CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel
baseThe product establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that the message was not modified during transmission.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (46)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-3596US | critical9.0OT high | Exploit | ||
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any ot… | ||||
| CVE-2022-23303US | critical9.8 | Exploit | ||
The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exist… | ||||
| CVE-2022-23304US | critical9.8 | — | ||
The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue e… | ||||
| CVE-2020-5869US | critical9.1 | — | ||
In BIG-IQ 5.2.0-7.0.0, high availability (HA) synchronization is not secure by TLS and may allow on-path attackers to read / modify confidential data in transit. | ||||
| CVE-2020-15685US | high8.8 | — | ||
During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated within the encrypted session. This vulnerability affects Thund… | ||||
| CVE-2021-34793US | high8.6 | — | ||
A vulnerability in the TCP Normalizer of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software operating in transparent mode could allow an u… | ||||
| CVE-2023-6408US | high8.1 | — | ||
CWE-924: Improper Enforcement of Message Integrity During Transmission in a
Communication Channel vulnerability exists that could cause a denial of service and loss of
confidentia… | ||||
| CVE-2021-41034US | high8.1 | — | ||
The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint. As a consequence the builds of such stacks are vulnerable… | ||||
| CVE-2018-7295US | high8.1 | — | ||
ffxivlauncher.exe in Square Enix Final Fantasy XIV 4.21 and 4.25 on Windows is affected by Improper Enforcement of Message Integrity During Transmission in a Communication Channel,… | ||||
| CVE-2023-49933US | high7.5 | — | ||
An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. There is Improper Enforcement of Message Integrity During Transmission in a Communication Channel. This allo… | ||||
| CVE-2022-3166US | high7.5 | — | ||
Rockwell Automation was made aware that the webservers of the Micrologix 1100 and 1400 controllers contain a vulnerability that may lead to a denial-of-service condition. The secu… | ||||
| CVE-2018-14526US | medium6.5 | — | ||
An issue was discovered in rsn_supp/wpa.c in wpa_supplicant 2.0 through 2.6. Under certain conditions, the integrity of EAPOL-Key messages is not checked, leading to a decryption o… | ||||
| CVE-2019-20844US | medium6.5 | — | ||
An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. An attacker can spoof a direct-message channel by changing the type of a channel. | ||||
| CVE-2022-26491US | medium5.9 | — | ||
An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to a malicious server. The client will perform TLS c… | ||||
| CVE-2015-2968US | medium5.9 | — | ||
LINE@ for Android version 1.0.0 and LINE@ for iOS version 1.0.0 are vulnerable to MITM (man-in-the-middle) attack since the application allows non-SSL/TLS communications. As a resu… | ||||
| CVE-2015-0897US | medium5.9 | — | ||
LINE for Android version 5.0.2 and earlier and LINE for iOS version 5.0.0 and earlier are vulnerable to MITM (man-in-the-middle) attack since the application allows non-SSL/TLS com… | ||||
| CVE-2023-3347US | medium5.9OT elevated | — | ||
A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connectio… | ||||
| CVE-2021-21390US | medium5.9 | — | ||
MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-17T02-33-02Z,… | ||||
| CVE-2023-43297US | medium5.4 | — | ||
An issue in animal-art-lab v13.6.1 allows attackers to send crafted notifications via leakage of the channel access token. | ||||
| CVE-2024-39229US | medium5.3 | — | ||
An issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan