CWE-310 · Cryptographic Issues (page 3)
Page 3 of 26 — CVEs classified under CWE-310, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-10580 | High | 8.1 | 2018-06-01 | nodewebkit is an installer for node-webkit. nodewebkit downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to… |
CVE-2016-10579 | High | 8.1 | 2018-06-01 | Chromedriver is an NPM wrapper for selenium ChromeDriver. Chromedriver before 2.26.1 downloads binary resources over HTTP, which leaves it vulnerable to MITM a… |
CVE-2016-10576 | High | 8.1 | 2018-06-01 | Fuseki server wrapper and management API in fuseki before 1.0.1 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be pos… |
CVE-2016-10575 | High | 8.1 | 2018-06-01 | Kindlegen is a simple Node.js wrapper of the official kindlegen program. Kindlegen versions before 1.1.0 download binary resources over HTTP, which leaves it v… |
CVE-2016-10574 | High | 8.1 | 2018-06-01 | apk-parser3 is a module to extract Android Manifest info from an APK file. apk-parser3 versions before 0.1.3 download binary resources over HTTP, which leaves… |
CVE-2016-10572 | High | 8.1 | 2018-05-31 | mongodb-instance before 0.0.3 installs mongodb locally. mongodb-instance downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It m… |
CVE-2016-10571 | High | 8.1 | 2018-05-31 | bkjs-wand is imagemagick wand support for node.js and backendjs bkjs-wand versions lower than 0.3.2 download binary resources over HTTP, which leaves it vulner… |
CVE-2016-10569 | High | 8.1 | 2018-05-31 | embedza is a module to create HTML snippets/embeds from URLs using info from oEmbed, Open Graph, meta tags. embedza versions below 1.2.4 download JavaScript re… |
CVE-2016-10565 | High | 8.1 | 2018-05-31 | operadriver is a Opera Driver for Selenium. operadriver versions below 0.2.3 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. I… |
CVE-2016-10564 | High | 8.1 | 2018-05-31 | apk-parser is a tool to extract Android Manifest info from an APK file. apk-parser versions below 0.1.6 download binary resources over HTTP, which leaves it vu… |
CVE-2016-10563 | High | 8.1 | 2018-05-31 | During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP. This allows for a MITM attack to compromise the… |
CVE-2016-10562 | High | 8.1 | 2018-05-31 | iedriver is an NPM wrapper for Selenium IEDriver. iedriver versions below 3.0.0 download binary resources over HTTP, which leaves the module vulnerable to MITM… |
CVE-2016-10560 | High | 8.1 | 2018-05-31 | galenframework-cli is the node wrapper for the Galen Framework. galenframework-cli below 2.3.1 download binary resources over HTTP, which leaves it vulnerable… |
CVE-2016-10557 | High | 8.1 | 2018-05-31 | appium-chromedriver is a Node.js wrapper around Chromedriver. Versions below 2.9.4 download binary resources over HTTP, which leaves the module vulnerable to M… |
CVE-2016-10555 | Medium | 6.5 | 2018-05-31 | Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If th… |
CVE-2016-10535 | Medium | 5.9 | 2018-05-31 | csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses `===`, a fail first string comparison, instead of a… |
CVE-2016-10530 | Medium | 5.9 | 2018-05-31 | The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. Environment variables can often times contain secret keys and other… |
CVE-2016-10698 | High | 8.1 | 2018-05-29 | mystem-fix is a node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem-fix downloads binary resources over HTTP, which leaves it vulnerable to… |
CVE-2016-10682 | High | 8.1 | 2018-05-29 | massif is a Phantomjs fork massif downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution… |
CVE-2016-10681 | High | 8.1 | 2018-05-29 | roslib-socketio - The standard ROS Javascript Library fork for add support to socket.io roslib-socketio downloads binary resources over HTTP, which leaves it v… |
CVE-2016-10680 | High | 8.1 | 2018-05-29 | adamvr-geoip-lite is a light weight native JavaScript implementation of GeoIP API from MaxMind adamvr-geoip-lite downloads geoip resources over HTTP, which lea… |
CVE-2016-10679 | High | 8.1 | 2018-05-29 | selenium-standalone-painful installs a start-selenium command line to start a standalone selenium server with chrome-driver. selenium-standalone-painful downlo… |
CVE-2016-10674 | High | 8.1 | 2018-05-29 | limbus-buildgen is a "build anywhere" build system. limbus-buildgen versions below 0.1.1 download binary resources over HTTP, which leaves it vulnerable to MIT… |
CVE-2016-10666 | High | 8.1 | 2018-05-29 | tomita-parser is a Node wrapper for Yandex Tomita Parser tomita-parser downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may… |
CVE-2016-10659 | High | 8.1 | 2018-05-29 | poco - The POCO libraries, downloads source file resources used for compilation over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to ca… |
CVE-2016-10658 | High | 8.1 | 2018-05-29 | native-opencv is the OpenCV library installed via npm native-opencv downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be… |
CVE-2016-10650 | High | 8.1 | 2018-05-29 | ntfserver is a Network Testing Framework Server. ntfserver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible… |
CVE-2016-10635 | High | 8.1 | 2018-05-29 | broccoli-closure is a Closure compiler plugin for Broccoli. broccoli-closure before 1.3.1 downloads binary resources over HTTP, which leaves it vulnerable to M… |
CVE-2016-10627 | High | 8.1 | 2018-05-29 | scala-bin is a binary wrapper for Scala. scala-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to caus… |
CVE-2016-10611 | High | 8.1 | 2018-05-29 | strider-sauce is Sauce Labs / Selenium support for Strider. strider-sauce downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It… |
CVE-2016-10601 | High | 8.1 | 2018-05-29 | webdrvr is a npm wrapper for Selenium Webdriver including Chromedriver / IEDriver / IOSDriver / Ghostdriver. webdrvr downloads binary resources over HTTP, whic… |
CVE-2016-10593 | High | 8.1 | 2018-05-29 | ibapi is an Interactive Brokers API addon for NodeJS. ibapi downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. Before 2.5.6, it… |
CVE-2016-10591 | High | 8.1 | 2018-05-29 | Prince is a Node API for executing XML/HTML to PDF renderer PrinceXML via prince(1) CLI. prince downloads zipped resources over HTTP, which leaves it vulnerabl… |
CVE-2016-10590 | High | 8.1 | 2018-05-29 | cue-sdk-node is a Corsair Cue SDK wrapper for node.js. cue-sdk-node downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be… |
CVE-2016-10589 | High | 8.1 | 2018-05-29 | selenium-binaries downloads Selenium related binaries for your OS. selenium-binaries downloads binary resources over HTTP, which leaves it vulnerable to MITM a… |
CVE-2016-10586 | High | 8.1 | 2018-05-29 | macaca-chromedriver is a Node.js wrapper for the selenium chromedriver. macaca-chromedriver before 1.0.29 downloads binary resources over HTTP, which leaves it… |
CVE-2016-10584 | High | 8.1 | 2018-05-29 | dalek-browser-chrome-canary provides Google Chrome bindings for DalekJS. dalek-browser-chrome-canary downloads binary resources over HTTP, which leaves it vuln… |
CVE-2016-10578 | High | 8.1 | 2018-05-29 | unicode loads unicode data downloaded from unicode.org into nodejs. Unicode before 9.0.0 downloads binary resources over HTTP, which leaves it vulnerable to MI… |
CVE-2016-10577 | High | 8.1 | 2018-05-29 | ibm_db is an asynchronous/synchronous interface for node.js to IBM DB2 and IBM Informix. ibm_db before 1.0.2 downloads binary resources over HTTP, which leaves… |
CVE-2016-10573 | High | 8.1 | 2018-05-29 | baryton-saxophone is a module to install and launch Selenium Server for Mac, Linux and Windows. baryton-saxophone versions below 3.0.1 download binary resource… |
CVE-2016-10570 | High | 8.1 | 2018-05-29 | pngcrush-installer is an installer for Pngcrush. pngcrush-installer versions below 1.8.10 download binary resources over HTTP, which leaves it vulnerable to MI… |
CVE-2016-10568 | High | 8.1 | 2018-05-29 | geoip-lite-country is a stripped down version of geoip-lite, supporting only country lookup. geoip-lite-country before 1.1.4 downloads data resources over HTTP… |
CVE-2016-10567 | High | 8.1 | 2018-05-29 | product-monitor is a HTML/JavaScript template for monitoring a product by encouraging product developers to gather all the information about the status of a pr… |
CVE-2016-10566 | High | 8.1 | 2018-05-29 | install-nw is a module which quickly and robustly installs and caches NW.js. install-nw versions below 1.1.5 download binary resources over HTTP, which leaves… |
CVE-2016-10559 | High | 8.1 | 2018-05-29 | selenium-download downloads the latest versions of the selenium standalone server and the chromedriver. selenium-download before 2.0.7 downloads binary resourc… |
CVE-2016-10558 | High | 8.1 | 2018-05-29 | aerospike is an Aerospike add-on module for Node.js. aerospike versions below 2.4.2 download binary resources over HTTP, which leaves the module vulnerable to… |
CVE-2018-0283 | Medium | 5.8 | 2018-05-02 | A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to restart an instance of the Snort… |
CVE-2018-0281 | Medium | 5.8 | 2018-05-02 | A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to restart an instance of the Snort… |
CVE-2013-4035 | High | 7.3 | 2018-05-01 | IBM Sterling Connect:Direct for OpenVMS 3.4.00, 3.4.01, 3.5.00, 3.6.0, and 3.6.0.1 allow remote attackers to have unspecified impact by leveraging failure to r… |
CVE-2013-5391 | Medium | 5.3 | 2018-04-27 | IBM Worklight Consumer and Enterprise Editions 5.0.x before 5.0.6 Fix Pack 2 and 6.0.x before 6.0.0 Fix Pack 2, and Mobile Foundation Consumer and Enterprise E… |
CVE-2015-9258 | High | 7.5 | 2018-03-31 | In Docker Notary before 0.1, gotuf/signed/verify.go has a Signature Algorithm Not Matched to Key vulnerability. Because an attacker controls the field specifyi… |
CVE-2015-5039 | High | 7.4 | 2018-03-26 | The Remote Client and change management integrations in IBM Rational ClearCase 7.1.x, 8.0.0.x before 8.0.0.18, and 8.0.1.x before 8.0.1.11 do not properly vali… |
CVE-2018-5466 | High | 7.5 | 2018-03-26 | Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have a self-signed SSL certificate vulnerability this could allow an attacker to gain unauthorized… |
CVE-2018-5464 | High | 7.5 | 2018-03-26 | Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an untrusted SSL certificate vulnerability this could allow an attacker to gain unauthorized… |
CVE-2018-5462 | High | 7.5 | 2018-03-26 | Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an SSL incorrect hostname certificate vulnerability this could allow an attacker to gain unau… |
CVE-2018-5458 | High | 7.5 | 2018-03-26 | Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have a vulnerability using SSL legacy encryption that could allow an attacker to gain unauthorized… |
CVE-2014-10069 | High | 7.5 | 2018-01-07 | Hitron CVE-30360 devices use a 578A958E3DD933FC DES key that is shared across different customers' installations, which makes it easier for attackers to obtain… |
CVE-2014-2903 | Medium | 5.9 | 2017-10-06 | CyaSSL does not check the key usage extension in leaf certificates, which allows remote attackers to spoof servers via a crafted server certificate not authori… |
CVE-2015-7256 | Medium | 5.9 | 2017-09-28 | ZyXEL NWA1100-N, NWA1100-NH, NWA1121-NI, NWA1123-AC, and NWA1123-NI access points; P-660HN-51, P-663HN-51, VMG1312-B10A, VMG1312-B30A, VMG1312-B30B, VMG4380-B1… |
CVE-2014-8878 | Medium | 5.9 | 2017-09-28 | KDE KMail does not encrypt attachments in emails when "automatic encryption" is enabled, which allows remote attackers to obtain sensitive information by sniff… |
CVE-2011-4667 | Medium | 5.9 | 2017-09-25 | The encryption library in Cisco IOS Software 15.2(1)T, 15.2(1)T1, and 15.2(2)T, Cisco NX-OS in Cisco MDS 9222i Multiservice Modular Switch, Cisco MDS 9000 18/4… |
CVE-2014-8686 | Critical | 9.8 | 2017-09-19 | CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt… |
CVE-2014-8684 | Critical | 9.8 | 2017-09-19 | CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently condu… |
CVE-2014-7808 | High | 7.5 | 2017-09-15 | Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict… |
CVE-2017-6766 | High | 7.5 | 2017-08-07 | A vulnerability in the Secure Sockets Layer (SSL) Decryption and Inspection feature of Cisco Firepower System Software 5.4.0, 5.4.1, 6.0.0, 6.1.0, 6.2.0, 6.2.1… |
CVE-2015-9107 | Critical | 9.8 | 2017-08-04 | Zoho ManageEngine OpManager 11 through 12.2 uses a custom encryption algorithm to protect the credential used to access the monitored devices. The implemented… |
CVE-2016-7812 | Low | 3.1 | 2017-08-02 | The Bank of Tokyo-Mitsubishi UFJ, Ltd. App for Android ver5.3.1, ver5.2.2 and earlier allow a man-in-the-middle attacker to downgrade the communication between… |
CVE-2016-0736 | High | 7.5 | 2017-07-27 | In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB… |
CVE-2015-8013 | High | 7.5 | 2017-07-25 | s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if me… |
CVE-2016-4457 | High | 7.5 | 2017-06-08 | CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate. |
CVE-2016-10376 | Medium | 4.5 | 2017-05-28 | Gajim through 0.16.7 unconditionally implements the "XEP-0146: Remote Controlling Clients" extension. This can be abused by malicious XMPP servers to, for exam… |
CVE-2015-9003 | High | 7.8 | 2017-05-16 | In TrustZone a cryptographic issue can potentially occur in all Android releases from CAF using the Linux kernel. |
CVE-2017-3204 | High | 8.1 | 2017-04-04 | The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to r… |
CVE-2016-7585 | Medium | 6.8 | 2017-04-02 | An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves mishandling of DMA in the "EFI" component. It allows ph… |
CVE-2015-8234 | Medium | 5.5 | 2017-03-29 | The image signature algorithm in OpenStack Glance 11.0.0 allows remote attackers to bypass the signature verification process via a crafted image, which trigge… |
CVE-2015-8989 | High | 8.8 | 2017-03-14 | Unsalted password vulnerability in the Enterprise Manager (web portal) component in Intel Security McAfee Vulnerability Manager (MVM) 7.5.8 and earlier allows… |
CVE-2015-4056 | Medium | 6.7 | 2017-02-21 | The System Library in VCE Vision Intelligent Operations before 2.6.5 does not properly implement cryptography, which makes it easier for local users to discove… |
CVE-2016-9346 | Medium | 5.3 | 2017-02-13 | An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. Configuration data are stored in a… |
CVE-2016-6329 | Medium | 5.9 | 2017-01-31 | OpenVPN, when using a 64-bit block cipher, makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypte… |
CVE-2016-1919 | Medium | 4.7 | 2017-01-27 | Samsung KNOX 1.0 uses a weak eCryptFS Key generation algorithm, which makes it easier for local users to obtain sensitive information by leveraging knowledge o… |
CVE-2016-10139 | High | 7.8 | 2017-01-13 | An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The two package names involved in the exfiltration are com.adups.fota and com.adups… |
CVE-2016-10138 | High | 7.8 | 2017-01-13 | An issue was discovered on BLU Advance 5.0 and BLU R1 HD devices with Shanghai Adups software. The com.adups.fota.sysoper app is installed as a system app and… |
CVE-2016-10137 | High | 7.8 | 2017-01-13 | An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoProvider in the app w… |
CVE-2016-10136 | High | 7.8 | 2017-01-13 | An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoProvider in the app w… |
CVE-2016-10099 | Medium | 5.3 | 2017-01-02 | Borg (aka BorgBackup) before 1.0.9 has a flaw in the cryptographic protocol used to authenticate the manifest (list of archives), potentially allowing an attac… |
CVE-2016-7270 | High | 7.5 | 2016-12-20 | The Data Provider for SQL Server in Microsoft .NET Framework 4.6.2 mishandles a developer-supplied key, which allows remote attackers to bypass the Always Encr… |
CVE-2016-1411 | Medium | 5.9 | 2016-12-14 | A vulnerability in the update functionality of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA), Cisco Web Security Appliance (WSA), and Cisco C… |
CVE-2016-7439 | Medium | 5.5 | 2016-12-13 | The C software implementation of RSA in wolfSSL (formerly CyaSSL) before 3.9.10 makes it easier for local users to discover RSA keys by leveraging cache-bank h… |
CVE-2016-7438 | Medium | 5.5 | 2016-12-13 | The C software implementation of ECC in wolfSSL (formerly CyaSSL) before 3.9.10 makes it easier for local users to discover RSA keys by leveraging cache-bank h… |
CVE-2016-9847 | Medium | 5.3 | 2016-12-11 | An issue was discovered in phpMyAdmin. When the user does not specify a blowfish_secret key for encrypting cookies, phpMyAdmin generates one at runtime. A vuln… |
CVE-2016-6606 | High | 8.1 | 2016-12-11 | An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attack. This can allow an… |
CVE-2016-2953 | Low | 3.7 | 2016-11-30 | IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 does not require SSL, which allows remote attackers to obtain sensitive cleartext informat… |
CVE-2016-2951 | Low | 3.7 | 2016-11-30 | IBM BigFix Remote Control before 9.1.3 does not properly set the default encryption strength, which makes it easier for remote attackers to defeat cryptographi… |
CVE-2016-8224 | Medium | 4.4 | 2016-11-29 | A vulnerability has been identified in some Lenovo Notebook and ThinkServer systems where an attacker with administrative privileges on a system could install… |
CVE-2016-8889 | Medium | 6.2 | 2016-10-28 | In Bitcoin Knots v0.11.0.ljr20150711 through v0.13.0.knots20160814 (fixed in v0.13.1.knots20161027), the debug console stores sensitive information including p… |
CVE-2016-5084 | High | 7.5 | 2016-10-05 | Johnson & Johnson Animas OneTouch Ping devices do not use encryption for certain data, which might allow remote attackers to obtain sensitive information by sn… |
CVE-2016-6550 | Medium | 5.4 | 2016-10-05 | The U by BB&T app 1.5.4 and earlier for iOS does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof ser… |
CVE-2016-5957 | High | 7.5 | 2016-09-26 | IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote attackers to defeat cryptographic protection mechanisms a… |
CVE-2016-4763 | Medium | 6.8 | 2016-09-25 | WKWebView in WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly verify X.509 certificates from HTTPS server… |
CVE-2016-4754 | High | 7.5 | 2016-09-25 | ServerDocs Server in Apple OS X Server before 5.2 supports the RC4 cipher, which might allow remote attackers to defeat cryptographic protection mechanisms via… |