CWE-327 · Use of a Broken or Risky Cryptographic Algorithm (page 3)
Page 3 of 7 — CVEs classified under CWE-327, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-48847 | High | 8.2 | 2024-12-05 | MD5 Checksum Bypass vulnerabilities where found exploiting a weakness in the way an application dependency calculates or validates MD5 checksum hashes. Affect… |
CVE-2024-41775 | Medium | 5.9 | 2024-12-03 | IBM Cognos Controller 11.0.0 and 11.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. |
CVE-2024-52801 | | 2024-11-29 | sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The OpenID Connect implem… | |
CVE-2022-43934 | Medium | 6.5 | 2024-11-21 | Brocade SANnav before Brocade SANnav 2.2.2 supports key exchange algorithms, which are considered weak on ports 24, 6514, 18023, 19094, and 19095. |
CVE-2024-43189 | Medium | 5.9 | 2024-11-15 | IBM Concert Software 1.0.0 through 1.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Tr… |
CVE-2020-11916 | Medium | 6.3 | 2024-11-07 | An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. The password for the root user is hashed using an old and deprecated hashing technique. Beca… |
CVE-2024-51556 | Medium | 6.5 | 2024-11-04 | This vulnerability exists in the Wave 2.0 due to insufficient encryption of sensitive data received at the API response. An authenticated remote attacker could… |
CVE-2024-51478 | Critical | 9.9 | 2024-10-31 | YesWiki is a wiki system written in PHP. Prior to 4.4.5, the use of a weak cryptographic algorithm and a hard-coded salt to hash the password reset key allows… |
CVE-2024-10128 | Low | 2.7 | 2024-10-18 | A vulnerability was found in Topdata Inner Rep Plus WebServer 2.01. It has been rated as problematic. Affected by this issue is some unknown functionality of t… |
CVE-2024-48016 | Medium | 4.6 | 2024-10-18 | Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.24, contains a Use of a Broken or Risky Cryptographic Algorithm vulnerability. A low privil… |
CVE-2024-47188 | High | 7.5 | 2024-10-16 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initializ… |
CVE-2024-47187 | High | 7.5 | 2024-10-16 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initializ… |
CVE-2024-8452 | High | 7.5 | 2024-09-30 | Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNMPv3 service, allowi… |
CVE-2024-39583 | High | 8.1 | 2024-09-10 | Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains a Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthenticated attacker wit… |
CVE-2024-37068 | Medium | 5.9 | 2024-09-07 | IBM Maximo Application Suite - Manage Component 8.10, 8.11, and 9.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt… |
CVE-2024-45394 | High | 8.8 | 2024-09-03 | Authenticator is a browser extension that generates two-step verification codes. In versions 7.0.0 and below, encryption keys for user data were stored encrypt… |
CVE-2024-45193 | Medium | 4.3 | 2024-08-22 | An issue was discovered in Matrix libolm through 3.2.16. There is Ed25519 signature malleability due to lack of validation criteria (does not ensure that S < n… |
CVE-2024-36440 | Medium | 6.8 | 2024-08-22 | An issue was discovered on Swissphone DiCal-RED 4009 devices. An attacker with access to the file /etc/deviceconfig may recover the administrative device passw… |
CVE-2024-39745 | Medium | 5.9 | 2024-08-22 | IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt high… |
CVE-2024-41270 | Critical | 9.1 | 2024-08-06 | An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecated TLS version. |
CVE-2024-28972 | Medium | 5.9 | 2024-08-01 | Dell InsightIQ, Verion 5.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. An unauthenticated remote attacker could potentially e… |
CVE-2024-40465 | High | 8.8 | 2024-07-31 | An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go file |
CVE-2024-39731 | Medium | 5.9 | 2024-07-15 | IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly s… |
CVE-2024-30098 | High | 7.5 | 2024-07-09 | Windows Cryptographic Services Security Feature Bypass Vulnerability |
CVE-2023-41928 | Medium | 5.3 | 2024-07-02 | The device is observed to accept deprecated TLS protocols, increasing the risk of cryptographic weaknesses. |
CVE-2023-41927 | Medium | 5.3 | 2024-07-02 | The server supports at least one cipher suite which is on the NCSC-NL list of cipher suites to be phased out, increasing the risk of cryptographic weaknesses. |
CVE-2024-32852 | Medium | 5.9 | 2024-07-02 | Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.0 contain use of a broken or risky cryptographic algorithm vulnerability. An unprivileged network maliciou… |
CVE-2024-37137 | Low | 3.8 | 2024-06-28 | Dell Key Trust Platform, v3.0.6 and prior, contains Use of a Cryptographic Primitive with a Risky Implementation vulnerability. A local privileged attacker cou… |
CVE-2023-38371 | Medium | 5.9 | 2024-06-27 | IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly… |
CVE-2024-29175 | Medium | 5.9 | 2024-06-26 | Dell PowerProtect Data Domain, versions prior to 7.13.0.0, LTS 7.7.5.40, LTS 7.10.1.30 contain an weak cryptographic algorithm vulnerability. A remote unauthen… |
CVE-2024-3264 | Medium | 5.3 | 2024-06-24 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in Mia Technology Inc. Mia-Med Health Aplication allows Signature Spoofing by Improper Validatio… |
CVE-2024-35537 | High | 7.5 | 2024-06-21 | TVS Motor Company Limited TVS Connect Android v4.6.0 and IOS v5.0.0 was discovered to insecurely handle the RSA key pair, allowing attackers to possibly access… |
CVE-2024-32911 | Critical | 9.8 | 2024-06-13 | There is a possible escalation of privilege due to improperly used crypto. This could lead to remote escalation of privilege with no additional execution privi… |
CVE-2024-5559 | Medium | 6.1 | 2024-06-12 | CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists that could cause denial of service, device reboot, or an attacker gaining full c… |
CVE-2024-36823 | High | 7.5 | 2024-06-06 | The encrypt() function of Ninja Core v7.0.0 was discovered to use a weak cryptographic algorithm, leading to a possible leakage of sensitive information. |
CVE-2024-20070 | Medium | 5.1 | 2024-06-03 | In modem, there is a possible information disclosure due to using risky cryptographic algorithm during connection establishment negotiation. This could lead to… |
CVE-2024-31510 | Critical | 9.8 | 2024-05-24 | An issue in Open Quantum Safe liboqs v.10.0 allows a remote attacker to escalate privileges via the crypto_sign_signature parameter in the /pqcrystals-dilithiu… |
CVE-2024-4563 | Medium | 6.1 | 2024-05-22 | The Progress MOVEit Automation configuration export function prior to 2024.0.0 uses a cryptographic method with insufficient bit length. |
CVE-2024-31989 | Critical | 9.0 | 2024-05-21 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It has been discovered that an unprivileged pod in a different namespace on the same… |
CVE-2024-4765 | High | 8.1 | 2024-05-14 | Web application manifests were stored by using an insecure MD5 hash which allowed for a hash collision to overwrite another application's manifest. This could… |
CVE-2024-25968 | Medium | 5.9 | 2024-05-14 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unauthenticated attack… |
CVE-2023-40696 | Medium | 5.9 | 2024-05-03 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive in… |
CVE-2020-4874 | Medium | 5.9 | 2024-05-03 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive in… |
CVE-2024-33663 | Medium | 6.5 | 2024-04-26 | python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217. |
CVE-2023-37396 | Low | 2.5 | 2024-04-19 | IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain sensitive information due to improper encryption of certain data. IBM X-Force ID: 25… |
CVE-2024-29056 | Medium | 4.3 | 2024-04-09 | Windows Authentication Elevation of Privilege Vulnerability |
CVE-2023-50313 | Medium | 5.3 | 2024-04-02 | IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configu… |
CVE-2024-25963 | Medium | 5.9 | 2024-03-28 | Dell PowerScale OneFS, versions 8.2.2.x through 9.5.0.x contains a use of a broken cryptographic algorithm vulnerability. A remote unauthenticated attacker cou… |
CVE-2024-28834 | Medium | 5.3 | 2024-03-21 | A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-ch… |
CVE-2024-22463 | High | 7.4 | 2024-03-04 | Dell PowerScale OneFS 8.2.x through 9.6.0.x contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unprivileged attacker could pot… |
CVE-2024-27255 | Medium | 5.9 | 2024-03-03 | IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 uses weaker t… |
CVE-2024-22458 | Low | 3.7 | 2024-03-01 | Dell Secure Connect Gateway, 5.18, contains an Inadequate Encryption Strength Vulnerability. An unauthenticated network attacker could potentially exploit this… |
CVE-2023-50312 | Medium | 5.3 | 2024-03-01 | IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.2 could provide weaker than expected security for outbound TLS connections caused by a failure… |
CVE-2023-51392 | Medium | 6.2 | 2024-02-23 | Ember ZNet between v7.2.0 and v7.4.0 used software AES-CCM instead of integrated hardware cryptographic accelerators, potentially increasing risk of electromag… |
CVE-2022-34309 | Medium | 5.9 | 2024-02-12 | IBM CICS TX Standard and Advanced 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information… |
CVE-2022-34310 | Medium | 5.9 | 2024-02-12 | IBM CICS TX Standard and Advanced 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information… |
CVE-2024-22361 | Medium | 5.9 | 2024-02-10 | IBM Semeru Runtime 8.0.302.0 through 8.0.392.0, 11.0.12.0 through 11.0.21.0, 17.0.1.0 - 17.0.9.0, and 21.0.1.0 uses weaker than expected cryptographic algorith… |
CVE-2024-22318 | Medium | 5.1 | 2024-02-09 | IBM i Access Client Solutions (ACS) 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.4 is vulnerable to NT LAN Manager (NTLM) hash disclosure by an attacker modif… |
CVE-2024-24559 | Low | 3.7 | 2024-02-05 | Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management when compiling the `IR` for `sha3_64`. Concretely, the `heig… |
CVE-2023-51838 | High | 7.5 | 2024-02-02 | Ylianst MeshCentral 1.1.16 suffers from Use of a Broken or Risky Cryptographic Algorithm. |
CVE-2023-50937 | Medium | 5.9 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-F… |
CVE-2023-50939 | Medium | 5.9 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-F… |
CVE-2024-1040 | Medium | 4.4 | 2024-02-01 | Gessler GmbH WEB-MASTER user account is stored using a weak hashing algorithm. The attacker can restore the passwords by breaking the hashes stored on the devi… |
CVE-2023-51839 | Critical | 9.1 | 2024-01-29 | DeviceFarmer stf v3.6.6 suffers from Use of a Broken or Risky Cryptographic Algorithm. |
CVE-2024-22192 | Medium | 6.5 | 2024-01-16 | Ursa is a cryptographic library for use with blockchains. The revocation scheme that is part of the Ursa CL-Signatures implementations has a flaw that could im… |
CVE-2024-21670 | Medium | 6.5 | 2024-01-16 | Ursa is a cryptographic library for use with blockchains. The revocation schema that is part of the Ursa CL-Signatures implementations has a flaw that could im… |
CVE-2023-49259 | High | 7.5 | 2024-01-12 | The authentication cookies are generated using an algorithm based on the username, hardcoded secret and the up-time, and can be guessed in a reasonable time. |
CVE-2023-5347 | Critical | 9.8 | 2024-01-09 | An Improper Verification of Cryptographic Signature vulnerability in the update process of Korenix JetNet Series allows replacing the whole operating system in… |
CVE-2023-50351 | High | 8.2 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by the use of an insecure key rotation mechanism which can allow an attacker to compromise the confidentiality or integrity o… |
CVE-2023-50350 | High | 8.2 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by the use of a broken cryptographic algorithm for encryption, potentially giving an attacker ability to decrypt sensitive in… |
CVE-2021-46900 | High | 7.5 | 2023-12-31 | Sympa before 6.2.62 relies on a cookie parameter for certain security objectives, but does not ensure that this parameter exists and has an unpredictable value… |
CVE-2023-5962 | Medium | 6.5 | 2023-12-23 | A weak cryptographic algorithm vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. This vulnerability can help an attac… |
CVE-2023-41097 | Medium | 4.6 | 2023-12-21 | An Observable Timing Discrepancy, Covert Timing Channel vulnerability in Silabs GSDK on ARM potentially allows Padding Oracle Crypto Attack on CBC PKCS7.This i… |
CVE-2023-50481 | High | 7.5 | 2023-12-21 | An issue was discovered in blinksocks version 3.3.8, allows remote attackers to obtain sensitive information via weak encryption algorithms in the component /p… |
CVE-2023-50475 | Critical | 9.1 | 2023-12-21 | An issue was discovered in bcoin-org bcoin version 2.2.0, allows remote attackers to obtain sensitive information via weak hashing algorithms in the component… |
CVE-2023-28053 | Medium | 5.3 | 2023-12-18 | Dell NetWorker Virtual Edition versions 19.8 and below contain the use of deprecated cryptographic algorithms in the SSH component. A remote unauthenticated a… |
CVE-2022-43843 | Medium | 5.9 | 2023-12-14 | IBM Spectrum Scale 5.1.5.0 through 5.1.5.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informat… |
CVE-2021-27795 | Medium | 6.4 | 2023-12-06 | Brocade Fabric OS (FOS) hardware platforms running any version of Brocade Fabric OS software, which supports the license string format; contain cryptographic… |
CVE-2022-24403 | Medium | 4.3 | 2023-12-05 | The TETRA TA61 identity encryption function internally uses a 64-bit value derived exclusively from the SCK (Class 2 networks) or CCK (Class 3 networks). The s… |
CVE-2023-26024 | Medium | 6.5 | 2023-12-01 | IBM Planning Analytics on Cloud Pak for Data 4.0 could allow an attacker on a shared network to obtain sensitive information caused by insecure network communi… |
CVE-2023-38361 | Medium | 5.9 | 2023-11-18 | IBM CICS TX Advanced 10.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force… |
CVE-2023-47640 | Medium | 6.4 | 2023-11-14 | DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key… |
CVE-2023-5627 | High | 7.5 | 2023-11-01 | A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable. This vulnerability arises from the incorrect implemen… |
CVE-2023-46233 | Critical | 9.1 | 2023-10-25 | crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at… |
CVE-2023-46133 | Critical | 9.1 | 2023-10-25 | CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript. Prior to version 2.1.0, CryptoES PBKDF2 is 1,000 times weaker than originally… |
CVE-2023-30994 | Medium | 5.4 | 2023-10-14 | IBM QRadar SIEM 7.5.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID… |
CVE-2022-33160 | Low | 3.7 | 2023-10-06 | IBM Security Directory Suite 8.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IB… |
CVE-2023-3350 | High | 8.2 | 2023-10-03 | A Cryptographic Issue vulnerability has been found on IBERMATICA RPS, affecting version 2019. By firstly downloading the log file, an attacker could retrieve t… |
CVE-2023-39252 | Medium | 5.9 | 2023-09-21 | Dell SCG Policy Manager 5.16.00.14 contains a broken cryptographic algorithm vulnerability. A remote unauthenticated attacker may potentially exploit this vu… |
CVE-2023-43635 | High | 8.8 | 2023-09-20 | Vault Key Sealed With SHA1 PCRs The measured boot solution implemented in EVE OS leans on a PCR locking mechanism. Different parts of the system update… |
CVE-2023-34039 | Critical | 9.8 | 2023-08-29 | Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. A malicious actor with netwo… |
CVE-2023-34758 | High | 8.1 | 2023-08-28 | Sliver from v1.5.x to v1.5.39 has an improper cryptographic implementation, which allows attackers to execute a man-in-the-middle attack via intercepted and cr… |
CVE-2023-38730 | Medium | 5.9 | 2023-08-27 | IBM Storage Copy Data Management 2.2.0.0 through 2.2.19.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sen… |
CVE-2023-40371 | Medium | 6.2 | 2023-08-24 | IBM AIX 7.2, 7.3, VIOS 3.1's OpenSSH implementation could allow a non-privileged local user to access files outside of those allowed due to improper access con… |
CVE-2023-4331 | High | 7.5 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that support obsolete and vulnerable TLS protocols |
CVE-2023-4326 | High | 7.5 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that supports obsolete SHA1-based ciphersuites |
CVE-2023-23347 | Medium | 6.4 | 2023-08-09 | HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of s… |
CVE-2023-23346 | Medium | 6.4 | 2023-08-09 | HCL DRYiCE MyCloud is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sen… |
CVE-2023-37484 | Medium | 5.3 | 2023-08-08 | SAP PowerDesigner - version 16.7, queries all password hashes in the backend database and compares it with the user provided one during login attempt, which mi… |
CVE-2021-38933 | Medium | 5.9 | 2023-07-19 | IBM Sterling Connect:Direct for UNIX 1.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informatio… |