CWE-326 · Inadequate Encryption Strength (page 3)
Page 3 of 5 — CVEs classified under CWE-326, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-22464 | High | 7.5 | 2022-07-08 | IBM Security Access Manager Appliance 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 uses weaker than expected cryptographic algorithms that could allow an attacke… |
CVE-2022-31459 | High | 7.4 | 2022-06-02 | Owl Labs Meeting Owl 5.2.0.15 allows attackers to retrieve the passcode hash via a certain c 10 value over Bluetooth. |
CVE-2022-29249 | High | 7.5 | 2022-05-24 | JavaEZ is a library that adds new functions to make Java easier. A weakness in JavaEZ 1.6 allows force decryption of locked text by unauthorized actors. The is… |
CVE-2020-16235 | Low | 3.8 | 2022-05-19 | Inadequate encryption may allow the credentials used by Emerson OpenEnterprise, up through version 3.3.5, to access field devices and external systems to be ob… |
CVE-2021-27761 | Medium | 4.8 | 2022-05-06 | Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacks |
CVE-2022-29161 | Medium | 5.4 | 2022-05-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The XWiki Crypto API will generate X509 certificates s… |
CVE-2021-32010 | Medium | 5.6 | 2022-05-04 | Inadequate Encryption Strength vulnerability in TLS stack of Secomea SiteManager, LinkManager, GateManager may facilitate man in the middle attacks. This issue… |
CVE-2022-22368 | High | 7.5 | 2022-05-03 | IBM Spectrum Scale 5.1.0 through 5.1.3.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informatio… |
CVE-2022-29566 | High | 8.1 | 2022-04-21 | The Bulletproofs 2017/1066 paper mishandles Fiat-Shamir generation because the hash computation fails to include all of the public values from the Zero Knowled… |
CVE-2022-1318 | Medium | 6.2 | 2022-04-20 | Hills ComNav version 3002-19 suffers from a weak communication channel. Traffic across the local network for the configuration pages can be viewed by a malicio… |
CVE-2022-20677 | Medium | 5.5 | 2022-04-15 | Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into… |
CVE-2022-25156 | High | 8.1 | 2022-04-01 | Use of Weak Hash vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU all version… |
CVE-2021-32945 | High | 7.5 | 2022-04-01 | An attacker could decipher the encryption and gain access to MDT AutoSave versions prior to v6.02.06. |
CVE-2021-37209 | Medium | 6.7 | 2022-03-08 | A vulnerability has been identified in RUGGEDCOM i800 (All versions < V4.3.8), RUGGEDCOM i801 (All versions < V4.3.8), RUGGEDCOM i802 (All versions < V4.3.8)… |
CVE-2022-25012 | Medium | 5.5 | 2022-03-01 | Argus Surveillance DVR v4.0 employs weak password encryption. |
CVE-2022-22321 | Medium | 5.5 | 2022-03-01 | IBM MQ Appliance 9.2 CD and 9.2 LTS local messaging users stored with a password hash that provides insufficient protection. IBM X-Force ID: 218368. |
CVE-2020-14481 | High | 7.8 | 2022-02-24 | The DeskLock tool provided with FactoryTalk View SE uses a weak encryption algorithm that may allow a local, authenticated attacker to decipher user credential… |
CVE-2020-10636 | Medium | 6.5 | 2022-02-24 | Inadequate encryption may allow the passwords for Emerson OpenEnterprise versions through 3.3.4 user accounts to be obtained. |
CVE-2022-21800 | Medium | 6.5 | 2022-02-18 | MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 uses the MD5 a… |
CVE-2019-4291 | Medium | 6.5 | 2022-02-16 | IBM Maximo Anywhere 7.6.4.0 could allow an attacker to reverse engineer the application due to the lack of binary protection precautions. IBM X-Force ID: 16069… |
CVE-2022-24318 | High | 7.5 | 2022-02-09 | A CWE-326: Inadequate Encryption Strength vulnerability exists that could cause non-encrypted communication with the server when outdated versions of the ViewX… |
CVE-2022-21653 | Medium | 5.9 | 2022-01-05 | Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext… |
CVE-2021-36337 | Medium | 6.5 | 2021-12-21 | Dell Wyse Management Suite version 3.3.1 and prior support insecure Transport Security Protocols TLS 1.0 and TLS 1.1 which are susceptible to Man-In-The-Middle… |
CVE-2021-42216 | Critical | 9.8 | 2021-12-15 | A Broken or Risky Cryptographic Algorithm exists in AnonAddy 0.8.5 via VerificationController.php. |
CVE-2021-38947 | High | 7.5 | 2021-12-13 | IBM Spectrum Copy Data Management 2.2.13 and earlier uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitiv… |
CVE-2021-20400 | High | 7.5 | 2021-12-01 | IBM QRadar SIEM 7.3 and 7.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Forc… |
CVE-2021-38891 | High | 7.5 | 2021-11-23 | IBM Sterling Connect:Direct Web Services 1.0 and 6.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitiv… |
CVE-2021-44150 | High | 7.5 | 2021-11-22 | The client in tusdotnet through 2.5.0 relies on SHA-1 to prevent spoofing of file content. |
CVE-2021-38984 | High | 7.5 | 2021-11-15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sen… |
CVE-2021-38983 | High | 7.5 | 2021-11-15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sen… |
CVE-2021-3789 | Medium | 4.2 | 2021-11-12 | An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access to obta… |
CVE-2021-39182 | High | 7.5 | 2021-11-08 | EnroCrypt is a Python module for encryption and hashing. Prior to version 1.1.4, EnroCrypt used the MD5 hashing algorithm in the hashing file. Beginners who ar… |
CVE-2021-38464 | Medium | 6.4 | 2021-10-19 | InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 have inadequate encryption strength, which may allow an attacker to intercept the communica… |
CVE-2021-38862 | High | 7.5 | 2021-10-12 | IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM… |
CVE-2021-38925 | High | 7.5 | 2021-10-06 | IBM Sterling B2B Integrator Standard Edition 5.2.0. 0 through 6.1.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decryp… |
CVE-2021-23855 | High | 8.6 | 2021-10-04 | The user and password data base is exposed by an unprotected web server resource. Passwords are hashed with a weak hashing algorithm and therefore allow an att… |
CVE-2017-16632 | High | 7.5 | 2021-08-11 | In SapphireIMS 4097_1, the password in the database is stored in Base64 format. |
CVE-2021-37606 | Medium | 5.3 | 2021-07-30 | Meow hash 0.5/calico does not sufficiently thwart key recovery by an attacker who can query whether there's a collision in the bottom bits of the hashes of two… |
CVE-2021-28095 | Medium | 4.8 | 2021-07-30 | OX Documents before 7.10.5-rev5 has Incorrect Access Control for documents that contain XML structures because hash collisions can occur, due to use of CRC32. |
CVE-2021-28094 | Medium | 6.5 | 2021-07-30 | OX Documents before 7.10.5-rev7 has Incorrect Access Control for converted documents because hash collisions can occur, due to use of CRC32. |
CVE-2021-28093 | Medium | 6.5 | 2021-07-30 | OX Documents before 7.10.5-rev5 has Incorrect Access Control of converted images because hash collisions can occur, due to use of Adler32. |
CVE-2021-20369 | Medium | 5.9 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM… |
CVE-2021-20360 | High | 7.5 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM… |
CVE-2021-34430 | High | 7.5 | 2021-07-08 | Eclipse TinyDTLS through 0.9-rc1 relies on the rand function in the C library, which makes it easier for remote attackers to compute the master key and then de… |
CVE-2021-32496 | Medium | 5.3 | 2021-06-28 | SICK Visionary-S CX up version 5.21.2.29154R are vulnerable to an Inadequate Encryption Strength vulnerability concerning the internal SSH interface solely use… |
CVE-2021-25392 | Medium | 4.0 | 2021-06-11 | Improper protection of backup path configuration in Samsung Dex prior to SMR MAY-2021 Release 1 allows local attackers to get sensitive information via changin… |
CVE-2020-15387 | High | 7.4 | 2021-06-09 | The host SSH servers of Brocade Fabric OS before Brocade Fabric OS v7.4.2h, v8.2.1c, v8.2.2, v9.0.0, and Brocade SANnav before v2.1.1 utilize keys of less than… |
CVE-2018-16499 | Medium | 5.9 | 2021-05-26 | In VOS compromised, an attacker at network endpoints can possibly view communications between an unsuspecting user and the service using man-in-the-middle atta… |
CVE-2020-27208 | Medium | 6.8 | 2021-05-21 | The flash read-out protection (RDP) level is not enforced during the device initialization phase of the SoloKeys Solo 4.0.0 & Somu and the Nitrokey FIDO2 token… |
CVE-2020-18220 | High | 7.5 | 2021-05-20 | Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does not use a random salt or IV for its AES-CB… |
CVE-2021-27457 | High | 7.5 | 2021-05-20 | A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected products utilize a weak encryption algorithm for… |
CVE-2020-27020 | High | 7.5 | 2021-05-14 | Password generator feature in Kaspersky Password Manager was not completely cryptographically strong and potentially allowed an attacker to predict generated p… |
CVE-2021-21507 | High | 8.8 | 2021-04-30 | Dell EMC Networking X-Series firmware versions prior to 3.0.1.8 and Dell EMC PowerEdge VRTX Switch Module firmware versions prior to 2.0.0.82 contain a Weak Pa… |
CVE-2020-26197 | High | 7.5 | 2021-04-20 | Dell PowerScale OneFS 8.1.0 - 9.1.0 contains an LDAP Provider inability to connect over TLSv1.2 vulnerability. It may make it easier to eavesdrop and decrypt s… |
CVE-2021-23982 | Medium | 6.5 | 2021-03-31 | Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network's hosts as well as services running on… |
CVE-2021-27450 | High | 7.8 | 2021-03-25 | SSH server configuration file does not implement some best practices. This could lead to a weakening of the SSH protocol strength, which could lead to addition… |
CVE-2021-21387 | High | 8.1 | 2021-03-19 | Wrongthink peer-to-peer, end-to-end encrypted messenger with PeerJS and Axolotl ratchet. In wrongthink from version 2.0.0 and before 2.3.0 there was a set of v… |
CVE-2020-35221 | High | 8.8 | 2021-03-10 | The hashing algorithm implemented for NSDP password authentication on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was found to be insecure, allowing attackers… |
CVE-2021-20406 | Low | 2.2 | 2021-02-12 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensiti… |
CVE-2021-21474 | Medium | 6.5 | 2021-02-09 | SAP HANA Database, versions - 1.0, 2.0, accepts SAML tokens with MD5 digest, an attacker who manages to obtain an MD5-digest signed SAML Assertion issued for a… |
CVE-2020-10554 | High | 7.5 | 2021-02-05 | An issue was discovered in Psyprax beforee 3.2.2. Passwords used to encrypt the data are stored in the database in an obfuscated format, which can be easily re… |
CVE-2020-10375 | Medium | 5.5 | 2021-02-05 | An issue was discovered in New Media Smarty before 9.10. Passwords are stored in the database in an obfuscated format that can be easily reversed. The file dat… |
CVE-2021-25761 | Medium | 5.3 | 2021-02-03 | In JetBrains Ktor before 1.5.0, a birthday attack on SessionStorage key was possible. |
CVE-2020-25685 | Low | 3.7 | 2021-01-20 | A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded… |
CVE-2019-4160 | High | 7.5 | 2021-01-13 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive… |
CVE-2021-3131 | High | 7.5 | 2021-01-13 | The Web server in 1C:Enterprise 8 before 8.3.17.1851 sends base64 encoded credentials in the creds URL parameter. |
CVE-2017-20001 | High | 7.5 | 2021-01-01 | The AES encryption project 7.x and 8.x for Drupal does not sufficiently prevent attackers from decrypting data, aka SA-CONTRIB-2017-027. NOTE: This project is… |
CVE-2020-26263 | High | 7.5 | 2020-12-21 | tlslite-ng is an open source python library that implements SSL and TLS cryptographic protocols. In tlslite-ng before versions 0.7.6 and 0.8.0-alpha39, the cod… |
CVE-2020-7565 | High | 7.3 | 2020-11-19 | A CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryp… |
CVE-2020-17494 | Medium | 5.3 | 2020-11-12 | Untangle Firewall NG before 16.0 uses MD5 for passwords. |
CVE-2020-8761 | Medium | 4.6 | 2020-11-12 | Inadequate encryption strength in subsystem for Intel(R) CSME versions before 13.0.40 and 13.30.10 may allow an unauthenticated user to potentially enable info… |
CVE-2020-9128 | Medium | 4.4 | 2020-11-12 | FusionCompute versions 8.0.0 have an insecure encryption algorithm vulnerability. Attackers with high permissions can exploit this vulnerability to cause infor… |
CVE-2020-5938 | Medium | 6.5 | 2020-10-29 | On BIG-IP 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when negotiating IPSec tunnels with configured, authenticated peers, the peer may negotiate a… |
CVE-2020-3549 | High | 8.1 | 2020-10-21 | A vulnerability in the sftunnel functionality of Cisco Firepower Management Center (FMC) Software and Cisco Firepower Threat Defense (FTD) Software could allow… |
CVE-2020-7069 | Medium | 5.4 | 2020-10-02 | In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only… |
CVE-2020-14517 | Critical | 9.8 | 2020-09-16 | Protocol encryption can be easily broken for CodeMeter (All versions prior to 6.90 are affected, including Version 6.90 or newer only if CodeMeter Runtime is r… |
CVE-2020-5917 | Medium | 5.9 | 2020-08-26 | In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2 and BIG-IQ versions 5.2.0-7.0.0, th… |
CVE-2020-10125 | High | 7.6 | 2020-08-21 | NCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00 implement 512-bit RSA certificates to validate bunch note acceptor (BNA) software updates, which can… |
CVE-2020-5763 | High | 8.8 | 2020-07-29 | Grandstream HT800 series firmware version 1.0.17.5 and below contain a backdoor in the SSH service. An authenticated remote attacker can obtain a root shell by… |
CVE-2020-10919 | Medium | 5.9 | 2020-07-23 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen pan… |
CVE-2020-1982 | Medium | 4.8 | 2020-07-08 | Certain communication between PAN-OS and cloud-delivered services inadvertently use TLS 1.0, which is known to be a cryptographically weak protocol. These clou… |
CVE-2017-1712 | Medium | 5.9 | 2020-07-01 | "A vulnerability in the TLS protocol implementation of the Domino server could allow an unauthenticated, remote attacker to access sensitive information, aka a… |
CVE-2020-10275 | Critical | 9.8 | 2020-06-24 | The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD… |
CVE-2020-0533 | Medium | 6.7 | 2020-06-15 | Reversible one-way hash in Intel(R) CSME versions before 11.8.76, 11.12.77 and 11.22.77 may allow a privileged user to potentially enable escalation of privile… |
CVE-2020-3929 | Medium | 5.9 | 2020-06-12 | GeoVision Door Access Control device family employs shared cryptographic private keys for SSH and HTTPS. Attackers may conduct MITM attack with the derived key… |
CVE-2020-12714 | Medium | 5.9 | 2020-06-11 | An issue was discovered in CipherMail Community Gateway Virtual Appliances and Professional/Enterprise Gateway Virtual Appliances versions 1.0.1 through 4.7.1-… |
CVE-2020-13785 | High | 7.5 | 2020-06-03 | D-Link DIR-865L Ax 1.20B01 Beta devices have Inadequate Encryption Strength. |
CVE-2020-12872 | Medium | 5.5 | 2020-05-15 | yaws_config.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks, if running on an Erlang/OTP… |
CVE-2020-5886 | Critical | 9.1 | 2020-04-30 | On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems setup for connection mirroring in a High Availability (HA) p… |
CVE-2020-5885 | Critical | 9.1 | 2020-04-30 | On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems set up for connection mirroring in a high availability (HA)… |
CVE-2019-19101 | Medium | 6.5 | 2020-04-29 | A missing secure communication definition and an incomplete TLS validation in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, < 4.3… |
CVE-2018-21080 | Medium | 4.6 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) software. A physically proximate attacker wielding a magnet can activate NFC to bypass the locksc… |
CVE-2016-11043 | High | 7.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with M(6.0) software. The S/MIME implementation in EAS uses DES (where 3DES is intended). The Samsung ID is S… |
CVE-2020-10601 | High | 7.8 | 2020-04-03 | VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module allow weak hashing algorithm and insecure permissions which may allow a local attacker to bypas… |
CVE-2019-19097 | Medium | 5.9 | 2020-04-02 | ABB eSOMS versions 4.0 to 6.0.3 accept connections using medium strength ciphers. If a connection is enabled using such a cipher, an attacker might be able to… |
CVE-2020-10866 | High | 7.5 | 2020-04-01 | An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to e… |
CVE-2019-14855 | High | 7.5 | 2020-03-20 | A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create… |
CVE-2019-12121 | High | 7.5 | 2020-03-18 | An issue was detected in ONAP Portal through Dublin. By executing a padding oracle attack using the ONAPPORTAL/processSingleSignOn UserId field, an attacker is… |
CVE-2019-19299 | High | 7.5 | 2020-03-10 | A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0), SiNVR/SiVMS Video Server (All versions >= V5.0.0 < V5.0.2), SiNVR/SiVM… |
CVE-2020-10244 | High | 7.5 | 2020-03-09 | JPaseto before 0.3.0 generates weak hashes when using v2.local tokens. |