Filtered by CWE-494
Total 174 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-23110 1 Netgear 18 D6100, D6100 Firmware, Dgn1000v3 and 15 more 2025-03-26 7.4 High
An exploitable firmware modification vulnerability was discovered in certain Netgear products. The data integrity of the uploaded firmware image is ensured with a fixed checksum number. Therefore, an attacker can conduct a MITM attack to modify the user-uploaded firmware image and bypass the checksum verification. This affects WNR612v2 Wireless Routers 1.0.0.3 and earlier, DGN1000v3 Modem Router 1.0.0.22 and earlier, D6100 WiFi DSL Modem Routers 1.0.0.63 and earlier, WNR1000v2 Wireless Routers 1.1.2.60 and earlier, XAVN2001v2 Wireless-N Extenders 0.4.0.7 and earlier, WNR2200 Wireless Routers 1.0.1.102 and earlier, WNR2500 Wireless Routers 1.0.0.34 and earlier, R8900 Smart WiFi Routers 1.0.3.6 and earlier, and R9000 Smart WiFi Routers 1.0.3.6 and earlier.
CVE-2025-27593 2025-03-14 9.3 Critical
The product can be used to distribute malicious code using SDD Device Drivers due to missing download verification checks, leading to code execution on target systems.
CVE-2023-39474 1 Inductiveautomation 1 Ignition 2025-03-13 8.8 High
Inductive Automation Ignition downloadLaunchClientJar Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exploit this vulnerability in that the target must connect to a malicious server. The specific flaw exists within the downloadLaunchClientJar function. The issue results from the lack of validating a remote JAR file prior to loading it. An attacker can leverage this vulnerability to execute code in the context of the current user. . Was ZDI-CAN-19915.
CVE-2023-27574 1 Shadowsocks 1 Shadowsocksx-ng 2025-03-06 9.8 Critical
ShadowsocksX-NG 1.10.0 signs with com.apple.security.get-task-allow entitlements because of CODE_SIGNING_INJECT_BASE_ENTITLEMENTS.
CVE-2023-28818 1 Veritas 2 Aptare It Analytics, Netbackup It Analytics 2025-02-19 5.3 Medium
An issue was discovered in Veritas NetBackup IT Analytics 11 before 11.2.0. The application upgrade process included unsigned files that could be exploited and result in a customer installing unauthentic components. A malicious actor could install rogue Collector executable files (aptare.jar or upgrademanager.zip) on the Portal server, which might then be downloaded and installed on collectors.
CVE-2023-27025 1 Ruoyi 1 Ruoyi 2025-02-18 7.5 High
An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the server.
CVE-2023-45842 1 Buildroot 1 Buildroot 2025-02-13 8.1 High
Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the `mxsldr` package.
CVE-2023-45841 1 Buildroot 1 Buildroot 2025-02-13 8.1 High
Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the `versal-firmware` package.
CVE-2023-45840 1 Buildroot 1 Buildroot 2025-02-13 8.1 High
Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the `riscv64-elf-toolchain` package.
CVE-2023-45839 1 Buildroot 1 Buildroot 2025-02-13 8.1 High
Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the `aufs-util` package.
CVE-2023-45838 1 Buildroot 1 Buildroot 2025-02-13 8.1 High
Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the `aufs` package.
CVE-2023-43608 1 Buildroot 1 Buildroot 2025-02-13 8.1 High
A data integrity vulnerability exists in the BR_NO_CHECK_HASH_FOR functionality of Buildroot 2023.08.1 and dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.
CVE-2022-36359 2 Debian, Djangoproject 2 Debian Linux, Django 2025-02-13 8.8 High
An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input.
CVE-2025-1058 2025-02-13 8.1 High
CWE-494: Download of Code Without Integrity Check vulnerability exists that could render the device inoperable when malicious firmware is downloaded.
CVE-2023-24503 1 Electra-air 1 Smart Kit For Split Ac 2025-02-06 7.5 High
Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW.
CVE-2023-24500 1 Electra-air 2 Central Ac Unit, Central Ac Unit Firmware 2025-02-06 7.5 High
Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW.
CVE-2023-28317 1 Rocket.chat 1 Rocket.chat 2025-01-28 5.3 Medium
A vulnerability has been discovered in Rocket.Chat, where editing messages can change the original timestamp, causing the UI to display messages in an incorrect order.
CVE-2024-42183 2025-01-23 2.5 Low
BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability. It could allow a malicious operator to download files from arbitrary URLs without any proper validation or allowlist controls.
CVE-2023-29401 2 Gin-gonic, Redhat 4 Gin, Migration Toolkit Virtualization, Openshift and 1 more 2025-01-06 4.3 Medium
The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of "setup.bat";x=.txt" will be sent as a file named "setup.bat". If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.
CVE-2024-45321 3 App\, Perl, Redhat 3 \, Cpanminus, Enterprise Linux 2024-12-05 9.8 Critical
The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.