CWE-327 · Use of a Broken or Risky Cryptographic Algorithm (page 3)
Page 3 of 8 — CVEs classified under CWE-327, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-28780 | Medium | 5.9 | 2025-02-19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 Rich Client uses weaker than expected cryptographic algorithms that could allow… |
CVE-2024-4282 | Critical | 9.8 | 2025-02-15 | Brocade SANnav OVA before SANnav 2.3.1b enables SHA1 deprecated setting for SSH for port 22. |
CVE-2024-10405 | Medium | 5.3 | 2025-02-15 | Brocade SANnav before SANnav 2.3.1b enables weak TLS ciphers on ports 443 and 18082. In case of a successful exploit, an attacker can read Brocade SANnav dat… |
CVE-2024-52884 | High | 7.5 | 2025-02-07 | An issue was discovered in AudioCodes Mediant Session Border Controller (SBC) before 7.40A.501.841. Due to the use of weak password obfuscation/encryption, an… |
CVE-2024-49797 | Medium | 5.9 | 2025-02-06 | IBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An att… |
CVE-2025-22475 | Low | 3.7 | 2025-02-04 | Dell PowerProtect DD, versions prior to DDOS 8.3.0.0, 7.10.1.50, and 7.13.1.10 contains a use of a Cryptographic Primitive with a Risky Implementation vulnerab… |
CVE-2022-3365 | Critical | 9.8 | 2025-01-28 | Due to reliance on a trivial substitution cipher, sent in cleartext, and the reliance on a default password when the user does not set a password, the Remote M… |
CVE-2024-26317 | Medium | 6.1 | 2025-01-27 | In illumos illumos-gate 2024-02-15, an error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates, causing the alg… |
CVE-2024-27256 | Medium | 5.9 | 2025-01-27 | IBM MQ Container 3.0.0, 3.0.1, 3.1.0 through 3.1.3 CD, 2.0.0 LTS through 2.0.22 LTS and 2.4.0 through 2.4.8, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2 uses weak… |
CVE-2024-38320 | Medium | 5.9 | 2025-01-27 | IBM Storage Protect for Virtual Environments: Data Protection for VMware and Storage Protect Backup-Archive Client 8.1.0.0 through 8.1.23.0 uses weaker than ex… |
CVE-2024-52331 | High | 7.5 | 2025-01-23 | ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that… |
CVE-2024-22347 | Medium | 5.9 | 2025-01-20 | IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses weaker than expected cryptographic algorithms that could allow an attacker to d… |
CVE-2024-8603 | High | 7.5 | 2025-01-15 | A “Use of a Broken or Risky Cryptographic Algorithm” vulnerability in the SSL/TLS component used in B&R Automation Runtime versions before 6.1 and B&R mapp Vie… |
CVE-2024-51456 | Medium | 5.9 | 2025-01-12 | IBM Robotic Process Automation 21.0.0 through 21.0.7.19 and 23.0.0 through 23.0.19 could allow a remote attacker to obtain sensitive data that may be exposed t… |
CVE-2024-52366 | Medium | 5.9 | 2025-01-07 | IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly e… |
CVE-2024-41763 | Medium | 5.9 | 2025-01-04 | IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt… |
CVE-2024-47921 | High | 8.4 | 2024-12-30 | Smadar SPS – CWE-327: Use of a Broken or Risky Cryptographic Algorithm |
CVE-2024-55539 | Low | 2.5 | 2024-12-23 | Weak algorithm used to sign RPM package. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux) before build 39185, Acronis Cyber Prote… |
CVE-2024-28980 | Medium | 6.5 | 2024-12-13 | Dell RecoverPoint for VMs, version(s) 6.0.x contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the SSH. An unauthenticated attacker… |
CVE-2024-55885 | High | 7.5 | 2024-12-12 | beego is an open-source web framework for the Go programming language. Versions of beego prior to 2.3.4 use MD5 as a hashing algorithm. MD5 is no longer consid… |
CVE-2024-53845 | | 2024-12-12 | ESPTouch is a connection protocol for internet of things devices. In the ESPTouchV2 protocol, while there is an option to use a custom AES key, there is no opt… | |
CVE-2023-37395 | Low | 2.5 | 2024-12-11 | IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain sensitive information due to improper encryption of certain data. |
CVE-2024-53441 | Critical | 9.1 | 2024-12-09 | An issue in the index.js decryptCookie function of cookie-encrypter v1.0.1 allows attackers to execute a bit flipping attack. |
CVE-2024-48847 | High | 8.2 | 2024-12-05 | MD5 Checksum Bypass vulnerabilities where found exploiting a weakness in the way an application dependency calculates or validates MD5 checksum hashes. Affect… |
CVE-2024-41775 | Medium | 5.9 | 2024-12-03 | IBM Cognos Controller 11.0.0 and 11.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. |
CVE-2024-52801 | | 2024-11-29 | sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The OpenID Connect implem… | |
CVE-2022-43934 | Medium | 6.5 | 2024-11-21 | Brocade SANnav before Brocade SANnav 2.2.2 supports key exchange algorithms, which are considered weak on ports 24, 6514, 18023, 19094, and 19095. |
CVE-2024-43189 | Medium | 5.9 | 2024-11-15 | IBM Concert Software 1.0.0 through 1.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Tr… |
CVE-2020-11916 | Medium | 6.3 | 2024-11-07 | An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. The password for the root user is hashed using an old and deprecated hashing technique. Beca… |
CVE-2024-51556 | Medium | 6.5 | 2024-11-04 | This vulnerability exists in the Wave 2.0 due to insufficient encryption of sensitive data received at the API response. An authenticated remote attacker could… |
CVE-2024-51478 | Critical | 9.9 | 2024-10-31 | YesWiki is a wiki system written in PHP. Prior to 4.4.5, the use of a weak cryptographic algorithm and a hard-coded salt to hash the password reset key allows… |
CVE-2024-10128 | Low | 2.7 | 2024-10-18 | A vulnerability was found in Topdata Inner Rep Plus WebServer 2.01. It has been rated as problematic. Affected by this issue is some unknown functionality of t… |
CVE-2024-48016 | Medium | 4.6 | 2024-10-18 | Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.24, contains a Use of a Broken or Risky Cryptographic Algorithm vulnerability. A low privil… |
CVE-2024-47188 | High | 7.5 | 2024-10-16 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initializ… |
CVE-2024-47187 | High | 7.5 | 2024-10-16 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initializ… |
CVE-2024-8452 | High | 7.5 | 2024-09-30 | Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNMPv3 service, allowi… |
CVE-2024-39583 | High | 8.1 | 2024-09-10 | Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains a Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthenticated attacker wit… |
CVE-2024-37068 | Medium | 5.9 | 2024-09-07 | IBM Maximo Application Suite - Manage Component 8.10, 8.11, and 9.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt… |
CVE-2024-45394 | High | 8.8 | 2024-09-03 | Authenticator is a browser extension that generates two-step verification codes. In versions 7.0.0 and below, encryption keys for user data were stored encrypt… |
CVE-2024-45193 | Medium | 4.3 | 2024-08-22 | An issue was discovered in Matrix libolm through 3.2.16. There is Ed25519 signature malleability due to lack of validation criteria (does not ensure that S < n… |
CVE-2024-36440 | Medium | 6.8 | 2024-08-22 | An issue was discovered on Swissphone DiCal-RED 4009 devices. An attacker with access to the file /etc/deviceconfig may recover the administrative device passw… |
CVE-2024-39745 | Medium | 5.9 | 2024-08-22 | IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt high… |
CVE-2024-41270 | Critical | 9.1 | 2024-08-06 | An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecated TLS version. |
CVE-2024-28972 | Medium | 5.9 | 2024-08-01 | Dell InsightIQ, Verion 5.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. An unauthenticated remote attacker could potentially e… |
CVE-2024-40465 | High | 8.8 | 2024-07-31 | An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go file |
CVE-2024-39731 | Medium | 5.9 | 2024-07-15 | IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly s… |
CVE-2024-30098 | High | 7.5 | 2024-07-09 | Windows Cryptographic Services Security Feature Bypass Vulnerability |
CVE-2023-41928 | Medium | 5.3 | 2024-07-02 | The device is observed to accept deprecated TLS protocols, increasing the risk of cryptographic weaknesses. |
CVE-2023-41927 | Medium | 5.3 | 2024-07-02 | The server supports at least one cipher suite which is on the NCSC-NL list of cipher suites to be phased out, increasing the risk of cryptographic weaknesses. |
CVE-2024-32852 | Medium | 5.9 | 2024-07-02 | Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.0 contain use of a broken or risky cryptographic algorithm vulnerability. An unprivileged network maliciou… |
CVE-2024-37137 | Low | 3.8 | 2024-06-28 | Dell Key Trust Platform, v3.0.6 and prior, contains Use of a Cryptographic Primitive with a Risky Implementation vulnerability. A local privileged attacker cou… |
CVE-2023-38371 | Medium | 5.9 | 2024-06-27 | IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly… |
CVE-2024-29175 | Medium | 5.9 | 2024-06-26 | Dell PowerProtect Data Domain, versions prior to 7.13.0.0, LTS 7.7.5.40, LTS 7.10.1.30 contain an weak cryptographic algorithm vulnerability. A remote unauthen… |
CVE-2024-3264 | Medium | 5.3 | 2024-06-24 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in Mia Technology Inc. Mia-Med Health Aplication allows Signature Spoofing by Improper Validatio… |
CVE-2024-35537 | High | 7.5 | 2024-06-21 | TVS Motor Company Limited TVS Connect Android v4.6.0 and IOS v5.0.0 was discovered to insecurely handle the RSA key pair, allowing attackers to possibly access… |
CVE-2024-32911 | Critical | 9.8 | 2024-06-13 | There is a possible escalation of privilege due to improperly used crypto. This could lead to remote escalation of privilege with no additional execution privi… |
CVE-2024-5559 | Medium | 6.1 | 2024-06-12 | CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists that could cause denial of service, device reboot, or an attacker gaining full c… |
CVE-2024-36823 | High | 7.5 | 2024-06-06 | The encrypt() function of Ninja Core v7.0.0 was discovered to use a weak cryptographic algorithm, leading to a possible leakage of sensitive information. |
CVE-2024-20070 | Medium | 5.1 | 2024-06-03 | In modem, there is a possible information disclosure due to using risky cryptographic algorithm during connection establishment negotiation. This could lead to… |
CVE-2024-31510 | Critical | 9.8 | 2024-05-24 | An issue in Open Quantum Safe liboqs v.10.0 allows a remote attacker to escalate privileges via the crypto_sign_signature parameter in the /pqcrystals-dilithiu… |
CVE-2024-4563 | Medium | 6.1 | 2024-05-22 | The Progress MOVEit Automation configuration export function prior to 2024.0.0 uses a cryptographic method with insufficient bit length. |
CVE-2024-31989 | Critical | 9.0 | 2024-05-21 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It has been discovered that an unprivileged pod in a different namespace on the same… |
CVE-2024-4765 | High | 8.1 | 2024-05-14 | Web application manifests were stored by using an insecure MD5 hash which allowed for a hash collision to overwrite another application's manifest. This could… |
CVE-2024-25968 | Medium | 5.9 | 2024-05-14 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unauthenticated attack… |
CVE-2023-40696 | Medium | 5.9 | 2024-05-03 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive in… |
CVE-2020-4874 | Medium | 5.9 | 2024-05-03 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive in… |
CVE-2024-33663 | Medium | 6.5 | 2024-04-26 | python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217. |
CVE-2023-37396 | Low | 2.5 | 2024-04-19 | IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain sensitive information due to improper encryption of certain data. IBM X-Force ID: 25… |
CVE-2024-29056 | Medium | 4.3 | 2024-04-09 | Windows Authentication Elevation of Privilege Vulnerability |
CVE-2023-50313 | Medium | 5.3 | 2024-04-02 | IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configu… |
CVE-2024-25963 | Medium | 5.9 | 2024-03-28 | Dell PowerScale OneFS, versions 8.2.2.x through 9.5.0.x contains a use of a broken cryptographic algorithm vulnerability. A remote unauthenticated attacker cou… |
CVE-2024-28834 | Medium | 5.3 | 2024-03-21 | A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-ch… |
CVE-2024-22463 | High | 7.4 | 2024-03-04 | Dell PowerScale OneFS 8.2.x through 9.6.0.x contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unprivileged attacker could pot… |
CVE-2024-27255 | Medium | 5.9 | 2024-03-03 | IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 uses weaker t… |
CVE-2024-22458 | Low | 3.7 | 2024-03-01 | Dell Secure Connect Gateway, 5.18, contains an Inadequate Encryption Strength Vulnerability. An unauthenticated network attacker could potentially exploit this… |
CVE-2023-50312 | Medium | 5.3 | 2024-03-01 | IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.2 could provide weaker than expected security for outbound TLS connections caused by a failure… |
CVE-2023-51392 | Medium | 6.2 | 2024-02-23 | Ember ZNet between v7.2.0 and v7.4.0 used software AES-CCM instead of integrated hardware cryptographic accelerators, potentially increasing risk of electromag… |
CVE-2022-34309 | Medium | 5.9 | 2024-02-12 | IBM CICS TX Standard and Advanced 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information… |
CVE-2022-34310 | Medium | 5.9 | 2024-02-12 | IBM CICS TX Standard and Advanced 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information… |
CVE-2024-22361 | Medium | 5.9 | 2024-02-10 | IBM Semeru Runtime 8.0.302.0 through 8.0.392.0, 11.0.12.0 through 11.0.21.0, 17.0.1.0 - 17.0.9.0, and 21.0.1.0 uses weaker than expected cryptographic algorith… |
CVE-2024-22318 | Medium | 5.1 | 2024-02-09 | IBM i Access Client Solutions (ACS) 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.4 is vulnerable to NT LAN Manager (NTLM) hash disclosure by an attacker modif… |
CVE-2024-24559 | Low | 3.7 | 2024-02-05 | Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management when compiling the `IR` for `sha3_64`. Concretely, the `heig… |
CVE-2023-51838 | High | 7.5 | 2024-02-02 | Ylianst MeshCentral 1.1.16 suffers from Use of a Broken or Risky Cryptographic Algorithm. |
CVE-2023-50937 | Medium | 5.9 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-F… |
CVE-2023-50939 | Medium | 5.9 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-F… |
CVE-2024-1040 | Medium | 4.4 | 2024-02-01 | Gessler GmbH WEB-MASTER user account is stored using a weak hashing algorithm. The attacker can restore the passwords by breaking the hashes stored on the devi… |
CVE-2023-51839 | Critical | 9.1 | 2024-01-29 | DeviceFarmer stf v3.6.6 suffers from Use of a Broken or Risky Cryptographic Algorithm. |
CVE-2024-22192 | Medium | 6.5 | 2024-01-16 | Ursa is a cryptographic library for use with blockchains. The revocation scheme that is part of the Ursa CL-Signatures implementations has a flaw that could im… |
CVE-2024-21670 | Medium | 6.5 | 2024-01-16 | Ursa is a cryptographic library for use with blockchains. The revocation schema that is part of the Ursa CL-Signatures implementations has a flaw that could im… |
CVE-2023-49259 | High | 7.5 | 2024-01-12 | The authentication cookies are generated using an algorithm based on the username, hardcoded secret and the up-time, and can be guessed in a reasonable time. |
CVE-2023-5347 | Critical | 9.8 | 2024-01-09 | An Improper Verification of Cryptographic Signature vulnerability in the update process of Korenix JetNet Series allows replacing the whole operating system in… |
CVE-2023-50351 | High | 8.2 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by the use of an insecure key rotation mechanism which can allow an attacker to compromise the confidentiality or integrity o… |
CVE-2023-50350 | High | 8.2 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by the use of a broken cryptographic algorithm for encryption, potentially giving an attacker ability to decrypt sensitive in… |
CVE-2021-46900 | High | 7.5 | 2023-12-31 | Sympa before 6.2.62 relies on a cookie parameter for certain security objectives, but does not ensure that this parameter exists and has an unpredictable value… |
CVE-2023-5962 | Medium | 6.5 | 2023-12-23 | A weak cryptographic algorithm vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. This vulnerability can help an attac… |
CVE-2023-41097 | Medium | 4.6 | 2023-12-21 | An Observable Timing Discrepancy, Covert Timing Channel vulnerability in Silabs GSDK on ARM potentially allows Padding Oracle Crypto Attack on CBC PKCS7.This i… |
CVE-2023-50481 | High | 7.5 | 2023-12-21 | An issue was discovered in blinksocks version 3.3.8, allows remote attackers to obtain sensitive information via weak encryption algorithms in the component /p… |
CVE-2023-50475 | Critical | 9.1 | 2023-12-21 | An issue was discovered in bcoin-org bcoin version 2.2.0, allows remote attackers to obtain sensitive information via weak hashing algorithms in the component… |
CVE-2023-28053 | Medium | 5.3 | 2023-12-18 | Dell NetWorker Virtual Edition versions 19.8 and below contain the use of deprecated cryptographic algorithms in the SSH component. A remote unauthenticated a… |
CVE-2022-43843 | Medium | 5.9 | 2023-12-14 | IBM Spectrum Scale 5.1.5.0 through 5.1.5.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informat… |