Download of Code Without Integrity Check

The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

CVEs (209)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2025-7620 - - Jun 17, 2026 Jul 14, 2025 8.6 HIGH· v4 8.8 HIGH· v3 N/A· v2 The cross-browser document creation component produced by Digitware System Integration Corporation has a Remote Code Execution vulnerability. If a user visits a malicious website while the component is active, remote att...Show more The cross-browser document creation component produced by Digitware System Integration Corporation has a Remote Code Execution vulnerability. If a user visits a malicious website while the component is active, remote attackers can cause the system to download and execute arbitrary programs.Show less
CVE-2025-52937 - - Jun 17, 2026 Jun 23, 2025 2.0 LOW· v4 N/A· v3 N/A· v2 Vulnerability in PointCloudLibrary PCL (surface/src/3rdparty/opennurbs modules). This vulnerability is associated with program files crc32.C. This vulnerability is only relevant if the PCL version is older than 1.14.0 o...Show more Vulnerability in PointCloudLibrary PCL (surface/src/3rdparty/opennurbs modules). This vulnerability is associated with program files crc32.C. This vulnerability is only relevant if the PCL version is older than 1.14.0 or the user specifically requests to not use the system zlib (WITH_SYSTEM_ZLIB=FALSE).Show less
CVE-2025-28236 - - Jun 17, 2026 Apr 18, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Nautel VX Series transmitters VX SW v6.4.0 and below was discovered to contain a remote code execution (RCE) vulnerability in the firmware update process. This vulnerability allows attackers to execute arbitrary code via...Show more Nautel VX Series transmitters VX SW v6.4.0 and below was discovered to contain a remote code execution (RCE) vulnerability in the firmware update process. This vulnerability allows attackers to execute arbitrary code via supplying a crafted update package to the /#/software/upgrades endpoint.Show less
CVE-2025-27593 - - Jun 17, 2026 Mar 14, 2025 N/A· v4 9.3 CRITICAL· v3 N/A· v2 The product can be used to distribute malicious code using SDD Device Drivers due to missing download verification checks, leading to code execution on target systems.
CVE-2024-43169 1Ibm 1Engineering Requirements Management Doors Next Jun 17, 2026 Mar 3, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 could allow a user to download a malicious file without verifying the integrity of the code.
CVE-2024-50696 1Sungrowpower 1Winet S Firmware Jun 17, 2026 Feb 26, 2025 N/A· v4 7.5 HIGH· v3 N/A· v2 SunGrow WiNet-S V200.001.00.P025 and earlier versions is missing integrity checks for firmware upgrades. Sending a specific MQTT message allows an update to an inverter or a WiNet connectivity dongle with a bogus firmwar...Show more SunGrow WiNet-S V200.001.00.P025 and earlier versions is missing integrity checks for firmware upgrades. Sending a specific MQTT message allows an update to an inverter or a WiNet connectivity dongle with a bogus firmware file that is located on attacker-controlled server.Show less
CVE-2025-1058 - - Jun 17, 2026 Feb 13, 2025 7.2 HIGH· v4 8.1 HIGH· v3 N/A· v2 CWE-494: Download of Code Without Integrity Check vulnerability exists that could render the device inoperable when malicious firmware is downloaded.
CVE-2024-52331 1Ecovacs 14Airbot Andy Firmware Airbot Ava FirmwareAirbot Z1 Firmware+11 more Jun 17, 2026 Jan 23, 2025 7.7 HIGH· v4 7.5 HIGH· v3 N/A· v2 ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot.
CVE-2024-42183 - - Jun 17, 2026 Jan 23, 2025 N/A· v4 2.5 LOW· v3 N/A· v2 BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability. It could allow a malicious operator to download files from arbitrary URLs without any proper validation or allowlist controls.
CVE-2024-55459 1Keras 1Keras Jun 17, 2026 Jan 8, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the get_file function.
CVE-2024-54126 - - Jun 17, 2026 Dec 5, 2024 8.5 HIGH· v4 N/A· v3 N/A· v2 This vulnerability exists in the TP-Link Archer C50 due to improper signature verification mechanism in the firmware upgrade process at its web interface. An attacker with administrative privileges within the router’s Wi...Show more This vulnerability exists in the TP-Link Archer C50 due to improper signature verification mechanism in the firmware upgrade process at its web interface. An attacker with administrative privileges within the router’s Wi-Fi range could exploit this vulnerability by uploading and executing malicious firmware which could lead to complete compromise of the targeted device.Show less
CVE-2024-52583 - - Jun 17, 2026 Nov 18, 2024 N/A· v4 8.2 HIGH· v3 N/A· v2 The WesHacks GitHub repository provides the official Hackathon competition website source code for the Muweilah Wesgreen Hackathon. The page `schedule.html` before 17 November 2024 or commit 93dfb83 contains links to `Le...Show more The WesHacks GitHub repository provides the official Hackathon competition website source code for the Muweilah Wesgreen Hackathon. The page `schedule.html` before 17 November 2024 or commit 93dfb83 contains links to `Leostop`, a site that hosts a malicious injected JavaScript file that occurs when bootstrap is run as well as jquery. `Leostop` may be a tracking malware and creates 2 JavaScript files, but little else is known about it. The WesHacks website remove all references to `Leostop` as of 17 November 2024.Show less
CVE-2024-48974 - - Jun 17, 2026 Nov 14, 2024 N/A· v4 9.3 CRITICAL· v3 N/A· v2 The ventilator does not perform proper file integrity checks when adopting firmware updates. This makes it possible for an attacker to force unauthorized changes to the device's configuration settings and/or compromise d...Show more The ventilator does not perform proper file integrity checks when adopting firmware updates. This makes it possible for an attacker to force unauthorized changes to the device's configuration settings and/or compromise device functionality by pushing a compromised/illegitimate firmware file. This could disrupt the function of the device and/or cause unauthorized information disclosure.Show less
CVE-2024-33660 1Ami 1Aptio V Jun 17, 2026 Nov 12, 2024 5.2 MEDIUM· v4 4.3 MEDIUM· v3 N/A· v2 An exploit is possible where an actor with physical access can manipulate SPI flash without being detected.
CVE-2024-45321 1App 1\ Jun 17, 2026 Aug 27, 2024 N/A· v4 8.1 HIGH· v3 N/A· v2 The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.
CVE-2024-39819 1Zoom 3Meeting Software Development Kit RoomsWorkplace Desktop Jun 17, 2026 Jul 15, 2024 N/A· v4 7.3 HIGH· v3 N/A· v2 Integrity check in the installer for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct a privilege escalation via local access.
CVE-2023-41921 - - Jun 17, 2026 Jul 2, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin and integrity of the code. This vulnerability can allow atta...Show more A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin and integrity of the code. This vulnerability can allow attackers to modify the firmware before uploading it to the system, thus achieving the modification of the target’s integrity to achieve an insecure state.Show less
CVE-2024-39348 1Synology 1Router Manager Jun 17, 2026 Jun 28, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 Download of code without integrity check vulnerability in AirPrint functionality in Synology Router Manager (SRM) before 1.2.5-8227-11 and 1.3.1-9346-8 allows man-in-the-middle attackers to execute arbitrary code via uns...Show more Download of code without integrity check vulnerability in AirPrint functionality in Synology Router Manager (SRM) before 1.2.5-8227-11 and 1.3.1-9346-8 allows man-in-the-middle attackers to execute arbitrary code via unspecified vectors.Show less
CVE-2024-30206 - - Jun 17, 2026 May 14, 2024 8.8 HIGH· v4 8.8 HIGH· v3 N/A· v2 A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2...Show more A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA30) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA30) (All versions < V3.0.1.1). Affected SIMATIC RTLS Locating Manager Clients do not properly check the integrity of update files. This could allow an unauthenticated remote attacker to alter update files in transit and trick an authorized user into installing malicious code. A successful exploit requires the attacker to be able to modify the communication between server and client on the network.Show less
CVE-2024-33118 1Luckyframe 1Luckyframeweb Jun 17, 2026 May 6, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary read vulnerability via the fileDownload method in class com.luckyframe.project.common.CommonController.

Previous 1 2 345...11 Next