Total
144 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-27593 | 2025-03-14 | N/A | 9.3 CRITICAL | ||
| The product can be used to distribute malicious code using SDD Device Drivers due to missing download verification checks, leading to code execution on target systems. | |||||
| CVE-2023-39474 | 1 Inductiveautomation | 1 Ignition | 2025-03-13 | N/A | 8.8 HIGH |
| Inductive Automation Ignition downloadLaunchClientJar Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exploit this vulnerability in that the target must connect to a malicious server. The specific flaw exists within the downloadLaunchClientJar function. The issue results from the lack of validating a remote JAR file prior to loading it. An attacker can leverage this vulnerability to execute code in the context of the current user. . Was ZDI-CAN-19915. | |||||
| CVE-2024-43169 | 1 Ibm | 1 Engineering Requirements Management Doors Next | 2025-03-07 | N/A | 8.8 HIGH |
| IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 could allow a user to download a malicious file without verifying the integrity of the code. | |||||
| CVE-2023-27574 | 1 Shadowsocks | 1 Shadowsocksx-ng | 2025-03-06 | N/A | 9.8 CRITICAL |
| ShadowsocksX-NG 1.10.0 signs with com.apple.security.get-task-allow entitlements because of CODE_SIGNING_INJECT_BASE_ENTITLEMENTS. | |||||
| CVE-2023-28818 | 1 Veritas | 2 Aptare It Analytics, Netbackup It Analytics | 2025-02-19 | N/A | 5.3 MEDIUM |
| An issue was discovered in Veritas NetBackup IT Analytics 11 before 11.2.0. The application upgrade process included unsigned files that could be exploited and result in a customer installing unauthentic components. A malicious actor could install rogue Collector executable files (aptare.jar or upgrademanager.zip) on the Portal server, which might then be downloaded and installed on collectors. | |||||
| CVE-2023-27025 | 1 Ruoyi | 1 Ruoyi | 2025-02-18 | N/A | 7.5 HIGH |
| An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the server. | |||||
| CVE-2024-27438 | 2025-02-13 | N/A | 9.8 CRITICAL | ||
| Download of Code Without Integrity Check vulnerability in Apache Doris. The jdbc driver files used for JDBC catalog is not checked and may resulting in remote command execution. Once the attacker is authorized to create a JDBC catalog, he/she can use arbitrary driver jar file with unchecked code snippet. This code snippet will be run when catalog is initializing without any check. This issue affects Apache Doris: from 1.2.0 through 2.0.4. Users are recommended to upgrade to version 2.0.5 or 2.1.x, which fixes the issue. | |||||
| CVE-2025-1058 | 2025-02-13 | N/A | 8.1 HIGH | ||
| CWE-494: Download of Code Without Integrity Check vulnerability exists that could render the device inoperable when malicious firmware is downloaded. | |||||
| CVE-2021-44168 | 1 Fortinet | 1 Fortios | 2025-02-12 | 4.6 MEDIUM | 3.3 LOW |
| A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages. | |||||
| CVE-2023-24503 | 1 Electra-air | 1 Smart Kit For Split Ac | 2025-02-06 | N/A | 7.5 HIGH |
| Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW. | |||||
| CVE-2023-24500 | 1 Electra-air | 2 Central Ac Unit, Central Ac Unit Firmware | 2025-02-06 | N/A | 7.5 HIGH |
| Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW. | |||||
| CVE-2023-28317 | 1 Rocket.chat | 1 Rocket.chat | 2025-01-28 | N/A | 5.3 MEDIUM |
| A vulnerability has been discovered in Rocket.Chat, where editing messages can change the original timestamp, causing the UI to display messages in an incorrect order. | |||||
| CVE-2024-52331 | 2025-01-23 | N/A | 7.5 HIGH | ||
| ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot. | |||||
| CVE-2024-42183 | 2025-01-23 | N/A | 2.5 LOW | ||
| BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability. It could allow a malicious operator to download files from arbitrary URLs without any proper validation or allowlist controls. | |||||
| CVE-2024-55459 | 2025-01-09 | N/A | 6.5 MEDIUM | ||
| An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the get_file function. | |||||
| CVE-2023-29401 | 1 Gin-gonic | 1 Gin | 2025-01-06 | N/A | 4.3 MEDIUM |
| The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of "setup.bat";x=.txt" will be sent as a file named "setup.bat". If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header. | |||||
| CVE-2024-45321 | 1 App\ | 1 \ | 2024-12-05 | N/A | 8.1 HIGH |
| The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers. | |||||
| CVE-2024-54126 | 2024-12-05 | N/A | N/A | ||
| This vulnerability exists in the TP-Link Archer C50 due to improper signature verification mechanism in the firmware upgrade process at its web interface. An attacker with administrative privileges within the router’s Wi-Fi range could exploit this vulnerability by uploading and executing malicious firmware which could lead to complete compromise of the targeted device. | |||||
| CVE-2024-30205 | 2024-12-03 | N/A | 7.1 HIGH | ||
| In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode before 9.6.23. | |||||
| CVE-2024-39348 | 2024-11-21 | N/A | 7.5 HIGH | ||
| Download of code without integrity check vulnerability in AirPrint functionality in Synology Router Manager (SRM) before 1.2.5-8227-11 and 1.3.1-9346-8 allows man-in-the-middle attackers to execute arbitrary code via unspecified vectors. | |||||