CWE-924
AllowedImproper Enforcement of Message Integrity During Transmission in a Communication Channel
Abstraction: Base · Status: Incomplete
The product establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that the message was not modified during transmission.
56 vulnerabilities reference this CWE, most recent first.
GHSA-788J-V5XM-H2MQ
Vulnerability from github – Published: 2023-05-25 09:30 – Updated: 2024-04-04 04:20Channel Accessible by Non-Endpoint vulnerability in CBOT Chatbot allows Adversary in the Middle (AiTM).This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.
{
"affected": [],
"aliases": [
"CVE-2023-2885"
],
"database_specific": {
"cwe_ids": [
"CWE-300",
"CWE-924"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-25T09:15:12Z",
"severity": "HIGH"
},
"details": "Channel Accessible by Non-Endpoint vulnerability in CBOT Chatbot allows Adversary in the Middle (AiTM).This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.\n\n",
"id": "GHSA-788j-v5xm-h2mq",
"modified": "2024-04-04T04:20:20Z",
"published": "2023-05-25T09:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2885"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-23-0293"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-7GF3-3V44-PWM2
Vulnerability from github – Published: 2022-05-24 16:58 – Updated: 2024-04-04 02:12An issue was discovered in the RENPHO application 3.0.0 for iOS. It transmits JSON data unencrypted to a server without an integrity check, if a user changes personal data in his profile tab (e.g., exposure of his birthday) or logs into his account (i.e., exposure of credentials).
{
"affected": [],
"aliases": [
"CVE-2019-14808"
],
"database_specific": {
"cwe_ids": [
"CWE-319",
"CWE-924"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-09T16:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in the RENPHO application 3.0.0 for iOS. It transmits JSON data unencrypted to a server without an integrity check, if a user changes personal data in his profile tab (e.g., exposure of his birthday) or logs into his account (i.e., exposure of credentials).",
"id": "GHSA-7gf3-3v44-pwm2",
"modified": "2024-04-04T02:12:28Z",
"published": "2022-05-24T16:58:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14808"
},
{
"type": "WEB",
"url": "https://apps.apple.com/us/app/renpho/id1219889310"
},
{
"type": "WEB",
"url": "https://renpho.com/pages/contact-us"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/154772/RENPHO-3.0.0-Information-Disclosure.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-82XM-JWXQ-4436
Vulnerability from github – Published: 2025-07-25 18:30 – Updated: 2026-02-25 18:31An issue in Gardyn 4 allows a remote attacker to obtain sensitive information and execute arbitrary code via a request
{
"affected": [],
"aliases": [
"CVE-2025-29628"
],
"database_specific": {
"cwe_ids": [
"CWE-77",
"CWE-924"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-25T17:15:31Z",
"severity": "HIGH"
},
"details": "An issue in Gardyn 4 allows a remote attacker to obtain sensitive information and execute arbitrary code via a request",
"id": "GHSA-82xm-jwxq-4436",
"modified": "2026-02-25T18:31:27Z",
"published": "2025-07-25T18:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29628"
},
{
"type": "WEB",
"url": "https://github.com/mselbrede/gardyn/blob/main/CVE-2025-29628_CVE-2025-29631.md"
},
{
"type": "WEB",
"url": "https://mygardyn.com/blog/security-update"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-03"
},
{
"type": "WEB",
"url": "http://gardyn.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9XM2-C28X-G93R
Vulnerability from github – Published: 2023-10-31 12:30 – Updated: 2023-11-08 18:30LINE for Android version 5.0.2 and earlier and LINE for iOS version 5.0.0 and earlier are vulnerable to MITM (man-in-the-middle) attack since the application allows non-SSL/TLS communications. As a result, any API may be invoked from a script injected by a MITM (man-in-the-middle) attacker.
{
"affected": [],
"aliases": [
"CVE-2015-0897"
],
"database_specific": {
"cwe_ids": [
"CWE-924"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-31T10:15:08Z",
"severity": "MODERATE"
},
"details": "LINE for Android version 5.0.2 and earlier and LINE for iOS version 5.0.0 and earlier are vulnerable to MITM (man-in-the-middle) attack since the application allows non-SSL/TLS communications. As a result, any API may be invoked from a script injected by a MITM (man-in-the-middle) attacker.",
"id": "GHSA-9xm2-c28x-g93r",
"modified": "2023-11-08T18:30:30Z",
"published": "2023-10-31T12:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0897"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN41281927"
},
{
"type": "WEB",
"url": "http://official-blog.line.me/ja/archives/24809761.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-C2JH-QJFQ-M6H4
Vulnerability from github – Published: 2024-07-23 18:31 – Updated: 2024-07-23 18:31An attacker could exploit the vulnerability by injecting garbage data or specially crafted data. Depending on the data injected each process might be affected differently. The process could crash or cause communication issues on the affected node, effectively causing a denial-of-service attack. The attacker could tamper with the data transmitted, causing the product to store wrong information or act on wrong data or display wrong information.
This issue affects Advant MOD 300 AdvaBuild: from 3.0 through 3.7 SP2.
For an attack to be successful, the attacker must have local access to a node in the system and be able to start a specially crafted application that disrupts the communication. An attacker who successfully exploited the vulnerability would be able to manipulate the data in such way as allowing reads and writes to the controllers or cause Windows processes in 800xA for MOD 300 and AdvaBuild to crash.
{
"affected": [],
"aliases": [
"CVE-2020-11639"
],
"database_specific": {
"cwe_ids": [
"CWE-924"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-23T18:15:04Z",
"severity": "HIGH"
},
"details": "An attacker could exploit the vulnerability by\ninjecting garbage data or specially crafted data. Depending on the data injected each process might be\naffected differently. The process could crash or cause communication issues on the affected node, effectively causing a denial-of-service attack. The attacker could tamper with the data transmitted, causing\nthe product to store wrong information or act on wrong data or display wrong information.\n\n\nThis issue affects Advant MOD 300 AdvaBuild: from 3.0 through 3.7 SP2.\n\n\n\n\nFor an attack to be successful, the attacker must have local access to a node in the system and be able to\nstart a specially crafted application that disrupts the communication.\nAn attacker who successfully exploited the vulnerability would be able to manipulate the data in such\nway as allowing reads and writes to the controllers or cause Windows processes in 800xA for MOD 300\nand AdvaBuild to crash.",
"id": "GHSA-c2jh-qjfq-m6h4",
"modified": "2024-07-23T18:31:07Z",
"published": "2024-07-23T18:31:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11639"
},
{
"type": "WEB",
"url": "https://search.abb.com/library/Download.aspx?DocumentID=3BUA003421\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch\u0026_ga=2.200044199.882581162.1721753430-284724496.1718609177"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-C9WC-P58W-QCGF
Vulnerability from github – Published: 2022-12-16 21:30 – Updated: 2022-12-22 21:30Rockwell Automation was made aware that the webservers of the Micrologix 1100 and 1400 controllers contain a vulnerability that may lead to a denial-of-service condition. The security vulnerability could be exploited by an attacker with network access to the affected systems by sending TCP packets to webserver and closing it abruptly which would cause a denial-of-service condition for the web server application on the device
{
"affected": [],
"aliases": [
"CVE-2022-3166"
],
"database_specific": {
"cwe_ids": [
"CWE-924"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-16T20:15:00Z",
"severity": "HIGH"
},
"details": "Rockwell Automation was made aware that the webservers of the Micrologix 1100 and 1400 controllers contain a vulnerability that may lead to a denial-of-service condition. The security vulnerability could be exploited by an attacker with network access to the affected systems by sending TCP packets to webserver and closing it abruptly which would cause a denial-of-service condition for the web server application on the device",
"id": "GHSA-c9wc-p58w-qcgf",
"modified": "2022-12-22T21:30:31Z",
"published": "2022-12-16T21:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3166"
},
{
"type": "WEB",
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137678"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CJJM-2HW2-C3JX
Vulnerability from github – Published: 2022-05-24 22:01 – Updated: 2022-05-24 22:01The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint. As a consequence the builds of such stacks are vulnerable to MITM attacks that allow the replacement of the original binaries with arbitrary ones. The stacks involved are Java 8 (alpine and centos), Android and PHP. The vulnerability is not exploitable at runtime but only when building Che.
{
"affected": [],
"aliases": [
"CVE-2021-41034"
],
"database_specific": {
"cwe_ids": [
"CWE-924"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-29T22:15:00Z",
"severity": "MODERATE"
},
"details": "The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint. As a consequence the builds of such stacks are vulnerable to MITM attacks that allow the replacement of the original binaries with arbitrary ones. The stacks involved are Java 8 (alpine and centos), Android and PHP. The vulnerability is not exploitable at runtime but only when building Che.",
"id": "GHSA-cjjm-2hw2-c3jx",
"modified": "2022-05-24T22:01:48Z",
"published": "2022-05-24T22:01:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41034"
},
{
"type": "WEB",
"url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=540989"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-GFPV-WRHP-WWH6
Vulnerability from github – Published: 2026-08-13 15:34 – Updated: 2026-08-13 15:34Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.5 and 17.11 are affected. Versions before PostgreSQL 17 are unaffected.
{
"affected": [],
"aliases": [
"CVE-2026-14681"
],
"database_specific": {
"cwe_ids": [
"CWE-924"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-13T13:17:45Z",
"severity": "MODERATE"
},
"details": "Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.5 and 17.11 are affected. Versions before PostgreSQL 17 are unaffected.",
"id": "GHSA-gfpv-wrhp-wwh6",
"modified": "2026-08-13T15:34:36Z",
"published": "2026-08-13T15:34:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14681"
},
{
"type": "WEB",
"url": "https://www.postgresql.org/support/security/CVE-2026-14681"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GJ56-GXXR-68V5
Vulnerability from github – Published: 2022-05-13 01:53 – Updated: 2022-05-13 01:53ffxivlauncher.exe in Square Enix Final Fantasy XIV 4.21 and 4.25 on Windows is affected by Improper Enforcement of Message Integrity During Transmission in a Communication Channel, allowing a man-in-the-middle attacker to steal user credentials because a session retrieves global.js via http before proceeding to use https. This is fixed in Patch 4.3.
{
"affected": [],
"aliases": [
"CVE-2018-7295"
],
"database_specific": {
"cwe_ids": [
"CWE-924"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-05-23T12:29:00Z",
"severity": "HIGH"
},
"details": "ffxivlauncher.exe in Square Enix Final Fantasy XIV 4.21 and 4.25 on Windows is affected by Improper Enforcement of Message Integrity During Transmission in a Communication Channel, allowing a man-in-the-middle attacker to steal user credentials because a session retrieves global.js via http before proceeding to use https. This is fixed in Patch 4.3.",
"id": "GHSA-gj56-gxxr-68v5",
"modified": "2022-05-13T01:53:18Z",
"published": "2022-05-13T01:53:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7295"
},
{
"type": "WEB",
"url": "https://raw.githubusercontent.com/WizardShotTheFood/advisories/master/CVE-2018-7295.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GR6W-7257-4Q7X
Vulnerability from github – Published: 2023-10-02 21:30 – Updated: 2024-04-04 08:01An issue in animal-art-lab v13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.
{
"affected": [],
"aliases": [
"CVE-2023-43297"
],
"database_specific": {
"cwe_ids": [
"CWE-924"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-02T21:15:34Z",
"severity": "MODERATE"
},
"details": "An issue in animal-art-lab v13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.",
"id": "GHSA-gr6w-7257-4q7x",
"modified": "2024-04-04T08:01:11Z",
"published": "2023-10-02T21:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43297"
},
{
"type": "WEB",
"url": "https://github.com/syz913/CVE-reports/blob/main/CVE-2023-43297.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.