CWE-327 · Use of a Broken or Risky Cryptographic Algorithm (page 4)
Page 4 of 7 — CVEs classified under CWE-327, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-37464 | High | 8.6 | 2023-07-14 | OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length f… |
CVE-2023-34130 | Critical | 9.8 | 2023-07-13 | SonicWall GMS and Analytics use outdated Tiny Encryption Algorithm (TEA) with a hardcoded key to encrypt sensitive data. This issue affects GMS: 9.3.2-SP1 and… |
CVE-2023-21399 | High | 7.8 | 2023-07-13 | there is a possible way to bypass cryptographic assurances due to a logic error in the code. This could lead to local escalation of privilege with no additiona… |
CVE-2023-32043 | Medium | 6.8 | 2023-07-11 | Windows Remote Desktop Security Feature Bypass Vulnerability |
CVE-2023-36749 | High | 7.4 | 2023-07-11 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2023-35890 | Medium | 5.1 | 2023-07-07 | IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security, caused by the improper encoding in a local configuration file. IBM X… |
CVE-2023-36608 | Medium | 6.5 | 2023-07-03 | The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm. |
CVE-2023-26276 | Medium | 5.9 | 2023-06-27 | IBM QRadar SIEM 7.5.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID… |
CVE-2023-28006 | High | 7.0 | 2023-06-22 | The OSD Bare Metal Server uses a cryptographic algorithm that is no longer considered sufficiently secure. |
CVE-2023-21115 | High | 8.8 | 2023-06-15 | In btm_sec_encrypt_change of btm_sec.cc, there is a possible way to downgrade the link key type due to improperly used crypto. This could lead to paired device… |
CVE-2022-43949 | Medium | 6.2 | 2023-06-13 | A use of a broken or risky cryptographic algorithm [CWE-327] in Fortinet FortiSIEM before 6.7.1 allows a remote unauthenticated attacker to perform brute forc… |
CVE-2023-28043 | Medium | 6.5 | 2023-06-01 | Dell SCG 5.14 contains an information disclosure vulnerability during the SRS to SCG upgrade path. A remote low privileged malicious user could potentially ex… |
CVE-2023-2900 | Low | 3.7 | 2023-05-25 | A vulnerability was found in NFine Rapid Development Platform 20230511. It has been classified as problematic. Affected is an unknown function of the file /Log… |
CVE-2023-28076 | Medium | 5.9 | 2023-05-16 | CloudLink 7.1.2 and all prior versions contain a broken or risky cryptographic algorithm vulnerability. An unauthenticated remote attacker could potentially e… |
CVE-2022-36937 | Critical | 9.8 | 2023-05-10 | HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS1.0 has numerous published vulnera… |
CVE-2022-22313 | Medium | 4.4 | 2023-05-06 | IBM QRadar Data Synchronization App 1.0 through 3.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensiti… |
CVE-2022-45858 | Medium | 4.2 | 2023-05-03 | A use of a weak cryptographic algorithm vulnerability [CWE-327] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.0 all versions, 8.8.0 all versions, 8.7.0 all… |
CVE-2023-30441 | High | 7.5 | 2023-04-29 | IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination… |
CVE-2023-27557 | Medium | 5.9 | 2023-04-28 | IBM Counter Fraud Management for Safer Payments 6.1.0.00 through 6.1.1.02, 6.2.0.00 through 6.2.2.02, 6.3.0.00 through 6.3.1.02, 6.4.0.00 through 6.4.2.01, and… |
CVE-2022-40722 | High | 7.7 | 2023-04-25 | A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to… |
CVE-2022-45170 | Medium | 6.5 | 2023-04-14 | An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Cryptographic Issue can occur under the /api/v1/vencrypt/decrypt/file endpoint. A malici… |
CVE-2023-28244 | High | 8.1 | 2023-04-11 | Windows Kerberos Elevation of Privilege Vulnerability |
CVE-2023-28509 | High | 7.5 | 2023-03-29 | Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 use weak encryption for packet… |
CVE-2023-22812 | High | 7.4 | 2023-03-24 | SanDisk PrivateAccess versions prior to 6.4.9 support insecure TLS 1.0 and TLS 1.1 protocols which are susceptible to man-in-the-middle attacks thereby comprom… |
CVE-2023-23040 | High | 7.5 | 2023-02-22 | TP-Link router TL-WR940N V6 3.19.1 Build 180119 uses a deprecated MD5 algorithm to hash the admin password used for basic authentication. |
CVE-2023-23695 | Medium | 5.9 | 2023-02-17 | Dell Secure Connect Gateway (SCG) version 5.14.00.12 contains a broken cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentia… |
CVE-2022-22564 | Medium | 5.9 | 2023-02-14 | Dell EMC Unity versions before 5.2.0.0.5.173 , use(es) broken cryptographic algorithm. A remote unauthenticated attacker could potentially exploit this vulnera… |
CVE-2022-34444 | Medium | 5.9 | 2023-02-11 | Dell PowerScale OneFS, versions 9.2.0.x through 9.4.0.x contain an information vulnerability. A remote unauthenticated attacker may potentially exploit this v… |
CVE-2022-35720 | Low | 2.3 | 2023-02-08 | IBM Sterling External Authentication Server 6.1.0 and IBM Sterling Secure Proxy 6.0.3 uses weaker than expected cryptographic algorithms during installation th… |
CVE-2023-0452 | Critical | 9.8 | 2023-01-26 | Econolite EOS versions prior to 3.2.23 use a weak hash algorithm for encrypting privileged user credentials. A configuration file that is accessible without au… |
CVE-2022-43917 | Medium | 5.9 | 2023-01-26 | IBM WebSphere Application Server 8.5 and 9.0 traditional container uses weaker than expected cryptographic keys that could allow an attacker to decrypt sensit… |
CVE-2022-22462 | Low | 3.7 | 2023-01-26 | IBM Security Verify Governance, Identity Manager virtual appliance component 10.0.1 uses weaker than expected cryptographic algorithms that could allow an att… |
CVE-2023-0296 | Medium | 5.3 | 2023-01-17 | The Birthday attack against 64-bit block ciphers flaw (CVE-2016-2183) was reported for the health checks port (9979) on etcd grpc-proxy component. Even though… |
CVE-2021-36647 | Medium | 4.7 | 2023-01-17 | Use of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp_mod() in lignum.c in Mbed TLS Mbed TLS all versions before 3.0.0, 2.27.0 or 2… |
CVE-2022-23539 | Medium | 5.9 | 2022-12-23 | Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA ke… |
CVE-2022-22461 | Medium | 5.9 | 2022-12-22 | IBM Security Verify Governance, Identity Manager 10.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sens… |
CVE-2022-38391 | Medium | 5.1 | 2022-12-20 | IBM Spectrum Control 5.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force… |
CVE-2022-4610 | Low | 1.9 | 2022-12-19 | A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected by thi… |
CVE-2022-46834 | Medium | 6.5 | 2022-12-13 | Use of a Broken or Risky Cryptographic Algorithm in SICK RFU65x firmware version < v2.21 allows a low-privileged remote attacker to decrypt the encrypted data… |
CVE-2022-46833 | Medium | 6.5 | 2022-12-13 | Use of a Broken or Risky Cryptographic Algorithm in SICK RFU63x firmware version < v2.21 allows a low-privileged remote attacker to decrypt the encrypted data… |
CVE-2022-46832 | Medium | 6.5 | 2022-12-13 | Use of a Broken or Risky Cryptographic Algorithm in SICK RFU62x firmware version < 2.21 allows a low-privileged remote attacker to decrypt the encrypted data i… |
CVE-2022-46140 | Medium | 6.5 | 2022-12-13 | Affected devices use a weak encryption scheme to encrypt the debug zip file. This could allow an authenticated attacker to decrypt the contents of the file and… |
CVE-2022-27581 | Medium | 6.5 | 2022-12-13 | Use of a Broken or Risky Cryptographic Algorithm in SICK RFU61x firmware version <v2.25 allows a low-privileged remote attacker to decrypt the encrypted data i… |
CVE-2022-34361 | Medium | 5.9 | 2022-12-06 | IBM Sterling Secure Proxy 6.0.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X… |
CVE-2022-34320 | Medium | 5.9 | 2022-11-14 | IBM CICS TX 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 2294… |
CVE-2022-34319 | Medium | 5.9 | 2022-11-14 | IBM CICS TX 11.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 229… |
CVE-2022-45195 | Medium | 5.3 | 2022-11-12 | SimpleXMQ before 3.4.0, as used in SimpleX Chat before 4.2, does not apply a key derivation function to intended data, which can interfere with forward secrecy… |
CVE-2021-27784 | Medium | 5.9 | 2022-10-31 | The provided HCL Launch Container images contain non-unique HTTPS certificates and a database encryption key. The fix provides directions and tools to replace… |
CVE-2022-39237 | Medium | 6.3 | 2022-10-06 | syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did… |
CVE-2022-2781 | Medium | 5.3 | 2022-10-06 | In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables. |
CVE-2022-35513 | High | 7.5 | 2022-09-07 | The Blink1Control2 application <= 2.2.7 uses weak password encryption and an insecure method of storage. |
CVE-2022-37177 | High | 7.5 | 2022-08-29 | HireVue Hiring Platform V1.0 suffers from Use of a Broken or Risky Cryptographic Algorithm. NOTE: this is disputed by the vendor for multiple reasons, e.g., it… |
CVE-2021-3979 | Medium | 6.5 | 2022-08-25 | A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectly passed in an encryption algorithm to c… |
CVE-2022-38493 | High | 7.5 | 2022-08-20 | Rhonabwy 0.9.99 through 1.1.x before 1.1.7 doesn't check the RSA private key length before RSA-OAEP decryption. This allows attackers to cause a Denial of Serv… |
CVE-2022-30320 | Medium | 4.3 | 2022-07-28 | Saia Burgess Controls (SBC) PCD through 2022-05-06 uses a Broken or Risky Cryptographic Algorithm. According to FSCT-2022-0063, there is a Saia Burgess Control… |
CVE-2022-30273 | Critical | 9.8 | 2022-07-26 | The Motorola MDLC protocol through 2022-05-02 mishandles message integrity. It supports three security modes: Plain, Legacy Encryption, and New Encryption. In… |
CVE-2022-29965 | Medium | 5.5 | 2022-07-26 | The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. Access to privileged operations on the mainte… |
CVE-2022-34632 | Critical | 9.1 | 2022-07-18 | Rocket-Chip commit 4f8114374d8824dfdec03f576a8cd68bebce4e56 was discovered to contain insufficient cryptography via the component /rocket/RocketCore.scala. |
CVE-2022-31157 | High | 7.5 | 2022-07-15 | LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the function used to generate random non… |
CVE-2022-34757 | Medium | 6.7 | 2022-07-13 | A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists where weak cipher suites can be used for the SSH connection between Easergy Pr… |
CVE-2022-30187 | Medium | 4.7 | 2022-07-12 | Azure Storage Library Information Disclosure Vulnerability |
CVE-2022-2097 | Medium | 5.3 | 2022-07-05 | AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. Th… |
CVE-2022-31230 | High | 8.1 | 2022-06-28 | Dell PowerScale OneFS, versions 8.2.x-9.2.x, contain broken or risky cryptographic algorithm. A remote unprivileged malicious attacker could potentially exploi… |
CVE-2022-28622 | High | 7.5 | 2022-06-27 | A potential security vulnerability has been identified in HPE StoreOnce Software. The SSH server supports weak key exchange algorithms which could lead to remo… |
CVE-2022-28166 | High | 7.5 | 2022-06-27 | In Brocade SANnav version before SANN2.2.0.2 and Brocade SANNav before 2.1.1.8, the implementation of TLS/SSL Server Supports the Use of Static Key Ciphers (ss… |
CVE-2022-28382 | High | 7.5 | 2022-06-08 | An issue was discovered in certain Verbatim drives through 2022-03-31. Due to the use of an insecure encryption AES mode (Electronic Codebook, aka ECB), an att… |
CVE-2022-24296 | High | 7.5 | 2022-06-08 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in Air Conditioning System G-150AD Ver. 3.21 and prior, Air Conditioning System AG-150A-A Ver. 3… |
CVE-2022-29249 | High | 7.5 | 2022-05-24 | JavaEZ is a library that adds new functions to make Java easier. A weakness in JavaEZ 1.6 allows force decryption of locked text by unauthorized actors. The is… |
CVE-2022-29217 | High | 7.4 | 2022-05-24 | PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choo… |
CVE-2022-30111 | Medium | 6.8 | 2022-05-18 | Due to the use of an insecure algorithm for rolling codes in MCK Smartlock 1.0, allows attackers to unlock the mechanism via replay attacks. |
CVE-2022-20117 | Medium | 5.5 | 2022-05-10 | In (TBD) of (TBD), there is a possible way to decrypt local data encrypted by the GSC due to improperly used crypto. This could lead to local information discl… |
CVE-2021-20479 | High | 7.5 | 2022-05-09 | IBM Cloud Pak System 2.3.0 through 2.3.3.3 Interim Fix 1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sens… |
CVE-2022-28164 | Medium | 6.5 | 2022-05-06 | Brocade SANnav before SANnav 2.2.0 application uses the Blowfish symmetric encryption algorithm for the storage of passwords. This could allow an authenticated… |
CVE-2022-29161 | Medium | 5.4 | 2022-05-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The XWiki Crypto API will generate X509 certificates s… |
CVE-2022-1434 | Medium | 5.9 | 2022-05-03 | The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attack… |
CVE-2021-39082 | High | 7.5 | 2022-04-29 | IBM UrbanCode Deploy (UCD) 7.1.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. |
CVE-2022-20805 | Medium | 4.1 | 2022-04-21 | A vulnerability in the automatic decryption process in Cisco Umbrella Secure Web Gateway (SWG) could allow an authenticated, adjacent attacker to bypass the SS… |
CVE-2021-39076 | High | 7.5 | 2022-04-19 | IBM Security Guardium 10.5 and 11.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive information. IBM X-For… |
CVE-2022-22559 | High | 7.5 | 2022-04-12 | Dell PowerScale OneFS, version 9.3.0, contains a use of a broken or risky cryptographic algorithm. An unprivileged network attacker could exploit this vulnerab… |
CVE-2022-1252 | High | 8.2 | 2022-04-11 | Use of a Broken or Risky Cryptographic Algorithm in GitHub repository gnuboard/gnuboard5 prior to and including 5.5.5. A vulnerability in gnuboard v5.5.5 and b… |
CVE-2022-26854 | High | 8.1 | 2022-04-08 | Dell PowerScale OneFS, versions 8.2.x-9.2.x, contain risky cryptographic algorithms. A remote unprivileged malicious attacker could potentially exploit this vu… |
CVE-2021-32593 | Medium | 6.5 | 2022-04-06 | A use of a broken or risky cryptographic algorithm vulnerability [CWE-327] in the Dynamic Tunnel Protocol of FortiWAN before 4.5.9 may allow an unauthenticated… |
CVE-2021-33018 | High | 7.5 | 2022-04-01 | The use of a broken or risky cryptographic algorithm in Philips Vue PACS versions 12.2.x.x and prior is an unnecessary risk that may result in the exposure of… |
CVE-2022-22327 | High | 7.5 | 2022-04-01 | IBM UrbanCode Deploy (UCD) 7.0.5, 7.1.0, 7.1.1, and 7.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sen… |
CVE-2022-25218 | High | 8.1 | 2022-03-10 | The use of the RSA algorithm without OAEP, or any other padding scheme, in telnetd_startup, allows an unauthenticated attacker on the local area network to ach… |
CVE-2021-27756 | High | 7.5 | 2022-03-04 | "TLS-RSA cipher suites are not disabled in BigFix Compliance up to v2.0.5. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record… |
CVE-2021-43774 | Medium | 4.9 | 2022-03-03 | A risky-algorithm issue was discovered on Fujifilm DocuCentre-VI C4471 1.8 devices. An attacker that obtained access to the administrative web interface of a p… |
CVE-2022-0377 | Medium | 4.3 | 2022-02-28 | Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. After this process the user crops and sa… |
CVE-2020-36516 | Medium | 5.9 | 2022-02-26 | An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an off-path att… |
CVE-2022-21800 | Medium | 6.5 | 2022-02-18 | MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 uses the MD5 a… |
CVE-2013-20003 | High | 8.3 | 2022-02-04 | Z-Wave devices from Sierra Designs (circa 2013) and Silicon Labs (using S0 security) may use a known, shared network key of all zeros, allowing an attacker wit… |
CVE-2021-41835 | High | 7.3 | 2022-01-21 | Fresenius Kabi Agilia Link + version 3.0 does not enforce transport layer encryption. Therefore, transmitted data may be sent in cleartext. Transport layer enc… |
CVE-2021-33846 | Medium | 5.9 | 2022-01-21 | Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 issues authentication tokens to authenticated users that are signed with a symmetr… |
CVE-2021-31562 | Medium | 6.5 | 2022-01-21 | The SSL/TLS configuration of Fresenius Kabi Agilia Link + version 3.0 has serious deficiencies that may allow an attacker to compromise SSL/TLS sessions in dif… |
CVE-2021-40006 | Medium | 4.6 | 2022-01-10 | Vulnerability of design defects in the security algorithm component. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2021-38921 | High | 7.5 | 2022-01-10 | IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive… |
CVE-2021-38542 | Medium | 5.9 | 2022-01-04 | Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle comma… |
CVE-2021-42583 | High | 7.5 | 2021-12-28 | A Broken or Risky Cryptographic Algorithm exists in Max Mazurov Maddy before 0.5.2, which is an unnecessary risk that may result in the exposure of sensitive i… |
CVE-2021-43550 | Medium | 5.9 | 2021-12-27 | The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information, which affects the communi… |
CVE-2021-45696 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the sha2 crate 0.9.7 before 0.9.8 for Rust. Hashes of long messages may be incorrect when the AVX2-accelerated backend is used. |