VYPR

CWE-353

Missing Support for Integrity Check

BaseDraftLikelihood: Medium

Description

The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.

If integrity check values or "checksums" are omitted from a protocol, there is no way of determining if data has been corrupted in transmission. The lack of checksum functionality in a protocol removes the first application-level check of data that can be used. The end-to-end philosophy of checks states that integrity checks should be performed at the lowest level that they can be completely implemented. Excluding further sanity checks and input validation performed by applications, the protocol's checksum is the most important level of checksum, since it can be performed more completely than at any previous level and takes into account entire messages, as opposed to single packets.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-13 · CAPEC-14 · CAPEC-389 · CAPEC-39 · CAPEC-665 · CAPEC-74 · CAPEC-75

CVEs mapped to this weakness (7)

  • CVE-2026-45787CriMay 28, 2026
    risk 0.52cvss 9.1epss 0.00

    electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.9.5, deterministic AES-192-CBC with a fixed zero IV, constant KDF salt, and no MAC leads to confidentiality and integrity failures for synced bookmark/profile data. Attackers can…

  • CVE-2024-27817HigJun 10, 2024
    risk 0.51cvss 7.8epss 0.00

    The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, visionOS 1.2. An app may be able to execute arbitrary code with kernel…

  • CVE-2025-15364HigJan 6, 2026
    risk 0.40cvss 7.3epss 0.00

    The Download Manager plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.40. This is due to the plugin not properly validating a user's identity prior to updating their details like password. This makes it…

  • CVE-2026-42428HigApr 28, 2026
    risk 0.39cvss 7.1epss 0.00

    OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. Attackers can install malicious or tampered plugin packages without detection, compromising the local assistant environment.

  • CVE-2026-33261MedApr 22, 2026
    risk 0.38cvss 5.9epss 0.00

    A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.

  • CVE-2026-31839Mar 11, 2026
    risk 0.00cvss epss 0.00

    Striae is a firearms examiner's comparison companion. A high-severity integrity bypass vulnerability existed in Striae's digital confirmation workflow prior to v3.0.0. Hash-only validation trusted manifest hash fields that could be modified together with package content,…

  • CVE-2023-29290Jun 15, 2023
    risk 0.00cvss epss 0.01

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to bypass a minor functionality.…