CWE-326 · Inadequate Encryption Strength (page 2)
Page 2 of 5 — CVEs classified under CWE-326, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-40745 | Medium | 5.5 | 2024-04-19 | IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain sensitive information due to weaker than expected security. IBM X-Force ID: 236452. |
CVE-2024-29969 | High | 7.5 | 2024-04-19 | When a Brocade SANnav installation is upgraded from Brocade SANnav v2.2.2 to Brocade SANnav 2.3.0, TLS/SSL weak message authentication code ciphers are added b… |
CVE-2024-29951 | Medium | 5.7 | 2024-04-17 | Brocade SANnav before v2.3.1 and v2.3.0a uses the SHA-1 hash in internal SSH ports that are not open to remote connection. |
CVE-2024-29950 | High | 7.5 | 2024-04-17 | The class FileTransfer implemented in Brocade SANnav before v2.3.1, v2.3.0a, uses the ssh-rsa signature scheme, which has a SHA-1 hash. The vulnerability could… |
CVE-2024-3387 | Medium | 5.3 | 2024-04-10 | A weak (low bit strength) device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle (MitM) attack to ca… |
CVE-2024-28755 | Medium | 6.5 | 2024-04-03 | An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum TLS version to be n… |
CVE-2024-28860 | High | 8.0 | 2024-03-27 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Users of IPsec transparent encryption in Cilium may be vulnerable to… |
CVE-2022-32753 | Medium | 4.5 | 2024-03-22 | IBM Security Verify Directory 10.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information… |
CVE-2024-25102 | High | 7.8 | 2024-03-06 | This vulnerability exists in AppSamvid software due to the usage of a weaker cryptographic algorithm (hash) SHA1 in user login component. An attacker with loca… |
CVE-2024-1224 | High | 7.1 | 2024-03-06 | This vulnerability exists in USB Pratirodh due to the usage of a weaker cryptographic algorithm (hash) SHA1 in user login component. A local attacker with admi… |
CVE-2024-22894 | Medium | 6.8 | 2024-01-30 | An issue fixed in AIT-Deutschland Alpha Innotec Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later and Novelan Heatpumps V2.88.3 or later, V3.89.0… |
CVE-2024-23656 | High | 7.5 | 2024-01-25 | Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. `cmd/dex… |
CVE-2023-7237 | Medium | 5.7 | 2024-01-23 | Lantronix XPort sends weakly encoded credentials within web request headers. |
CVE-2024-20692 | Medium | 5.7 | 2024-01-09 | Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability |
CVE-2023-26943 | Medium | 6.5 | 2023-12-05 | Weak encryption mechanisms in RFID Tags in Yale Keyless Lock v1.0 allows attackers to create a cloned tag via physical proximity to the original. |
CVE-2023-26942 | Medium | 6.5 | 2023-12-05 | Weak encryption mechanisms in RFID Tags in Yale IA-210 Alarm v1.0 allows attackers to create a cloned tag via physical proximity to the original. |
CVE-2023-26941 | Medium | 6.5 | 2023-12-05 | Weak encryption mechanisms in RFID Tags in Yale Conexis L1 v1.1.0 allows attackers to create a cloned tag via physical proximity to the original. |
CVE-2023-28896 | Low | 3.3 | 2023-12-01 | Access to critical Unified Diagnostics Services (UDS) of the Modular Infotainment Platform 3 (MIB3) infotainment is transmitted via Controller Area Network (CA… |
CVE-2023-48034 | Medium | 6.1 | 2023-11-27 | An issue discovered in Acer Wireless Keyboard SK-9662 allows attacker in physical proximity to both decrypt wireless keystrokes and inject arbitrary keystrokes… |
CVE-2023-48051 | High | 7.5 | 2023-11-20 | An issue in /upydev/keygen.py in upydev v0.4.3 allows attackers to decrypt sensitive information via weak encryption padding. |
CVE-2023-43757 | Medium | 6.5 | 2023-11-16 | Inadequate encryption strength vulnerability in multiple routers provided by ELECOM CO.,LTD. and LOGITEC CORPORATION allows a network-adjacent unauthenticated… |
CVE-2023-46894 | High | 7.5 | 2023-11-09 | An issue discovered in esptool 4.6.2 allows attackers to view sensitive information via weak cryptographic algorithm. |
CVE-2023-47373 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in DRAGON FAMILY Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-47372 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in UPDATESALON C-LOUNGE Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-47370 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in bluetrick Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-47368 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in taketorinoyu Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-47369 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in best_training_member Line 13.6.1 allows remote attackers to send malicious notifications. |
CVE-2023-47367 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in platinum clinic Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-47366 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in craft_members Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-47365 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in Lil.OFF-PRICE STORE Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-47364 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in nagaoka taxi Line 13.6.1 allows remote attackers to send malicious notifications to victims |
CVE-2023-47363 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in F.B.P members Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2022-48193 | Medium | 5.9 | 2023-11-06 | Weak ciphers in Softing smartLink SW-HT before 1.30 are enabled during secure communication (SSL). |
CVE-2023-44690 | High | 7.5 | 2023-10-19 | Inadequate encryption strength in mycli 1.27.0 allows attackers to view sensitive information via /mycli/config.py |
CVE-2023-30132 | High | 7.8 | 2023-10-19 | An issue discovered in IXP Data EasyInstall 6.6.14907.0 allows attackers to gain escalated privileges via static Cryptographic Key. |
CVE-2023-43776 | Medium | 6.8 | 2023-10-17 | Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the… |
CVE-2023-4129 | Medium | 5.9 | 2023-09-27 | Dell Data Protection Central, version 19.9, contains an Inadequate Encryption Strength Vulnerability. An unauthenticated network attacker could potentially ex… |
CVE-2023-41305 | High | 7.5 | 2023-09-27 | Vulnerability of 5G messages being sent without being encrypted in a VPN environment in the SMS message module. Successful exploitation of this vulnerability m… |
CVE-2022-46783 | Medium | 5.3 | 2023-08-28 | An issue was discovered in Stormshield SSL VPN Client before 3.2.0. If multiple address books are used, an attacker may be able to access the other encrypted a… |
CVE-2023-34971 | High | 7.1 | 2023-08-24 | An inadequate encryption strength vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows local netwo… |
CVE-2023-4333 | Medium | 5.5 | 2023-08-15 | Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by server |
CVE-2023-0525 | High | 7.5 | 2023-08-04 | Weak Encoding for Password vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.49.000 and prior, GT25 model versions 01.49.0… |
CVE-2023-28021 | Medium | 5.9 | 2023-07-18 | The BigFix WebUI uses weak cipher suites. |
CVE-2023-21145 | High | 7.8 | 2023-07-13 | In updatePictureInPictureMode of ActivityRecord.java, there is a possible bypass of background launch restrictions due to a logic error in the code. This could… |
CVE-2023-20942 | Medium | 5.5 | 2023-07-13 | In openMmapStream of AudioFlinger.cpp, there is a possible way to record audio without displaying the microphone privacy indicator due to a logic error in the… |
CVE-2023-20185 | High | 7.4 | 2023-07-12 | A vulnerability in the Cisco ACI Multi-Site CloudSec encryption feature of Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow an unauthenticated… |
CVE-2023-35332 | Medium | 6.8 | 2023-07-11 | Windows Remote Desktop Protocol Security Feature Bypass |
CVE-2023-36748 | Medium | 5.9 | 2023-07-11 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2023-34337 | High | 7.6 | 2023-07-05 | AMI SPx contains a vulnerability in the BMC where a user may cause an inadequate encryption strength by hash-based message authentication code (HMAC). A succe… |
CVE-2023-37301 | Medium | 5.3 | 2023-06-30 | An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3. Because it doesn't use EditEntity for undo and restore, the intended int… |
CVE-2023-36539 | Medium | 5.3 | 2023-06-30 | Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information. |
CVE-2023-3243 | High | 8.3 | 2023-06-28 | ** UNSUPPORTED WHEN ASSIGNED ** [An attacker can capture an authenticating hash and utilize it to create new sessions. The hash is also a poorly salted MD5 ha… |
CVE-2023-32414 | High | 8.6 | 2023-06-23 | The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.4. An app may be able to break out of its sandbox. |
CVE-2023-33283 | Medium | 5.5 | 2023-06-07 | Marval MSM through 14.19.0.12476 uses a static encryption key for secrets. An attacker that gains access to encrypted secrets can decrypt them by using this ke… |
CVE-2023-29549 | Medium | 6.5 | 2023-06-02 | Under certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm. This may have created a vulnerability relating… |
CVE-2023-23597 | Medium | 6.5 | 2023-06-02 | A compromised web child process could disable web security opening restrictions, leading to a new child process being spawned within the `file://` context. Giv… |
CVE-2023-33982 | Medium | 5.9 | 2023-05-24 | Bramble Handshake Protocol (BHP) in Briar before 1.5.3 is not forward secure: eavesdroppers can decrypt network traffic between two accounts if they later comp… |
CVE-2022-45453 | High | 7.5 | 2023-05-18 | TLS/SSL weak cipher suites enabled. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 30984. |
CVE-2023-31135 | Low | 3.3 | 2023-05-17 | Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. The first 12 b… |
CVE-2023-1764 | Medium | 6.5 | 2023-05-17 | Canon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: OS X 10.9.5-macOS 13),IJ Network Tool/Ver.4.7.3 and earlier (supported OS: OS X 10.7.5-OS X 10.8) al… |
CVE-2023-21109 | High | 7.8 | 2023-05-15 | In multiple places of AccessibilityService, there is a possible way to hide the app from the user due to a logic error in the code. This could lead to local es… |
CVE-2022-4048 | High | 7.7 | 2023-05-15 | Inadequate Encryption Strength in CODESYS Development System V3 versions prior to V3.5.18.40 allows an unauthenticated local attacker to access and manipulate… |
CVE-2023-2443 | High | 7.5 | 2023-05-11 | Rockwell Automation ThinManager product allows the use of medium strength ciphers. If the client requests an insecure cipher, a malicious actor could potenti… |
CVE-2023-30351 | High | 7.5 | 2023-05-10 | Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for root which is stored using weak encrypt… |
CVE-2023-2197 | Low | 2.5 | 2023-05-01 | HashiCorp Vault Enterprise 1.13.0 up to 1.13.1 is vulnerable to a padding oracle attack when using an HSM in conjunction with the CKM_AES_CBC_PAD or CKM_AES_CB… |
CVE-2023-28124 | Medium | 5.5 | 2023-04-19 | Improper usage of symmetric encryption in UI Desktop for Windows (Version 0.59.1.71 and earlier) could allow users with access to UI Desktop configuration file… |
CVE-2023-24502 | High | 7.5 | 2023-04-17 | Electra Central AC unit – The unit opens an AP with an easily calculated password. |
CVE-2023-29054 | Medium | 6.7 | 2023-04-11 | A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT PRO (Al… |
CVE-2023-27389 | High | 7.2 | 2023-04-11 | Inadequate encryption strength vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker with an administrative privilege to apply… |
CVE-2023-27987 | Critical | 9.1 | 2023-04-10 | In Apache Linkis <=1.3.1, due to the default token generated by Linkis Gateway deployment being too simple, it is easy for attackers to obtain the default tok… |
CVE-2023-22271 | Medium | 5.3 | 2023-03-22 | Experience Manager versions 6.5.15.0 (and earlier) are affected by a Weak Cryptography for Passwords vulnerability that can lead to a security feature bypass… |
CVE-2023-23911 | High | 7.5 | 2023-03-10 | An improper access control vulnerability exists prior to v6 that could allow an attacker to break the E2E encryption of a chat room by a user changing the grou… |
CVE-2022-45141 | Critical | 9.8 | 2023-03-06 | Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac i… |
CVE-2022-34385 | Medium | 5.5 | 2023-02-11 | SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain cryptographic weakness vulnerabili… |
CVE-2023-21444 | High | 7.5 | 2023-02-09 | Improper cryptographic implementation in Samsung Flow for PC 4.9.14.0 allows adjacent attackers to decrypt encrypted messages or inject commands. |
CVE-2023-21443 | High | 7.5 | 2023-02-09 | Improper cryptographic implementation in Samsung Flow for Android prior to version 4.9.04 allows adjacent attackers to decrypt encrypted messages or inject com… |
CVE-2022-43922 | Medium | 5.3 | 2023-02-01 | IBM App Connect Enterprise Certified Container 4.1, 4.2, 5.0, 5.1, 5.2, 6.0, 6.1, and 6.2 could disclose sensitive information to an attacker due to a weak has… |
CVE-2021-40341 | High | 7.1 | 2023-01-05 | DES cipher, which has inadequate encryption strength, is used Hitachi Energy FOXMAN-UN to encrypt user credentials used to access the Network Elements. Success… |
CVE-2022-2582 | Medium | 4.3 | 2022-12-27 | The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plainte… |
CVE-2022-24116 | Critical | 9.8 | 2022-12-26 | Certain General Electric Renewable Energy products have inadequate encryption strength. This affects iNET and iNET II before 8.3.0. |
CVE-2022-47931 | Critical | 9.1 | 2022-12-23 | IO FinNet tss-lib before 2.0.0 allows a collision of hash values. |
CVE-2022-38659 | Medium | 6.0 | 2022-12-19 | In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent. |
CVE-2022-46825 | Medium | 4.0 | 2022-12-08 | In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects. |
CVE-2022-2640 | High | 7.5 | 2022-12-02 | The Config-files of Horner Automation’s RCC 972 with firmware version 15.40 are encrypted with weak XOR encryption vulnerable to reverse engineering. This coul… |
CVE-2022-4036 | Medium | 5.3 | 2022-11-29 | The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.72. This is due to the use of insuffici… |
CVE-2022-45379 | High | 7.5 | 2022-11-15 | Jenkins Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script approvals as the SHA-1 hash of the script, making it vulnerable to collisi… |
CVE-2020-4099 | Medium | 5.9 | 2022-11-01 | The application was signed using a key length less than or equal to 1024 bits, making it potentially vulnerable to forged digital signatures. An attacker could… |
CVE-2022-41209 | Medium | 5.2 | 2022-10-11 | SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well… |
CVE-2021-35226 | Medium | 6.5 | 2022-10-10 | An entity in Network Configuration Manager product is misconfigured and exposing password field to Solarwinds Information Service (SWIS). Exposed credentials a… |
CVE-2022-3433 | Medium | 6.5 | 2022-10-10 | The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unorder… |
CVE-2022-3273 | Critical | 9.8 | 2022-10-06 | Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a4. |
CVE-2022-29835 | Medium | 5.3 | 2022-09-19 | WD Discovery software executable files were signed with an unsafe SHA-1 hashing algorithm. An attacker could use this weakness to create forged certificate sig… |
CVE-2022-35931 | Low | 2.7 | 2022-09-06 | Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, 23.0.7, and 24.0.3… |
CVE-2022-2758 | Medium | 6.5 | 2022-08-31 | Passwords are not adequately encrypted during the communication process between all versions of LS Industrial Systems (LSIS) Co. Ltd LS Electric XG5000 softwar… |
CVE-2022-36555 | Critical | 9.8 | 2022-08-29 | Hytec Inter HWL-2511-SS v1.05 and below implements a SHA512crypt hash for the root account which can be easily cracked via a brute-force attack. |
CVE-2022-21139 | High | 8.8 | 2022-08-18 | Inadequate encryption strength for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable escalation of privilege… |
CVE-2022-30285 | Critical | 9.8 | 2022-08-02 | In Quest KACE Systems Management Appliance (SMA) through 12.0, a hash collision is possible during authentication. This may allow authentication with invalid c… |
CVE-2022-26307 | High | 8.8 | 2022-07-25 | LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master… |
CVE-2022-26306 | High | 7.5 | 2022-07-25 | LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master… |
CVE-2022-22453 | High | 7.5 | 2022-07-14 | IBM Security Verify Identity Manager 10.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informati… |