacker in an MITM position could spoof the contents of an XML document describi… | ||||
| CVE-2020-8809US | high8.1OT elevated | Exploit | ||
Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection. A man-in-the-middle attacker can prompt the user to dow… | ||||
03
attack patterns (12)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan