CWE-326 · Inadequate Encryption Strength (page 4)
Page 4 of 5 — CVEs classified under CWE-326, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-9476 | High | 7.5 | 2020-03-04 | ARRIS TG1692A devices allow remote attackers to discover the administrator login name and password by reading the /login page and performing base64 decoding. |
CVE-2019-18863 | Medium | 5.9 | 2020-03-02 | A key length vulnerability in the implementation of the SRTP 128-bit key on Mitel 6800 and 6900 SIP series phones, versions 5.1.0.2051 SP2 and earlier, could a… |
CVE-2015-5361 | Medium | 6.5 | 2020-02-28 | Background For regular, unencrypted FTP traffic, the FTP ALG can inspect the unencrypted control channel and open related sessions for the FTP data channel. Th… |
CVE-2020-9337 | Medium | 6.5 | 2020-02-26 | In GolfBuddy Course Manager 1.1, passwords are sent (with base64 encoding) via a GET request. |
CVE-2019-4557 | High | 7.5 | 2020-02-25 | IBM Qradar Advisor 1.1 through 2.5 with Watson uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive info… |
CVE-2013-7287 | Critical | 9.8 | 2020-02-13 | MobileIron VSP < 5.9.1 and Sentry < 5.0 has an insecure encryption scheme. |
CVE-2013-7286 | High | 7.5 | 2020-02-12 | MobileIron VSP < 5.9.1 and Sentry < 5.0 has a weak password obfuscation algorithm |
CVE-2019-13163 | Medium | 5.9 | 2020-02-07 | The Fujitsu TLS library allows a man-in-the-middle attack. This affects Interstage Application Development Cycle Manager V10 and other versions, Interstage App… |
CVE-2011-3629 | High | 7.5 | 2020-02-04 | Joomla! core 1.7.1 allows information disclosure due to weak encryption |
CVE-2020-5224 | Medium | 6.5 | 2020-01-24 | In Django User Sessions (django-user-sessions) before 1.7.1, the views provided allow users to terminate specific sessions. The session key is used to identify… |
CVE-2020-6966 | Critical | 10.0 | 2020-01-24 | In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE… |
CVE-2019-18263 | Medium | 6.5 | 2019-12-20 | An issue was found in Philips Veradius Unity, Pulsera, and Endura Dual WAN Router, Veradius Unity (718132) with wireless option (shipped between 2016-August 20… |
CVE-2013-2166 | Critical | 9.8 | 2019-12-10 | python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass |
CVE-2012-2130 | High | 7.4 | 2019-12-06 | A Security Bypass vulnerability exists in PolarSSL 0.99pre4 through 1.1.1 due to a weak encryption error when generating Diffie-Hellman values and RSA keys. |
CVE-2013-7484 | High | 7.5 | 2019-11-30 | Zabbix before 5.0 represents passwords in the users table with unsalted MD5. |
CVE-2011-4121 | Critical | 9.8 | 2019-11-26 | The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used for private RSA key g… |
CVE-2019-18241 | Medium | 6.5 | 2019-11-26 | In Philips IntelliBridge EC40 and EC80, IntelliBridge EC40 Hub all versions, and IntelliBridge EC80 Hub all versions, the SSH server running on the affected pr… |
CVE-2019-13539 | High | 7.0 | 2019-11-08 | Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energ… |
CVE-2010-3670 | Medium | 4.8 | 2019-11-05 | TYPO3 before 4.3.4 and 4.4.x before 4.4.1 contains insecure randomness during generation of a hash with the "forgot password" function. |
CVE-2019-17598 | High | 7.5 | 2019-11-05 | An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may somet… |
CVE-2013-4104 | High | 7.5 | 2019-11-04 | Cryptocat before 2.0.22 has weak encryption in the Socialist Millionnaire Protocol |
CVE-2019-4339 | High | 7.5 | 2019-10-29 | IBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sens… |
CVE-2019-16649 | Critical | 10.0 | 2019-09-21 | On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of… |
CVE-2019-4175 | High | 7.5 | 2019-09-17 | IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sens… |
CVE-2019-15806 | Critical | 9.8 | 2019-08-29 | CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative interface because they i… |
CVE-2019-15805 | Critical | 9.8 | 2019-08-29 | CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative interface because they i… |
CVE-2019-14332 | High | 7.8 | 2019-08-01 | An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is use of weak ciphers for SSH such as diffie-hellman-group1-sha… |
CVE-2019-10639 | High | 7.5 | 2019-07-05 | The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information Exposure (partial kernel address disclosure), leading to a KASLR bypass. Speci… |
CVE-2019-10638 | Medium | 6.5 | 2019-07-05 | In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g., UDP an… |
CVE-2018-18325 | High | 7.5 | 2019-07-03 | DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for C… |
CVE-2018-15811 | High | 7.5 | 2019-07-03 | DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters. |
CVE-2019-4102 | Medium | 5.9 | 2019-07-01 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.0 uses weaker than expected cryptographic algorithms that could allow… |
CVE-2018-20810 | Critical | 9.8 | 2019-06-28 | Session data between cluster nodes during cluster synchronization is not properly encrypted in Pulse Secure Pulse Connect Secure (PCS) 8.3RX before 8.3R2 and P… |
CVE-2019-4151 | Medium | 5.9 | 2019-06-25 | IBM Security Access Manager 9.0.1 through 9.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive inf… |
CVE-2019-6972 | High | 7.5 | 2019-06-19 | An issue was discovered on TP-Link TL-WR1043ND V2 devices. The credentials can be easily decoded and cracked by brute-force, WordList, or Rainbow Table attacks… |
CVE-2019-4256 | High | 7.5 | 2019-05-29 | IBM API Connect 5.0.0.0 through 5.0.8.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information… |
CVE-2019-10855 | High | 7.5 | 2019-05-23 | Computrols CBAS 18.0.0 mishandles password hashes. The approach is MD5 with a pw prefix, e.g., if the password is admin, it will calculate the MD5 hash of pwad… |
CVE-2019-10112 | High | 7.5 | 2019-05-16 | An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. The construction of the HMAC… |
CVE-2018-1608 | Medium | 5.9 | 2019-05-01 | IBM Rational Engineering Lifecycle Manager 6.0 through 6.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly… |
CVE-2018-2007 | Medium | 5.9 | 2019-04-29 | IBM API Connect 2018.1 and 2018.4.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information… |
CVE-2018-1925 | Medium | 5.9 | 2019-04-15 | IBM WebShere MQ 9.1.0.0, 9.1.0.1, 9.1.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information… |
CVE-2019-10907 | Critical | 9.8 | 2019-04-07 | Airsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of airsonic in GlobalSecurityConfig.java. An attacker able to captur… |
CVE-2017-1713 | Medium | 5.9 | 2019-03-21 | IBM InfoSphere Streams 4.2.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-For… |
CVE-2018-1946 | Medium | 5.9 | 2019-02-21 | IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance supports interaction between multiple actors and allows those actors to… |
CVE-2013-7469 | High | 7.5 | 2019-02-21 | Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to condu… |
CVE-2017-1695 | Medium | 5.9 | 2019-02-15 | IBM QRadar SIEM 7.2 and 7.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Forc… |
CVE-2019-7648 | High | 7.5 | 2019-02-08 | controller/fetchpwd.php and controller/doAction.php in Hotels_Server through 2018-11-05 rely on base64 in an attempt to protect password storage. |
CVE-2018-1751 | Medium | 5.9 | 2019-01-23 | IBM Security Key Lifecycle Manager 3.0 through 3.0.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensit… |
CVE-2018-18767 | High | 7.0 | 2018-12-20 | An issue was discovered in D-Link 'myDlink Baby App' version 2.04.06. Whenever actions are performed from the app (e.g., change camera settings or play lullabi… |
CVE-2018-1814 | Medium | 5.9 | 2018-12-13 | IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 uses weaker than expected cryptographic algorithms that could allow an at… |
CVE-2018-1665 | Medium | 5.9 | 2018-12-13 | IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 through 7.7.1.3 uses… |
CVE-2018-19001 | Medium | 4.3 | 2018-12-07 | Philips HealthSuite Health Android App, all versions. The software uses simple encryption that is not strong enough for the level of protection required. |
CVE-2018-1648 | High | 7.5 | 2018-12-05 | IBM QRadar SIEM 7.2 and 7.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Forc… |
CVE-2018-19784 | High | 7.5 | 2018-12-01 | The str_rot_pass function in vendor/atholn1600/php-proxy/src/helpers.php in PHP-Proxy 5.1.0 uses weak cryptography, which makes it easier for attackers to calc… |
CVE-2018-15796 | High | 8.1 | 2018-11-09 | Cloud Foundry Bits Service Release, versions prior to 2.14.0, uses an insecure hashing algorithm to sign URLs. A remote malicious user may obtain a signed URL… |
CVE-2018-1518 | Medium | 6.2 | 2018-10-18 | IBM InfoSphere Information Server 11.7 is affected by a weak password encryption vulnerability that could allow a local user to obtain highly sensitive informa… |
CVE-2018-0448 | Critical | 9.8 | 2018-10-05 | A vulnerability in the identity management service of Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass… |
CVE-2018-1593 | Low | 3.7 | 2018-10-02 | IBM Multi-Cloud Data Encryption (MDE) 2.1 could allow an unauthorized user to manipulate data due to missing file checksums. IBM X-Force ID: 143568. |
CVE-2018-1785 | High | 7.5 | 2018-09-26 | IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensit… |
CVE-2018-1545 | High | 7.5 | 2018-09-26 | IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly… |
CVE-2018-17177 | Low | 2.4 | 2018-09-18 | An issue was discovered on Neato Botvac Connected 2.2.0 and Botvac 85 1.2.1 devices. Static encryption is used for the copying of so-called "black box" logs (e… |
CVE-2018-0131 | Medium | 5.9 | 2018-08-14 | A vulnerability in the implementation of RSA-encrypted nonces in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker t… |
CVE-2018-15124 | Critical | 9.8 | 2018-08-13 | Weak hashing algorithm in Zipato Zipabox Smart Home Controller BOARD REV - 1 with System Version -118 allows unauthenticated attacker extract clear text passwo… |
CVE-2017-1366 | Medium | 5.9 | 2018-08-06 | IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decry… |
CVE-2017-16726 | Critical | 9.1 | 2018-06-27 | Beckhoff TwinCAT supports communication over ADS. ADS is a protocol for industrial automation in protected environments. ADS has not been designed to achieve s… |
CVE-2018-9028 | High | 7.5 | 2018-06-18 | Weak cryptography used for passwords in CA Privileged Access Manager 2.x reduces the complexity for password cracking. |
CVE-2018-5184 | High | 7.5 | 2018-06-11 | Using remote content in encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8. |
CVE-2017-2598 | Medium | 4.3 | 2018-05-23 | Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored secrets vulnerable to… |
CVE-2017-9635 | Low | 3.9 | 2018-05-18 | Schneider Electric Ampla MES 6.4 provides capability to configure users and their privileges. When Ampla MES users are configured to use Simple Security, a wea… |
CVE-2018-1466 | Medium | 5.3 | 2018-05-17 | IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products (6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7… |
CVE-2017-1255 | High | 7.5 | 2018-05-02 | IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly s… |
CVE-2017-5535 | Medium | 6.8 | 2018-05-01 | The GridServer Broker, GridServer Driver, and GridServer Engine components of TIBCO Software Inc. TIBCO DataSynapse GridServer Manager contain vulnerabilities… |
CVE-2014-0841 | Medium | 5.3 | 2018-04-27 | IBM Rational Focal Point 6.4.0, 6.4.1, 6.5.1, 6.5.2, and 6.6.0 use a weak algorithm to hash passwords, which makes it easier for context-dependent attackers to… |
CVE-2017-17543 | High | 7.5 | 2018-04-26 | Users' VPN authentication credentials are unsafely encrypted in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and be… |
CVE-2017-1701 | High | 8.8 | 2018-04-23 | IBM Team Concert (RTC) 5.0, 5.0.1, 5.0.2, 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, and 6.0.5 stores credentials for users using a weak encryption algorithm, which coul… |
CVE-2017-1473 | High | 7.5 | 2018-04-23 | IBM Security Access Manager Appliance 8.0.0 through 8.0.1.6 and 9.0.0 through 9.0.3.1 uses weaker than expected cryptographic algorithms that could allow an at… |
CVE-2018-7242 | Critical | 9.8 | 2018-04-18 | Vulnerable hash algorithms exists in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versions of the com… |
CVE-2017-3971 | High | 8.2 | 2018-04-04 | Cryptanalysis vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to view confidential informatio… |
CVE-2015-4953 | Medium | 4.8 | 2018-03-29 | IBM BigFix Remote Control before Interim Fix pack 9.1.2-TIV-IBRC912-IF0001 makes it easier for man-in-the-middle attackers to decrypt traffic by leveraging a w… |
CVE-2015-7449 | Low | 3.3 | 2018-03-20 | IBM Rational Collaborative Lifecycle Management (CLM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; R… |
CVE-2018-4839 | Medium | 5.3 | 2018-03-08 | A vulnerability has been identified in DIGSI 4 (All versions < V4.92), EN100 Ethernet module DNP3 variant (All versions < V1.05.00), EN100 Ethernet module IEC… |
CVE-2018-5461 | Medium | 6.5 | 2018-03-06 | An Inadequate Encryption Strength issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switche… |
CVE-2017-6284 | Medium | 5.5 | 2018-03-06 | NVIDIA Security Engine contains a vulnerability in the Deterministic Random Bit Generator (DRBG) where the DRBG does not properly initialize and store or trans… |
CVE-2018-6653 | Medium | 5.3 | 2018-03-01 | comforte SWAP 1049 through 1069 and 20.0.0 through 21.5.3 (as used in SSLOBJ on HPE NonStop SSL T0910, and in the comforte SecurCS, SecurFTP, SecurLib/SSL-AT… |
CVE-2018-1425 | Medium | 5.9 | 2018-02-27 | IBM Security Guardium Big Data Intelligence (SonarG) 3.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sens… |
CVE-2018-6635 | High | 7.5 | 2018-02-05 | System Manager in Avaya Aura before 7.1.2 does not properly use SSL in conjunction with authentication, which allows remote attackers to bypass intended Remote… |
CVE-2018-6594 | High | 7.5 | 2018-02-03 | lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by read… |
CVE-2018-5298 | High | 7.5 | 2018-01-08 | In the Procter & Gamble "Oral-B App" (aka com.pg.oralb.oralbapp) application 5.0.0 for Android, AES encryption with static parameters is used to secure the loc… |
CVE-2017-1665 | Medium | 5.9 | 2018-01-04 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive… |
CVE-2017-1664 | Medium | 5.9 | 2018-01-04 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive… |
CVE-2017-1000486 | Critical | 9.8 | 2018-01-03 | Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution |
CVE-2017-14090 | Critical | 9.1 | 2017-12-16 | A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which some communications to the update servers are not encrypted. |
CVE-2017-1271 | High | 7.5 | 2017-12-07 | IBM Security Guardium 9.0, 9.1, and 9.5 supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a p… |
CVE-2017-17436 | High | 8.8 | 2017-12-07 | An issue was discovered in the software on Vaultek Gun Safe VT20i products. There is no encryption of the session between the Android application and the safe… |
CVE-2017-13699 | High | 7.5 | 2017-11-23 | An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. The password encryption method can be retrieved from the firmware. This encryption method… |
CVE-2017-8174 | High | 7.5 | 2017-11-22 | Huawei USG6300 V100R001C30SPC300 and USG6600 with software of V100R001C30SPC500,V100R001C30SPC600,V100R001C30SPC700,V100R001C30SPC800 have a weak algorithm vul… |
CVE-2017-1375 | High | 7.5 | 2017-10-24 | IBM System Storage Storwize V7000 Unified (V7000U) 1.5 and 1.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highl… |
CVE-2012-6707 | High | 7.5 | 2017-10-19 | WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging acces… |
CVE-2017-14797 | High | 7.5 | 2017-10-01 | Lack of Transport Encryption in the public API in Philips Hue Bridge BSB002 SW 1707040932 allows remote attackers to read API keys (and consequently bypass the… |
CVE-2017-9645 | Medium | 6.5 | 2017-09-20 | An Inadequate Encryption Strength issue was discovered in Mirion Technologies DMC 3000 Transmitter Module, iPam Transmitter f/DMC 2000, RDS-31 iTX and variants… |