CWE-494 · Supply Chain and Malicious Code
Download of Code Without Integrity Check
236CVEs
4exploited
1with a public check
0likely (EPSS 10%+)
SortMost likely exploited
236 CVEs with CWE-494 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2022-40799In CISA KEVExploitedData Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the device.D-Link · DNR-322L · CVSS 8.8 · 2022-11-29 | 8.8 | 34% | 2022-11-29 |
| CVE-2026-3502In CISA KEVExploitedTrueConf Client Update Integrity Verification BypassTrueConf · TrueConf Client · CVSS 7.8 · 2026-03-30 | 7.8 | 5.8% | 2026-03-30 |
| CVE-2025-15556In CISA KEVExploitedNotepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verificationnotepad-plus-plus · notepad-plus-plus · CVSS 7.7 · 2026-02-03 | 7.7 | 1.7% | 2026-02-03 |
| CVE-2021-44168In CISA KEVExploitedA download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbi…Fortinet · Fortinet FortiOS · CVSS 3.3 · 2022-01-04 | 3.3 | 0.9% | 2022-01-04 |
| CVE-2021-45027CheckOliver 5 Library Server <8.00.008.053 - Local File InclusionSoftlinkint · Oliver V5 Library · 2022-09-01 | – | 2.0% | 2022-09-01 |
| CVE-2018-19234The Miss Marple Updater Service in COMPAREX Miss Marple Enterprise Edition before 2.0 allows remote attackers to execute arbitrary code with SYSTEM privileges via vectors related…Comparex · Miss Marple · 2018-12-20 | – | 3.3% | 2018-12-20 |
| CVE-2016-6567SHDesigns' Resident Download Manager (as well as the Ethernet Download Manager) does not authenticate firmware downloads before executing code and deploying them to devicesSHDesigns · Resident Download Manager · 2018-07-13 | – | 2.9% | 2018-07-13 |
| CVE-2016-6564Ragentek Android software contains an over-the-air update mechanism that communicates over an unencrypted channel, which can allow a remote attacker to execute arbitrary code with…Ragentek · Android software · 2018-07-13 | – | 2.6% | 2018-07-13 |
| CVE-2001-1125Symantec LiveUpdate before 1.6 does not use cryptography to ensure the integrity of download files, which allows remote attackers to execute arbitrary code via DNS spoofing of the…Symantec · Liveupdate · CVSS 9.8 · 2002-03-15 | 9.8 | 2.5% | 2002-03-15 |
| CVE-2020-1453Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft · Microsoft SharePoint Enterprise Server 2016 · CVSS 8.6 · 2020-09-11 | 8.6 | 2.2% | 2020-09-11 |
| CVE-2020-1452Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft · Microsoft SharePoint Enterprise Server 2016 · CVSS 8.6 · 2020-09-11 | 8.6 | 2.2% | 2020-09-11 |
| CVE-2022-27438Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affected by a remote code execution vulnerabi…Caphyon · Advanced Installer · 2022-06-06 | – | 2.1% | 2022-06-06 |
| CVE-2020-1200Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft · Microsoft SharePoint Enterprise Server 2016 · CVSS 8.6 · 2020-09-11 | 8.6 | 2.1% | 2020-09-11 |
| CVE-2020-1595Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft · Microsoft SharePoint Enterprise Server 2016 · CVSS 9.9 · 2020-09-11 | 9.9 | 2.0% | 2020-09-11 |
| CVE-2020-9474The S. Siedle & Soehne SG 150-0 Smart Gateway before 1.2.4 allows remote code execution via the backup functionality in the web frontend. By using an exploit chain, an attacker wi…Siedle · Sg 150-0 Firmware · 2020-05-07 | – | 1.9% | 2020-05-07 |
| CVE-2020-1210Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft · Microsoft SharePoint Enterprise Server 2016 · CVSS 9.9 · 2020-09-11 | 9.9 | 1.9% | 2020-09-11 |
| CVE-2022-24644ZZ Inc. KeyMouse Windows 3.08 and prior is affected by a remote code execution vulnerability during an unauthenticated update. To exploit this vulnerability, a user must trigger a…Zzinc · Keymouse Firmware · 2022-03-07 | – | 1.9% | 2022-03-07 |
| CVE-2020-1576Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft · Microsoft SharePoint Enterprise Server 2016 · CVSS 8.5 · 2020-09-11 | 8.5 | 1.6% | 2020-09-11 |
| CVE-2022-28944Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check. This affects MSI Package Builder for Windows 9.1.4 and Remote Installer for Wind…Emcosoftware · Msi Package Builder · 2022-05-23 | – | 1.6% | 2022-05-23 |
| CVE-2022-22786Update package downgrade in Zoom Client for Meetings for WindowsZoom Video Communications Inc · Zoom Client for Meetings for Windows · CVSS 7.5 · 2022-05-18 | 7.5 | 1.5% | 2022-05-18 |
| CVE-2008-3324The PartyGaming PartyPoker client program 121/120 does not properly verify the authenticity of updates, which allows remote man-in-the-middle attackers to execute arbitrary code v…Party Gaming · Party Poker Client · 2008-08-18 | – | 1.4% | 2008-08-18 |
| CVE-2020-10926This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required…NETGEAR · R6700 · CVSS 7.5 · 2020-07-28 | 7.5 | 1.2% | 2020-07-28 |
| CVE-2020-8809Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection. A man-in-the-middle attacker can prompt the user to do…Gurux · Device Language Message Specification Director · 2020-02-25 | – | 1.2% | 2020-02-25 |
| CVE-2021-33879Tencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP connection. A malicious attacker in an MITM position could spoof the contents of an XML document describ…Tencent · Gameloop · 2021-06-06 | – | 1.2% | 2021-06-06 |
| CVE-2026-27180MajorDoMo Supply Chain Remote Code Execution via Update URL Poisoningsergejey · MajorDoMo · CVSS 9.8 · 2026-02-18 | 9.8 | 1.2% | 2026-02-18 |
| CVE-2020-28213A CWE-494: Download of Code Without Integrity Check vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause unauthoriz…Schneider-Electric · PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) · 2020-11-19 | – | 1.2% | 2020-11-19 |
| CVE-2002-0671Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 downloads phone applications from a web site but can not verify the integrity of the applications, which could…Pingtel · Xpressa Firmware · 2003-04-02 | – | 1.2% | 2003-04-02 |
| CVE-2019-7229The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: "Utilization of USB/SD Card to flash the device" and "Remote provisi…Abb · Board Support Package Un31 · 2019-06-24 | – | 1.1% | 2019-06-24 |
| CVE-2020-28332Barco wePresent WiPG-1600W devices download code without an Integrity Check. Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19. The Barco wePresent WiPG-1600W firmware do…Barco · Wepresent Wipg-1600w Firmware · 2020-11-24 | – | 1.1% | 2020-11-24 |
| CVE-2018-5409PrinterLogic Print Management Software updates and executes the code without origin and code verificationPrinterLogic · Management Software · 2019-05-08 | – | 1.1% | 2019-05-08 |
| CVE-2019-3977RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using the autoupgrade feature. Therefore, a remo…Mikrotik · MikroTik RouterOS · 2019-10-28 | – | 1.1% | 2019-10-28 |
| CVE-2020-5772Improper Input Validation in Teltonika firmware TRB2_R_00.02.04.01 allows a remote, authenticated attacker to gain root privileges by uploading a malicious package file.Teltonika-Networks · Teltonika Gateway TRB245 · 2020-08-03 | – | 1.1% | 2020-08-03 |
| CVE-2026-42249Remote Code Execution in Ollama via Update MechanismOllama · Ollama · CVSS 7.7 · 2026-04-29 | 7.7 | 1.0% | 2026-04-29 |
| CVE-2019-12809Yes24ViewerX ActiveX Control 1.0.327.50126 and earlier versions contains a vulnerability that could allow remote attackers to download and execute arbitrary files by setting the a…YES24 · YES24 PC VIEWER · 2019-08-15 | – | 1.0% | 2019-08-15 |
| CVE-2019-12728Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP.Grails · Grails · CVSS 8.1 · 2019-06-04 | 8.1 | 1.0% | 2019-06-04 |
| CVE-2020-7883Printchaser v2.2021.804.1 and earlier versions contain a vulnerability, which could allow remote attacker to download and execute remote file by setting the argument, variable in…WOWSOFT · Printchaser · 2021-12-28 | – | 1.0% | 2021-12-28 |
| CVE-2024-27438Apache Doris: Downloading arbitrary remote jar files resulting in remote command executionApache Software Foundation · Apache Doris · CVSS 9.8 · 2024-03-21 | 9.8 | 1.0% | 2024-03-21 |
| CVE-2022-36359An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack tha…Djangoproject · Django · 2022-08-03 | – | 0.9% | 2022-08-03 |
| CVE-2020-2320Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads.Jenkins project · Jenkins Plugin Installation Manager Tool · 2020-12-03 | – | 0.9% | 2020-12-03 |
| CVE-2020-7505A CWE-494 Download of Code Without Integrity Check vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to inject data with danger…Schneider-Electric · Easergy T300 (Firmware version 1.5.2 and older) · 2020-06-16 | – | 0.9% | 2020-06-16 |
| CVE-2014-2378Sensys Networks Traffic Sensor Download of Code Without Integrity CheckSensys Networks · VSN240-F · CVSS 6.5 · 2014-09-05 | 6.5 | 0.9% | 2014-09-05 |
| CVE-2021-3485Improper Input Validation in Bitdefender Endpoint Security Tools for LinuxBitdefender · Endpoint Security Tools for Linux · CVSS 6.4 · 2021-05-24 | 6.4 | 0.9% | 2021-05-24 |
| CVE-2020-7831A vulnerability in the web-based contract management service interface Ebiz4u of INOGARD could allow an victim user to download any file. The attacker is able to use startup menu…INOGARD · Ebiz4u CViewer Object AxECM.dll · CVSS 8.8 · 2020-08-24 | 8.8 | 0.9% | 2020-08-24 |
| CVE-2008-3438Apple Mac OS X does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated…Apple · Mac Os X · 2008-08-01 | – | 0.8% | 2008-08-01 |
| CVE-2023-45838Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-th…Buildroot · Buildroot · CVSS 8.1 · 2023-12-05 | 8.1 | 0.8% | 2023-12-05 |
| CVE-2023-43608A data integrity vulnerability exists in the BR_NO_CHECK_HASH_FOR functionality of Buildroot 2023.08.1 and dev commit 622698d7847. A specially crafted man-in-the-middle attack can…Buildroot · Buildroot · CVSS 8.1 · 2023-12-05 | 8.1 | 0.8% | 2023-12-05 |
| CVE-2023-45842Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-th…Buildroot · Buildroot · CVSS 8.1 · 2023-12-05 | 8.1 | 0.8% | 2023-12-05 |
| CVE-2023-45841Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-th…Buildroot · Buildroot · CVSS 8.1 · 2023-12-05 | 8.1 | 0.8% | 2023-12-05 |
| CVE-2023-45840Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-th…Buildroot · Buildroot · CVSS 8.1 · 2023-12-05 | 8.1 | 0.8% | 2023-12-05 |
| CVE-2023-45839Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-th…Buildroot · Buildroot · CVSS 8.1 · 2023-12-05 | 8.1 | 0.8% | 2023-12-05 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.