CWE-327 · Use of a Broken or Risky Cryptographic Algorithm (page 4)
Page 4 of 8 — CVEs classified under CWE-327, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-27795 | Medium | 6.4 | 2023-12-06 | Brocade Fabric OS (FOS) hardware platforms running any version of Brocade Fabric OS software, which supports the license string format; contain cryptographic… |
CVE-2022-24403 | Medium | 4.3 | 2023-12-05 | The TETRA TA61 identity encryption function internally uses a 64-bit value derived exclusively from the SCK (Class 2 networks) or CCK (Class 3 networks). The s… |
CVE-2023-26024 | Medium | 6.5 | 2023-12-01 | IBM Planning Analytics on Cloud Pak for Data 4.0 could allow an attacker on a shared network to obtain sensitive information caused by insecure network communi… |
CVE-2023-38361 | Medium | 5.9 | 2023-11-18 | IBM CICS TX Advanced 10.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force… |
CVE-2023-47640 | Medium | 6.4 | 2023-11-14 | DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key… |
CVE-2023-5627 | High | 7.5 | 2023-11-01 | A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable. This vulnerability arises from the incorrect implemen… |
CVE-2023-46233 | Critical | 9.1 | 2023-10-25 | crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at… |
CVE-2023-46133 | Critical | 9.1 | 2023-10-25 | CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript. Prior to version 2.1.0, CryptoES PBKDF2 is 1,000 times weaker than originally… |
CVE-2023-30994 | Medium | 5.4 | 2023-10-14 | IBM QRadar SIEM 7.5.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID… |
CVE-2022-33160 | Low | 3.7 | 2023-10-06 | IBM Security Directory Suite 8.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IB… |
CVE-2023-3350 | High | 8.2 | 2023-10-03 | A Cryptographic Issue vulnerability has been found on IBERMATICA RPS, affecting version 2019. By firstly downloading the log file, an attacker could retrieve t… |
CVE-2023-39252 | Medium | 5.9 | 2023-09-21 | Dell SCG Policy Manager 5.16.00.14 contains a broken cryptographic algorithm vulnerability. A remote unauthenticated attacker may potentially exploit this vu… |
CVE-2023-43635 | High | 8.8 | 2023-09-20 | Vault Key Sealed With SHA1 PCRs The measured boot solution implemented in EVE OS leans on a PCR locking mechanism. Different parts of the system update… |
CVE-2023-34039 | Critical | 9.8 | 2023-08-29 | Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. A malicious actor with netwo… |
CVE-2023-34758 | High | 8.1 | 2023-08-28 | Sliver from v1.5.x to v1.5.39 has an improper cryptographic implementation, which allows attackers to execute a man-in-the-middle attack via intercepted and cr… |
CVE-2023-38730 | Medium | 5.9 | 2023-08-27 | IBM Storage Copy Data Management 2.2.0.0 through 2.2.19.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sen… |
CVE-2023-40371 | Medium | 6.2 | 2023-08-24 | IBM AIX 7.2, 7.3, VIOS 3.1's OpenSSH implementation could allow a non-privileged local user to access files outside of those allowed due to improper access con… |
CVE-2023-4331 | High | 7.5 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that support obsolete and vulnerable TLS protocols |
CVE-2023-4326 | High | 7.5 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that supports obsolete SHA1-based ciphersuites |
CVE-2023-23347 | Medium | 6.4 | 2023-08-09 | HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of s… |
CVE-2023-23346 | Medium | 6.4 | 2023-08-09 | HCL DRYiCE MyCloud is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sen… |
CVE-2023-37484 | Medium | 5.3 | 2023-08-08 | SAP PowerDesigner - version 16.7, queries all password hashes in the backend database and compares it with the user provided one during login attempt, which mi… |
CVE-2021-38933 | Medium | 5.9 | 2023-07-19 | IBM Sterling Connect:Direct for UNIX 1.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informatio… |
CVE-2023-37464 | High | 8.6 | 2023-07-14 | OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length f… |
CVE-2023-34130 | Critical | 9.8 | 2023-07-13 | SonicWall GMS and Analytics use outdated Tiny Encryption Algorithm (TEA) with a hardcoded key to encrypt sensitive data. This issue affects GMS: 9.3.2-SP1 and… |
CVE-2023-21399 | High | 7.8 | 2023-07-13 | there is a possible way to bypass cryptographic assurances due to a logic error in the code. This could lead to local escalation of privilege with no additiona… |
CVE-2023-32043 | Medium | 6.8 | 2023-07-11 | Windows Remote Desktop Security Feature Bypass Vulnerability |
CVE-2023-36749 | High | 7.4 | 2023-07-11 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2023-35890 | Medium | 5.1 | 2023-07-07 | IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security, caused by the improper encoding in a local configuration file. IBM X… |
CVE-2023-36608 | Medium | 6.5 | 2023-07-03 | The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm. |
CVE-2023-26276 | Medium | 5.9 | 2023-06-27 | IBM QRadar SIEM 7.5.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID… |
CVE-2023-28006 | High | 7.0 | 2023-06-22 | The OSD Bare Metal Server uses a cryptographic algorithm that is no longer considered sufficiently secure. |
CVE-2023-21115 | High | 8.8 | 2023-06-15 | In btm_sec_encrypt_change of btm_sec.cc, there is a possible way to downgrade the link key type due to improperly used crypto. This could lead to paired device… |
CVE-2022-43949 | Medium | 6.2 | 2023-06-13 | A use of a broken or risky cryptographic algorithm [CWE-327] in Fortinet FortiSIEM before 6.7.1 allows a remote unauthenticated attacker to perform brute forc… |
CVE-2023-28043 | Medium | 6.5 | 2023-06-01 | Dell SCG 5.14 contains an information disclosure vulnerability during the SRS to SCG upgrade path. A remote low privileged malicious user could potentially ex… |
CVE-2023-2900 | Low | 3.7 | 2023-05-25 | A vulnerability was found in NFine Rapid Development Platform 20230511. It has been classified as problematic. Affected is an unknown function of the file /Log… |
CVE-2023-28076 | Medium | 5.9 | 2023-05-16 | CloudLink 7.1.2 and all prior versions contain a broken or risky cryptographic algorithm vulnerability. An unauthenticated remote attacker could potentially e… |
CVE-2022-36937 | Critical | 9.8 | 2023-05-10 | HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS1.0 has numerous published vulnera… |
CVE-2022-22313 | Medium | 4.4 | 2023-05-06 | IBM QRadar Data Synchronization App 1.0 through 3.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensiti… |
CVE-2022-45858 | Medium | 4.2 | 2023-05-03 | A use of a weak cryptographic algorithm vulnerability [CWE-327] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.0 all versions, 8.8.0 all versions, 8.7.0 all… |
CVE-2023-30441 | High | 7.5 | 2023-04-29 | IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination… |
CVE-2023-27557 | Medium | 5.9 | 2023-04-28 | IBM Counter Fraud Management for Safer Payments 6.1.0.00 through 6.1.1.02, 6.2.0.00 through 6.2.2.02, 6.3.0.00 through 6.3.1.02, 6.4.0.00 through 6.4.2.01, and… |
CVE-2022-40722 | High | 7.7 | 2023-04-25 | A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to… |
CVE-2022-45170 | Medium | 6.5 | 2023-04-14 | An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Cryptographic Issue can occur under the /api/v1/vencrypt/decrypt/file endpoint. A malici… |
CVE-2023-28244 | High | 8.1 | 2023-04-11 | Windows Kerberos Elevation of Privilege Vulnerability |
CVE-2023-28509 | High | 7.5 | 2023-03-29 | Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 use weak encryption for packet… |
CVE-2023-22812 | High | 7.4 | 2023-03-24 | SanDisk PrivateAccess versions prior to 6.4.9 support insecure TLS 1.0 and TLS 1.1 protocols which are susceptible to man-in-the-middle attacks thereby comprom… |
CVE-2023-23040 | High | 7.5 | 2023-02-22 | TP-Link router TL-WR940N V6 3.19.1 Build 180119 uses a deprecated MD5 algorithm to hash the admin password used for basic authentication. |
CVE-2023-23695 | Medium | 5.9 | 2023-02-17 | Dell Secure Connect Gateway (SCG) version 5.14.00.12 contains a broken cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentia… |
CVE-2022-22564 | Medium | 5.9 | 2023-02-14 | Dell EMC Unity versions before 5.2.0.0.5.173 , use(es) broken cryptographic algorithm. A remote unauthenticated attacker could potentially exploit this vulnera… |
CVE-2022-34444 | Medium | 5.9 | 2023-02-11 | Dell PowerScale OneFS, versions 9.2.0.x through 9.4.0.x contain an information vulnerability. A remote unauthenticated attacker may potentially exploit this v… |
CVE-2022-35720 | Low | 2.3 | 2023-02-08 | IBM Sterling External Authentication Server 6.1.0 and IBM Sterling Secure Proxy 6.0.3 uses weaker than expected cryptographic algorithms during installation th… |
CVE-2023-0452 | Critical | 9.8 | 2023-01-26 | Econolite EOS versions prior to 3.2.23 use a weak hash algorithm for encrypting privileged user credentials. A configuration file that is accessible without au… |
CVE-2022-43917 | Medium | 5.9 | 2023-01-26 | IBM WebSphere Application Server 8.5 and 9.0 traditional container uses weaker than expected cryptographic keys that could allow an attacker to decrypt sensit… |
CVE-2022-22462 | Low | 3.7 | 2023-01-26 | IBM Security Verify Governance, Identity Manager virtual appliance component 10.0.1 uses weaker than expected cryptographic algorithms that could allow an att… |
CVE-2023-0296 | Medium | 5.3 | 2023-01-17 | The Birthday attack against 64-bit block ciphers flaw (CVE-2016-2183) was reported for the health checks port (9979) on etcd grpc-proxy component. Even though… |
CVE-2021-36647 | Medium | 4.7 | 2023-01-17 | Use of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp_mod() in lignum.c in Mbed TLS Mbed TLS all versions before 3.0.0, 2.27.0 or 2… |
CVE-2022-23539 | Medium | 5.9 | 2022-12-23 | Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA ke… |
CVE-2022-22461 | Medium | 5.9 | 2022-12-22 | IBM Security Verify Governance, Identity Manager 10.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sens… |
CVE-2022-38391 | Medium | 5.1 | 2022-12-20 | IBM Spectrum Control 5.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force… |
CVE-2022-4610 | Low | 1.9 | 2022-12-19 | A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected by thi… |
CVE-2022-46834 | Medium | 6.5 | 2022-12-13 | Use of a Broken or Risky Cryptographic Algorithm in SICK RFU65x firmware version < v2.21 allows a low-privileged remote attacker to decrypt the encrypted data… |
CVE-2022-46833 | Medium | 6.5 | 2022-12-13 | Use of a Broken or Risky Cryptographic Algorithm in SICK RFU63x firmware version < v2.21 allows a low-privileged remote attacker to decrypt the encrypted data… |
CVE-2022-46832 | Medium | 6.5 | 2022-12-13 | Use of a Broken or Risky Cryptographic Algorithm in SICK RFU62x firmware version < 2.21 allows a low-privileged remote attacker to decrypt the encrypted data i… |
CVE-2022-46140 | Medium | 6.5 | 2022-12-13 | Affected devices use a weak encryption scheme to encrypt the debug zip file. This could allow an authenticated attacker to decrypt the contents of the file and… |
CVE-2022-27581 | Medium | 6.5 | 2022-12-13 | Use of a Broken or Risky Cryptographic Algorithm in SICK RFU61x firmware version <v2.25 allows a low-privileged remote attacker to decrypt the encrypted data i… |
CVE-2022-34361 | Medium | 5.9 | 2022-12-06 | IBM Sterling Secure Proxy 6.0.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X… |
CVE-2022-34320 | Medium | 5.9 | 2022-11-14 | IBM CICS TX 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 2294… |
CVE-2022-34319 | Medium | 5.9 | 2022-11-14 | IBM CICS TX 11.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 229… |
CVE-2022-45195 | Medium | 5.3 | 2022-11-12 | SimpleXMQ before 3.4.0, as used in SimpleX Chat before 4.2, does not apply a key derivation function to intended data, which can interfere with forward secrecy… |
CVE-2021-27784 | Medium | 5.9 | 2022-10-31 | The provided HCL Launch Container images contain non-unique HTTPS certificates and a database encryption key. The fix provides directions and tools to replace… |
CVE-2022-39237 | Medium | 6.3 | 2022-10-06 | syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did… |
CVE-2022-2781 | Medium | 5.3 | 2022-10-06 | In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables. |
CVE-2022-35513 | High | 7.5 | 2022-09-07 | The Blink1Control2 application <= 2.2.7 uses weak password encryption and an insecure method of storage. |
CVE-2022-37177 | High | 7.5 | 2022-08-29 | HireVue Hiring Platform V1.0 suffers from Use of a Broken or Risky Cryptographic Algorithm. NOTE: this is disputed by the vendor for multiple reasons, e.g., it… |
CVE-2021-3979 | Medium | 6.5 | 2022-08-25 | A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectly passed in an encryption algorithm to c… |
CVE-2022-38493 | High | 7.5 | 2022-08-20 | Rhonabwy 0.9.99 through 1.1.x before 1.1.7 doesn't check the RSA private key length before RSA-OAEP decryption. This allows attackers to cause a Denial of Serv… |
CVE-2022-30320 | Medium | 4.3 | 2022-07-28 | Saia Burgess Controls (SBC) PCD through 2022-05-06 uses a Broken or Risky Cryptographic Algorithm. According to FSCT-2022-0063, there is a Saia Burgess Control… |
CVE-2022-30273 | Critical | 9.8 | 2022-07-26 | The Motorola MDLC protocol through 2022-05-02 mishandles message integrity. It supports three security modes: Plain, Legacy Encryption, and New Encryption. In… |
CVE-2022-29965 | Medium | 5.5 | 2022-07-26 | The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. Access to privileged operations on the mainte… |
CVE-2022-34632 | Critical | 9.1 | 2022-07-18 | Rocket-Chip commit 4f8114374d8824dfdec03f576a8cd68bebce4e56 was discovered to contain insufficient cryptography via the component /rocket/RocketCore.scala. |
CVE-2022-31157 | High | 7.5 | 2022-07-15 | LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the function used to generate random non… |
CVE-2022-34757 | Medium | 6.7 | 2022-07-13 | A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists where weak cipher suites can be used for the SSH connection between Easergy Pr… |
CVE-2022-30187 | Medium | 4.7 | 2022-07-12 | Azure Storage Library Information Disclosure Vulnerability |
CVE-2022-2097 | Medium | 5.3 | 2022-07-05 | AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. Th… |
CVE-2022-31230 | High | 8.1 | 2022-06-28 | Dell PowerScale OneFS, versions 8.2.x-9.2.x, contain broken or risky cryptographic algorithm. A remote unprivileged malicious attacker could potentially exploi… |
CVE-2022-28622 | High | 7.5 | 2022-06-27 | A potential security vulnerability has been identified in HPE StoreOnce Software. The SSH server supports weak key exchange algorithms which could lead to remo… |
CVE-2022-28166 | High | 7.5 | 2022-06-27 | In Brocade SANnav version before SANN2.2.0.2 and Brocade SANNav before 2.1.1.8, the implementation of TLS/SSL Server Supports the Use of Static Key Ciphers (ss… |
CVE-2022-28382 | High | 7.5 | 2022-06-08 | An issue was discovered in certain Verbatim drives through 2022-03-31. Due to the use of an insecure encryption AES mode (Electronic Codebook, aka ECB), an att… |
CVE-2022-24296 | High | 7.5 | 2022-06-08 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in Air Conditioning System G-150AD Ver. 3.21 and prior, Air Conditioning System AG-150A-A Ver. 3… |
CVE-2022-29249 | High | 7.5 | 2022-05-24 | JavaEZ is a library that adds new functions to make Java easier. A weakness in JavaEZ 1.6 allows force decryption of locked text by unauthorized actors. The is… |
CVE-2022-29217 | High | 7.4 | 2022-05-24 | PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choo… |
CVE-2022-30111 | Medium | 6.8 | 2022-05-18 | Due to the use of an insecure algorithm for rolling codes in MCK Smartlock 1.0, allows attackers to unlock the mechanism via replay attacks. |
CVE-2022-20117 | Medium | 5.5 | 2022-05-10 | In (TBD) of (TBD), there is a possible way to decrypt local data encrypted by the GSC due to improperly used crypto. This could lead to local information discl… |
CVE-2021-20479 | High | 7.5 | 2022-05-09 | IBM Cloud Pak System 2.3.0 through 2.3.3.3 Interim Fix 1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sens… |
CVE-2022-28164 | Medium | 6.5 | 2022-05-06 | Brocade SANnav before SANnav 2.2.0 application uses the Blowfish symmetric encryption algorithm for the storage of passwords. This could allow an authenticated… |
CVE-2022-29161 | Medium | 5.4 | 2022-05-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The XWiki Crypto API will generate X509 certificates s… |
CVE-2022-1434 | Medium | 5.9 | 2022-05-03 | The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attack… |
CVE-2021-39082 | High | 7.5 | 2022-04-29 | IBM UrbanCode Deploy (UCD) 7.1.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. |
CVE-2022-20805 | Medium | 4.1 | 2022-04-21 | A vulnerability in the automatic decryption process in Cisco Umbrella Secure Web Gateway (SWG) could allow an authenticated, adjacent attacker to bypass the SS… |