CWE-494 下载代码缺少完整性检查 类弱点 138 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-494指下载代码时未进行完整性校验的漏洞。攻击者常通过劫持传输通道、DNS欺骗或入侵源服务器，篡改下载内容以植入恶意代码。开发者应实施数字签名验证或哈希校验，确保代码来源可信且未被篡改，从而防止执行被操纵的程序，保障系统安全。
URL[] classURLs= new URL[]{ new URL("file:subdir/") }; URLClassLoader loader = new URLClassLoader(classURLs); Class loadedClass = Class.forName("loadMe", true, loader);//assume the password is already encrypted, avoiding CWE-312 function authenticate($username,$password){ include("http://external.example.com/dbInfo.php"); //dbInfo.php makes $dbhost, $dbuser, $dbpass, $dbname available mysql_connect($dbhost, $dbuser, $dbpass) or die ('Error connecting to mysql'); mysql_select_db($dbname); $query = 'Select * from users where username='.$username.' And password='.$password; $result = mysql_query($query); if(mysql_numrows($result) == 1){ mysql_close(); return true; } else{ mysql_close(); return false; } }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-45838 | Buildroot 安全漏洞 — Buildroot | 8.1 | High | 2023-12-05 |
| CVE-2023-45839 | Buildroot 安全漏洞 — Buildroot | 8.1 | High | 2023-12-05 |
| CVE-2023-45840 | Buildroot 安全漏洞 — Buildroot | 8.1 | High | 2023-12-05 |
| CVE-2023-45841 | Buildroot 安全漏洞 — Buildroot | 8.1 | High | 2023-12-05 |
| CVE-2023-45842 | Buildroot 安全漏洞 — Buildroot | 8.1 | High | 2023-12-05 |
| CVE-2023-43608 | Buildroot 安全漏洞 — Buildroot | 8.1 | High | 2023-12-05 |
| CVE-2023-5984 | Schneider Electric ION8650和ION8800 安全漏洞 — ION8650 | 7.2 | High | 2023-11-15 |
| CVE-2023-45799 | MLSoft TCO!stream 安全漏洞 — TCO!stream | 7.2 | High | 2023-10-30 |
| CVE-2023-45821 | Artifact Hub 安全漏洞 — hub | 5.4 | Medium | 2023-10-19 |
| CVE-2023-37220 | Synel 安全漏洞 — Terminals | 7.2 | High | 2023-09-03 |
| CVE-2023-37864 | PHOENIX CONTACTs WP 6xxx series web panels 安全漏洞 — WP 6070-WVPS | 7.2 | High | 2023-08-09 |
| CVE-2023-22635 | Fortinet FortiClient 安全漏洞 — FortiClientMac | 6.9 | High | 2023-04-11 |
| CVE-2022-4261 | Rapid7 Nexpose 安全漏洞 — Nexpose | 4.4 | Medium | 2022-12-07 |
| CVE-2022-45442 | Sinatra 安全漏洞 — sinatra | 8.8 | High | 2022-11-28 |
| CVE-2022-38199 | Esri ArcGIS Server 安全漏洞 — ArcGIS Server | 6.1 | Medium | 2022-10-25 |
| CVE-2021-26639 | WISA Smart Wing CMS 安全漏洞 — Smart Wing CMS | 8.1 | High | 2022-08-17 |
| CVE-2021-35532 | Hitachi Energy TXpert Hub CoreTec 4 代码问题漏洞 — TXpert Hub CoreTec 4 version | 7.2 | - | 2022-06-07 |
| CVE-2020-7883 | Printchaser 安全漏洞 — Printchaser | 9.8 | - | 2021-12-28 |
| CVE-2020-7875 | Raonwiz DEXT5 安全漏洞 — DEXT5 Upload | 7.5 | High | 2021-10-28 |
| CVE-2020-7874 | Tobesoft NEXACRO14 安全漏洞 — NEXACRO14 | 8.8 | High | 2021-09-09 |
| CVE-2020-7873 | Younglimwon K-System WellComm 安全漏洞 — K-System WellComm | 8.8 | High | 2021-09-09 |
| CVE-2021-3485 | Bitdefender Endpoint Security Tool 输入验证错误漏洞 — Endpoint Security Tools for Linux | 6.4 | Medium | 2021-05-24 |
| CVE-2020-29032 | Secomea GateManager 代码问题漏洞 — GateManager | 8.4 | High | 2021-03-05 |
| CVE-2020-28213 | Schneider Electric Unity Pro 安全漏洞 — PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) | 8.8 | - | 2020-11-19 |
| CVE-2020-7831 | 管理服务接口Ebiz4u 安全漏洞 — Ebiz4u CViewer Object AxECM.dll | 8.8 | High | 2020-08-24 |
| CVE-2020-7817 | Raonwiz K Upload 安全漏洞 — MyBrowserPlus | 5.5 | Medium | 2020-08-06 |
| CVE-2020-10926 | NETGEAR R6700 安全漏洞 — R6700 | 8.8 | - | 2020-07-28 |
| CVE-2020-7826 | Bflysoft EyeSurfer BflyInstallerX.ocx 安全漏洞 — EyeSurfer BflyInstallerX.ocx | 8.8 | High | 2020-07-17 |
| CVE-2020-7505 | Schneider Electric Easergy T300 安全漏洞 — Easergy T300 (Firmware version 1.5.2 and older) | 7.2 | - | 2020-06-16 |
| CVE-2020-7812 | Kaoni ezHTTPTrans 安全漏洞 — ezHTTPTrans | 7.8 | High | 2020-05-28 |
CWE-494（下载代码缺少完整性检查） 是常见的弱点类别，本平台收录该类弱点关联的 138 条 CVE 漏洞。