VYPR

CWE-353

Missing Support for Integrity Check

BaseDraftLikelihood: Medium

Description

The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.

If integrity check values or "checksums" are omitted from a protocol, there is no way of determining if data has been corrupted in transmission. The lack of checksum functionality in a protocol removes the first application-level check of data that can be used. The end-to-end philosophy of checks states that integrity checks should be performed at the lowest level that they can be completely implemented. Excluding further sanity checks and input validation performed by applications, the protocol's checksum is the most important level of checksum, since it can be performed more completely than at any previous level and takes into account entire messages, as opposed to single packets.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-13 · CAPEC-14 · CAPEC-389 · CAPEC-39 · CAPEC-665 · CAPEC-74 · CAPEC-75

CVEs mapped to this weakness (44)

page 2 of 3
  • CVE-2025-48803MedJul 8, 2025
    risk 0.44cvss 6.7epss 0.00

    Missing support for integrity check in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

  • CVE-2023-28865MedAug 8, 2024
    risk 0.43cvss 6.6epss 0.00

    Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR15, 4.0.0 SR05, 4.1.0 SR03, and 4.2.0 SR02 fails to validate the directory contents of certain directories (e.g., ensuring the expected hash sum) during the Pre-Boot Authorization (PBA) process. This can be exploited by…

  • CVE-2026-18536HigAug 1, 2026
    risk 0.42cvss 7.5epss 0.00

    Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::Entropy::RawSource::RandomOrg integrity…

  • CVE-2026-12705MedJul 17, 2026
    risk 0.42cvss 6.4epss 0.00

    Missing support for integrity check vulnerability in ABB KNX Update Tool (ABB), ABB KNX Update Tool (BJE). This issue affects KNX Update Tool (ABB): through 2.0.175; KNX Update Tool (BJE): through 2.0.175.

  • CVE-2026-48995HigJun 25, 2026
    risk 0.42cvss 7.5epss 0.00

    pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a malicious codeload.github.com server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile. The lockfile does not store the hash of the dependencies from https://codeload.github.com. This…

  • CVE-2021-38396MedOct 4, 2021
    risk 0.42cvss 6.5epss 0.00

    The programmer installation utility does not perform a cryptographic authenticity or integrity checks of the software on the flash drive. An attacker could leverage this weakness to install unauthorized software using a specially crafted USB.

  • CVE-2021-28546MedApr 1, 2021
    risk 0.42cvss 6.5epss 0.01

    Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are missing support for an integrity check. An unauthenticated attacker could leverage this vulnerability to modify content in a certified PDF without…

  • CVE-2025-15364HigJan 6, 2026
    risk 0.40cvss 7.3epss 0.00

    The Download Manager plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.40. This is due to the plugin not properly validating a user's identity prior to updating their details like password. This makes it…

  • CVE-2026-42428HigApr 28, 2026
    risk 0.39cvss 7.1epss 0.00

    OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. Attackers can install malicious or tampered plugin packages without detection, compromising the local assistant environment.

  • CVE-2026-33261MedApr 22, 2026
    risk 0.38cvss 5.9epss 0.00

    A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.

  • CVE-2022-24404MedOct 19, 2023
    risk 0.38cvss 5.9epss 0.00

    Lack of cryptographic integrity check on TETRA air-interface encrypted traffic. Since a stream cipher is employed, this allows an active adversary to manipulate cleartext data in a bit-by-bit fashion.

  • CVE-2022-2793MedAug 19, 2022
    risk 0.38cvss 5.9epss 0.00

    Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-353 Missing Support for Integrity Check, and has no authentication or authorization of data packets after establishing a connection for the SRTP protocol.

  • CVE-2019-19160MedJun 29, 2020
    risk 0.37cvss 5.7epss 0.01

    Reportexpress ProPlus contains a vulnerability that could allow an arbitrary code execution by inserted VBscript into the configure file(rxp).

  • CVE-2020-7807MedSep 14, 2020
    risk 0.36cvss 5.6epss 0.00

    A vulnerability that can hijack a DLL file that is loaded during products(LGPCSuite_Setup, IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup) installation into a DLL file that the hacker wants. Missing Support for Integrity Check vulnerability in ____COMPONENT____ of LG Electronics…

  • CVE-2019-12804MedJul 10, 2019
    risk 0.36cvss 5.5epss 0.00

    In Hunesion i-oneNet version 3.0.7 ~ 3.0.53 and 4.0.4 ~ 4.0.16, due to the lack of update file integrity checking in the upgrade process, an attacker can craft malicious file and use it as an update.

  • CVE-2026-3856MedMar 17, 2026
    risk 0.34cvss 5.3epss 0.00

    IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 could allow an attacker to modify or corrupt data due to an insecure mechanism used for verifying the integrity of the data during transmission.

  • CVE-2025-32890MedMay 1, 2025
    risk 0.34cvss 5.3epss 0.00

    An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. It uses a custom implementation of encryption without any additional integrity checking mechanisms. This leaves messages malleable to an attacker that can access the message.

  • CVE-2025-32882MedMay 1, 2025
    risk 0.34cvss 5.3epss 0.00

    An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. The app uses a custom implementation of encryption without any additional integrity checking mechanisms. This leaves messages malleable to an attacker that can access the message.

  • CVE-2024-47123MedSep 26, 2024
    risk 0.34cvss 5.3epss 0.00

    The goTenna Pro App uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. This leaves messages malleable to an attacker that can access the message. It is recommended to continue to use encryption in the app and…

  • CVE-2024-43108MedSep 26, 2024
    risk 0.34cvss 5.3epss 0.00

    The goTenna Pro ATAK Plugin uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. This leaves messages malleable to an attacker that can access the message. It is advised to continue to use encryption in the plugin…