CWE-494 下载代码缺少完整性检查 类弱点 138 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-494指下载代码时未进行完整性校验的漏洞。攻击者常通过劫持传输通道、DNS欺骗或入侵源服务器，篡改下载内容以植入恶意代码。开发者应实施数字签名验证或哈希校验，确保代码来源可信且未被篡改，从而防止执行被操纵的程序，保障系统安全。
URL[] classURLs= new URL[]{ new URL("file:subdir/") }; URLClassLoader loader = new URLClassLoader(classURLs); Class loadedClass = Class.forName("loadMe", true, loader);//assume the password is already encrypted, avoiding CWE-312 function authenticate($username,$password){ include("http://external.example.com/dbInfo.php"); //dbInfo.php makes $dbhost, $dbuser, $dbpass, $dbname available mysql_connect($dbhost, $dbuser, $dbpass) or die ('Error connecting to mysql'); mysql_select_db($dbname); $query = 'Select * from users where username='.$username.' And password='.$password; $result = mysql_query($query); if(mysql_numrows($result) == 1){ mysql_close(); return true; } else{ mysql_close(); return false; } }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2020-7813 | Kaoni ezHTTPTrans 安全漏洞 — ezHTTPTrans | 7.8 | High | 2020-05-22 |
| CVE-2020-7806 | Tobesoft Xplatform 安全漏洞 — Xplatform | 7.8 | High | 2020-05-06 |
| CVE-2019-19167 | Tobesoft Nexacro 安全漏洞 — Nexacro14 | 7.8 | High | 2020-05-06 |
| CVE-2019-19166 | Tobesoft Xplatform 安全漏洞 — XPlatform | 7.8 | High | 2020-05-06 |
| CVE-2019-19165 | Inogard Ebiz4u 安全漏洞 — Ebiz4u ActiveX of Inogard Co,,LTD(AxECM.cab) on Windows 7/8/10 | 7.2 | High | 2020-04-29 |
| CVE-2020-9751 | Naver Cloud Explorer 安全漏洞 — Naver Cloud Explorer | 9.8 | - | 2020-03-03 |
| CVE-2019-3977 | MikroTik RouterOS 安全漏洞 — MikroTik RouterOS | 9.1 | - | 2019-10-28 |
| CVE-2019-9534 | Cobham plc EXPLORER 710 代码问题漏洞 — Explorer 710 | 7.8 | - | 2019-10-10 |
| CVE-2019-14845 | Red Hat OpenShift 安全漏洞 — openshift | 5.9 | - | 2019-10-08 |
| CVE-2019-13534 | 多款Philips产品安全漏洞 — Philips IntelliVue WLAN, portable patient monitors | 7.2 | - | 2019-09-12 |
| CVE-2019-12809 | Yes24ViewerX ActiveX Control 输入验证错误漏洞 — YES24 PC VIEWER | 8.8 | - | 2019-08-15 |
| CVE-2018-5409 | PrinterLogic Print Management 访问控制错误漏洞 — Management Software | 9.8 | - | 2019-05-08 |
| CVE-2019-3801 | 多款Cloud Foundry产品输入验证错误漏洞 — CredHub | 9.8 | - | 2019-04-25 |
| CVE-2018-14620 | Red Hat Openstack 安全漏洞 — openstack-rabbitmq-container | 9.8 | - | 2018-09-10 |
| CVE-2016-6564 | BLU Studio G 权限许可和访问控制问题漏洞 — Android software | 8.1 | - | 2018-07-13 |
| CVE-2016-6567 | SHDesigns Resident Download Manager 输入验证漏洞 — Resident Download Manager | 9.8 | - | 2018-07-13 |
| CVE-2017-12740 | Siemens LOGO! Soft Comfort 安全漏洞 — Siemens LOGO! Soft Comfort (All versions before V8.2) | 5.9 | - | 2017-12-26 |
| CVE-2014-2378 | Sensys Networks VSN240-F/VSN240-T sensors VDS/TrafficDOT 代码注入漏洞 — VSN240-F | 7.5 | - | 2014-09-05 |
CWE-494（下载代码缺少完整性检查） 是常见的弱点类别，本平台收录该类弱点关联的 138 条 CVE 漏洞。