40 matches found
CLEANSTART-2024-IT92973 local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file on a malicious SMB server
Security vulnerability affects the firefox-esr package. A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file on a malicious SMB server...
CVE-2026-8888-Printer-Firmware-Unsigned-Update-via-HTTP
CVE-2026-8888 – Printer Firmware Unsigned Update via HTTP Program Code Python HTTP server + printer emulator !/usr/bin/env python3 printerfirmwareserver.py - Simulated printer that fetches updates over HTTP import requests, hashlib, os FIRMWAREURL = "http://updates.printer.local/firmware.bin"...
CVE-2026-108160 AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed
AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and...
CVE-2026-77974
Softish C6 Ear Camera and its EarVision Android Application contain a vulnerability where a critical function lacks proper authentication. After spoofing the device and obtaining a single user confirmation, an attacker in the adjacent network can cause the application to transmit firmware through...
EUVD-2026-75056
After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through an unauthenticated and unsigned update channel...
PT-2026-89069
After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through an unauthenticated and unsigned update channel...
TrueConf Windows Client < 8.5.3.884 Download of Code Without Integrity Check Vulnerability (CVE-2026-3502)
The version of TrueConf Windows Client installed on the remote host is prior to 8.5.3.884. It is, therefore, affected by a vulnerability: â A remote code execution vulnerability exists in the TrueConf Client update mechanism due to lack of cryptographic verification of update packages. An...
CVE-2026-42248 Missing Signature Verification for Updates in Ollama
Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables. Unlike other platforms, the Windows implementation of the update verification routine unconditionally returns success so no digital signature or trust validation is performed before stagin...
CVE-2025-34324
GoSign Desktop versions 2.4.0 and earlier use an unsigned update manifest for distributing application updates. The manifest contains package URLs and SHA-256 hashes but is not digitally signed, so its authenticity relies solely on the underlying TLS channel. In affected versions, TLS certificate...
CVE-2025-34324
GoSign Desktop versions 2.4.0 and earlier use an unsigned update manifest for distributing application updates. The manifest contains package URLs and SHA-256 hashes but is not digitally signed, so its authenticity relies solely on the underlying TLS channel. In affected versions, TLS certificate...
CVE-2025-34324
GoSign Desktop versions 2.4.0 and earlier use an unsigned update manifest for distributing application updates. The manifest contains package URLs and SHA-256 hashes but is not digitally signed, so its authenticity relies solely on the underlying TLS channel. In affected versions, TLS certificate...
EUVD-2025-198033
GoSign Desktop versions 2.4.0 and earlier use an unsigned update manifest for distributing application updates. The manifest contains package URLs and SHA-256 hashes but is not digitally signed, so its authenticity relies solely on the underlying TLS channel. In affected versions, TLS certificate...
CVE-2025-34324 GoSign Desktop < 2.4.1 Insecure Update Mechanism RCE
GoSign Desktop versions 2.4.0 and earlier use an unsigned update manifest for distributing application updates. The manifest contains package URLs and SHA-256 hashes but is not digitally signed, so its authenticity relies solely on the underlying TLS channel. In affected versions, TLS certificate...
CVE-2025-34324 GoSign Desktop < 2.4.1 Insecure Update Mechanism RCE
GoSign Desktop versions 2.4.0 and earlier use an unsigned update manifest for distributing application updates. The manifest contains package URLs and SHA-256 hashes but is not digitally signed, so its authenticity relies solely on the underlying TLS channel. In affected versions, TLS certificate...
CVE-2025-34324
GoSign Desktop
CVE-2025-34324: Improper Verification of Cryptographic Signature
GoSign Desktop versions 2.4.0 and earlier use an unsigned update manifest for distributing application updates. The manifest contains package URLs and SHA-256 hashes but is not digitally signed, so its authenticity relies solely on the underlying TLS channel. In affected versions, TLS certificate...
GoSign Desktop security vulnerability
GoSign Desktop is an electronic document signing software from GoSign Lithuania. A security vulnerability exists in GoSign Desktop version 2.4.0 and prior versions, which stems from the fact that the update manifest is unsigned and TLS certificate validation can be disabled, which could lead to...
EUVD-2022-27958
Malicious code in bioql PyPI...
EUVD-2023-33074
Malicious code in bioql PyPI...
NiceHash QuickMiner security vulnerability
NiceHash QuickMiner is a cryptocurrency miner software open source by NiceHash.com. A security vulnerability exists in NiceHash QuickMiner version 6.12.0 that originates from executing a software update over HTTP without verifying digital signatures or hash checking, which could lead to remote co...