CWE-924
AllowedImproper Enforcement of Message Integrity During Transmission in a Communication Channel
Abstraction: Base · Status: Incomplete
The product establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that the message was not modified during transmission.
56 vulnerabilities reference this CWE, most recent first.
GHSA-H8Q7-RP5J-9P6F
Vulnerability from github – Published: 2023-08-03 03:30 – Updated: 2024-04-04 06:30Bluetens Electrostimulation Device BluetensQ device app version 4.3.15 is vulnerable to Man-in-the-middle attacks in the BLE channel. It allows attackers to decrease or increase the intensity of the stimulator by hijacking the BLE communication.
{
"affected": [],
"aliases": [
"CVE-2023-26979"
],
"database_specific": {
"cwe_ids": [
"CWE-924"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-03T02:15:09Z",
"severity": "LOW"
},
"details": "Bluetens Electrostimulation Device BluetensQ device app version 4.3.15 is vulnerable to Man-in-the-middle attacks in the BLE channel. It allows attackers to decrease or increase the intensity of the stimulator by hijacking the BLE communication.",
"id": "GHSA-h8q7-rp5j-9p6f",
"modified": "2024-04-04T06:30:16Z",
"published": "2023-08-03T03:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26979"
},
{
"type": "WEB",
"url": "https://www.secura.com/blog/serious-safety-impact-found-in-bluetooth-low-energy-based-medical-devices"
},
{
"type": "WEB",
"url": "http://bluetens.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HFFH-JRV7-CQXQ
Vulnerability from github – Published: 2023-07-06 21:14 – Updated: 2024-04-04 05:39In the pre connection stage, an improper enforcement of message integrity vulnerability exists in BIG-IP Edge Client for Windows and Mac OS. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
{
"affected": [],
"aliases": [
"CVE-2023-22372"
],
"database_specific": {
"cwe_ids": [
"CWE-924"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-03T15:15:11Z",
"severity": "MODERATE"
},
"details": "\nIn the pre connection stage, an improper enforcement of message integrity vulnerability exists in BIG-IP Edge Client for Windows and Mac OS.\u00a0 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
"id": "GHSA-hffh-jrv7-cqxq",
"modified": "2024-04-04T05:39:01Z",
"published": "2023-07-06T21:14:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22372"
},
{
"type": "WEB",
"url": "https://my.f5.com/manage/s/article/K000132522"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HGJX-J8HG-PXRF
Vulnerability from github – Published: 2023-12-14 06:30 – Updated: 2025-11-04 21:30An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. There is Improper Enforcement of Message Integrity During Transmission in a Communication Channel. This allows attackers to modify RPC traffic in a way that bypasses message hash checks. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.
{
"affected": [],
"aliases": [
"CVE-2023-49933"
],
"database_specific": {
"cwe_ids": [
"CWE-924"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-14T05:15:08Z",
"severity": "HIGH"
},
"details": "An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. There is Improper Enforcement of Message Integrity During Transmission in a Communication Channel. This allows attackers to modify RPC traffic in a way that bypasses message hash checks. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.",
"id": "GHSA-hgjx-j8hg-pxrf",
"modified": "2025-11-04T21:30:52Z",
"published": "2023-12-14T06:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49933"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYQS3LFGC4HE4WCW4L3NAA2I6FRIWMNO"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ"
},
{
"type": "WEB",
"url": "https://lists.schedmd.com/pipermail/slurm-announce/2023/000103.html"
},
{
"type": "WEB",
"url": "https://www.schedmd.com/security-archive.php"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HXQP-HF33-PX7G
Vulnerability from github – Published: 2026-06-02 15:32 – Updated: 2026-06-03 18:33Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors running software versions VG4.1.1, VG4.0.3, and lower contain network message handling vulnerabilities that allow network-adjacent attackers to spoof or tamper with data and cause denial-of-service conditions. Attackers with access to an enabled Infinity network port or physical proximity to a wireless access point can modify device settings such as alarm states or alarm limits, and overwhelm the system with incoming data causing the device to reboot and lose network functionality.
{
"affected": [],
"aliases": [
"CVE-2019-25719"
],
"database_specific": {
"cwe_ids": [
"CWE-924"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-02T14:16:25Z",
"severity": "HIGH"
},
"details": "Dr\u00e4ger Infinity Acute Care System and Standalone Infinity M540 patient monitors running software versions VG4.1.1, VG4.0.3, and lower contain network message handling vulnerabilities that allow network-adjacent attackers to spoof or tamper with data and cause denial-of-service conditions. Attackers with access to an enabled Infinity network port or physical proximity to a wireless access point can modify device settings such as alarm states or alarm limits, and overwhelm the system with incoming data causing the device to reboot and lose network functionality.",
"id": "GHSA-hxqp-hf33-px7g",
"modified": "2026-06-03T18:33:08Z",
"published": "2026-06-02T15:32:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25719"
},
{
"type": "WEB",
"url": "https://static.draeger.com/security"
},
{
"type": "WEB",
"url": "https://static.draeger.com/security/download/PSA-19-255-02_Product-Security-Advisory-IACS-VG4.1.pdf"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/dr-ger-infinity-m540-vg4-spoofing-and-dos-via-network-message-handling"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-JJPM-MXJP-G6MW
Vulnerability from github – Published: 2022-05-24 19:18 – Updated: 2023-08-16 18:30A vulnerability in the TCP Normalizer of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software operating in transparent mode could allow an unauthenticated, remote attacker to poison MAC address tables, resulting in a denial of service (DoS) vulnerability. This vulnerability is due to incorrect handling of certain TCP segments when the affected device is operating in transparent mode. An attacker could exploit this vulnerability by sending a crafted TCP segment through an affected device. A successful exploit could allow the attacker to poison the MAC address tables in adjacent devices, resulting in network disruption.
{
"affected": [],
"aliases": [
"CVE-2021-34793"
],
"database_specific": {
"cwe_ids": [
"CWE-924"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-27T19:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability in the TCP Normalizer of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software operating in transparent mode could allow an unauthenticated, remote attacker to poison MAC address tables, resulting in a denial of service (DoS) vulnerability. This vulnerability is due to incorrect handling of certain TCP segments when the affected device is operating in transparent mode. An attacker could exploit this vulnerability by sending a crafted TCP segment through an affected device. A successful exploit could allow the attacker to poison the MAC address tables in adjacent devices, resulting in network disruption.",
"id": "GHSA-jjpm-mxjp-g6mw",
"modified": "2023-08-16T18:30:20Z",
"published": "2022-05-24T19:18:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34793"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-dos-JxYWMJyL"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M82C-5HPW-48F7
Vulnerability from github – Published: 2023-07-20 18:33 – Updated: 2024-04-04 06:17A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-the-middle attack, by intercepting the network traffic and modifying the SMB2 messages between client and server, affecting the integrity of the data.
{
"affected": [],
"aliases": [
"CVE-2023-3347"
],
"database_specific": {
"cwe_ids": [
"CWE-347",
"CWE-924"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-20T15:15:11Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in Samba\u0027s SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured \"server signing = required\" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-the-middle attack, by intercepting the network traffic and modifying the SMB2 messages between client and server, affecting the integrity of the data.",
"id": "GHSA-m82c-5hpw-48f7",
"modified": "2024-04-04T06:17:50Z",
"published": "2023-07-20T18:33:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3347"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:4325"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:4328"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-3347"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2222792"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BPCSGND7LO467AJGR5DYBGZLTCGTOBCC"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OT74M42E6C36W7PQVY3OS4ZM7DVYB64Z"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20230731-0010"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5477"
},
{
"type": "WEB",
"url": "https://www.samba.org/samba/security/CVE-2023-3347.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MPX7-3W53-G6R5
Vulnerability from github – Published: 2024-02-14 18:30 – Updated: 2024-02-14 18:30CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause a denial of service and loss of confidentiality, integrity of controllers when conducting a Man in the Middle attack.
{
"affected": [],
"aliases": [
"CVE-2023-6408"
],
"database_specific": {
"cwe_ids": [
"CWE-924"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-14T17:15:11Z",
"severity": "HIGH"
},
"details": "\nCWE-924: Improper Enforcement of Message Integrity During Transmission in a\nCommunication Channel vulnerability exists that could cause a denial of service and loss of\nconfidentiality, integrity of controllers when conducting a Man in the Middle attack.\n\n",
"id": "GHSA-mpx7-3w53-g6r5",
"modified": "2024-02-14T18:30:25Z",
"published": "2024-02-14T18:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6408"
},
{
"type": "WEB",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-044-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-044-01.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-P89P-GPRQ-FRV8
Vulnerability from github – Published: 2022-05-13 01:49 – Updated: 2022-05-13 01:49An issue was discovered in rsn_supp/wpa.c in wpa_supplicant 2.0 through 2.6. Under certain conditions, the integrity of EAPOL-Key messages is not checked, leading to a decryption oracle. An attacker within range of the Access Point and client can abuse the vulnerability to recover sensitive information.
{
"affected": [],
"aliases": [
"CVE-2018-14526"
],
"database_specific": {
"cwe_ids": [
"CWE-924"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-08-08T19:29:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in rsn_supp/wpa.c in wpa_supplicant 2.0 through 2.6. Under certain conditions, the integrity of EAPOL-Key messages is not checked, leading to a decryption oracle. An attacker within range of the Access Point and client can abuse the vulnerability to recover sensitive information.",
"id": "GHSA-p89p-gprq-frv8",
"modified": "2022-05-13T01:49:58Z",
"published": "2022-05-13T01:49:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14526"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:3107"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-344983.pdf"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00009.html"
},
{
"type": "WEB",
"url": "https://papers.mathyvanhoef.com/woot2018.pdf"
},
{
"type": "WEB",
"url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-18:11.hostapd.asc"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3745-1"
},
{
"type": "WEB",
"url": "https://w1.fi/security/2018-1/unauthenticated-eapol-key-decryption.txt"
},
{
"type": "WEB",
"url": "https://www.us-cert.gov/ics/advisories/icsa-19-344-01"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00013.html"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1041438"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PX5G-45FF-HQQC
Vulnerability from github – Published: 2024-10-11 18:32 – Updated: 2024-10-16 21:31Incorrect access control in the function handleDataChannelChat(dataMessage) of Mirotalk before commit c21d58 allows attackers to forge chat messages using an arbitrary sender name.
{
"affected": [],
"aliases": [
"CVE-2024-44730"
],
"database_specific": {
"cwe_ids": [
"CWE-924"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-11T16:15:08Z",
"severity": "CRITICAL"
},
"details": "Incorrect access control in the function handleDataChannelChat(dataMessage) of Mirotalk before commit c21d58 allows attackers to forge chat messages using an arbitrary sender name.",
"id": "GHSA-px5g-45ff-hqqc",
"modified": "2024-10-16T21:31:07Z",
"published": "2024-10-11T18:32:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44730"
},
{
"type": "WEB",
"url": "https://aware7.com/de/blog/schwachstellen-in-videokonferenzsystemen"
},
{
"type": "WEB",
"url": "https://github.com/miroslavpejic85"
},
{
"type": "WEB",
"url": "https://github.com/miroslavpejic85/mirotalk"
},
{
"type": "WEB",
"url": "https://github.com/miroslavpejic85/mirotalksfu/blob/main/SECURITY.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QPW4-5X99-6VJP
Vulnerability from github – Published: 2026-06-25 22:15 – Updated: 2026-07-07 15:24An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "golang.org/x/crypto"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.52.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-39827"
],
"database_specific": {
"cwe_ids": [
"CWE-924"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-25T22:15:43Z",
"nvd_published_at": "2026-05-22T04:16:21Z",
"severity": "MODERATE"
},
"details": "An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection\u0027s internal state and released for garbage collection.",
"id": "GHSA-qpw4-5x99-6vjp",
"modified": "2026-07-07T15:24:35Z",
"published": "2026-06-25T22:15:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39827"
},
{
"type": "PACKAGE",
"url": "https://cs.opensource.google/go/x/crypto"
},
{
"type": "WEB",
"url": "https://go.dev/cl/781320"
},
{
"type": "WEB",
"url": "https://go.dev/issue/35127"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2026-5016"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS"
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.