CWE-327 · Use of a Broken or Risky Cryptographic Algorithm (page 5)
Page 5 of 8 — CVEs classified under CWE-327, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-39076 | High | 7.5 | 2022-04-19 | IBM Security Guardium 10.5 and 11.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive information. IBM X-For… |
CVE-2022-22559 | High | 7.5 | 2022-04-12 | Dell PowerScale OneFS, version 9.3.0, contains a use of a broken or risky cryptographic algorithm. An unprivileged network attacker could exploit this vulnerab… |
CVE-2022-1252 | High | 8.2 | 2022-04-11 | Use of a Broken or Risky Cryptographic Algorithm in GitHub repository gnuboard/gnuboard5 prior to and including 5.5.5. A vulnerability in gnuboard v5.5.5 and b… |
CVE-2022-26854 | High | 8.1 | 2022-04-08 | Dell PowerScale OneFS, versions 8.2.x-9.2.x, contain risky cryptographic algorithms. A remote unprivileged malicious attacker could potentially exploit this vu… |
CVE-2021-32593 | Medium | 6.5 | 2022-04-06 | A use of a broken or risky cryptographic algorithm vulnerability [CWE-327] in the Dynamic Tunnel Protocol of FortiWAN before 4.5.9 may allow an unauthenticated… |
CVE-2021-33018 | High | 7.5 | 2022-04-01 | The use of a broken or risky cryptographic algorithm in Philips Vue PACS versions 12.2.x.x and prior is an unnecessary risk that may result in the exposure of… |
CVE-2022-22327 | High | 7.5 | 2022-04-01 | IBM UrbanCode Deploy (UCD) 7.0.5, 7.1.0, 7.1.1, and 7.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sen… |
CVE-2022-25218 | High | 8.1 | 2022-03-10 | The use of the RSA algorithm without OAEP, or any other padding scheme, in telnetd_startup, allows an unauthenticated attacker on the local area network to ach… |
CVE-2021-27756 | High | 7.5 | 2022-03-04 | "TLS-RSA cipher suites are not disabled in BigFix Compliance up to v2.0.5. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record… |
CVE-2021-43774 | Medium | 4.9 | 2022-03-03 | A risky-algorithm issue was discovered on Fujifilm DocuCentre-VI C4471 1.8 devices. An attacker that obtained access to the administrative web interface of a p… |
CVE-2022-0377 | Medium | 4.3 | 2022-02-28 | Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. After this process the user crops and sa… |
CVE-2020-36516 | Medium | 5.9 | 2022-02-26 | An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an off-path att… |
CVE-2022-21800 | Medium | 6.5 | 2022-02-18 | MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 uses the MD5 a… |
CVE-2013-20003 | High | 8.3 | 2022-02-04 | Z-Wave devices from Sierra Designs (circa 2013) and Silicon Labs (using S0 security) may use a known, shared network key of all zeros, allowing an attacker wit… |
CVE-2021-41835 | High | 7.3 | 2022-01-21 | Fresenius Kabi Agilia Link + version 3.0 does not enforce transport layer encryption. Therefore, transmitted data may be sent in cleartext. Transport layer enc… |
CVE-2021-33846 | Medium | 5.9 | 2022-01-21 | Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 issues authentication tokens to authenticated users that are signed with a symmetr… |
CVE-2021-31562 | Medium | 6.5 | 2022-01-21 | The SSL/TLS configuration of Fresenius Kabi Agilia Link + version 3.0 has serious deficiencies that may allow an attacker to compromise SSL/TLS sessions in dif… |
CVE-2021-40006 | Medium | 4.6 | 2022-01-10 | Vulnerability of design defects in the security algorithm component. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2021-38921 | High | 7.5 | 2022-01-10 | IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive… |
CVE-2021-38542 | Medium | 5.9 | 2022-01-04 | Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle comma… |
CVE-2021-42583 | High | 7.5 | 2021-12-28 | A Broken or Risky Cryptographic Algorithm exists in Max Mazurov Maddy before 0.5.2, which is an unnecessary risk that may result in the exposure of sensitive i… |
CVE-2021-43550 | Medium | 5.9 | 2021-12-27 | The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information, which affects the communi… |
CVE-2021-45696 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the sha2 crate 0.9.7 before 0.9.8 for Rust. Hashes of long messages may be incorrect when the AVX2-accelerated backend is used. |
CVE-2021-45512 | High | 8.6 | 2021-12-26 | Certain NETGEAR devices are affected by weak cryptography. This affects D7000v2 before 1.0.0.62, D8500 before 1.0.3.50, EX3700 before 1.0.0.84, EX3800 before 1… |
CVE-2021-45486 | Low | 3.5 | 2021-12-25 | In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash table is very small. |
CVE-2021-45485 | High | 7.5 | 2021-12-25 | In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of certain use of a hash table which, alth… |
CVE-2021-43989 | High | 7.5 | 2021-12-23 | mySCADA myPRO Versions 8.20.0 and prior stores passwords using MD5, which may allow an attacker to crack the previously retrieved password hashes. |
CVE-2017-2488 | High | 7.5 | 2021-12-23 | A cryptographic weakness existed in the authentication protocol of Remote Desktop. This issue was addressed by implementing the Secure Remote Password authenti… |
CVE-2021-45451 | High | 7.5 | 2021-12-21 | In Mbed TLS before 3.1.0, psa_aead_generate_nonce allows policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to a… |
CVE-2021-45450 | High | 7.5 | 2021-12-21 | In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psa_cipher_generate_iv and psa_cipher_encrypt allow policy bypass or oracle-based decryption when the output bu… |
CVE-2021-39058 | High | 7.5 | 2021-12-13 | IBM Spectrum Copy Data Management 2.2.13 and earlier uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitiv… |
CVE-2021-39002 | High | 7.5 | 2021-12-09 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 uses weaker than expected cryptographic algorithms that could… |
CVE-2021-43808 | Medium | 5.3 | 2021-12-08 | Laravel is a web application framework. Laravel prior to versions 8.75.0, 7.30.6, and 6.20.42 contain a possible cross-site scripting (XSS) vulnerability in th… |
CVE-2021-22170 | Medium | 6.2 | 2021-12-06 | Assuming a database breach, nonce reuse issues in GitLab 11.6+ allows an attacker to decrypt some of the database's encrypted content |
CVE-2021-22356 | Medium | 5.9 | 2021-11-23 | There is a weak secure algorithm vulnerability in Huawei products. A weak secure algorithm is used in a module. Attackers can exploit this vulnerability by cap… |
CVE-2021-41278 | Medium | 5.7 | 2021-11-19 | Functions SDK for EdgeX is meant to provide all the plumbing necessary for developers to get started in processing/transforming/exporting data out of the EdgeX… |
CVE-2021-41263 | High | 8.3 | 2021-11-15 | rails_multisite provides multi-db support for Rails applications. In affected versions this vulnerability impacts any Rails applications using `rails_multisite… |
CVE-2021-39182 | High | 7.5 | 2021-11-08 | EnroCrypt is a Python module for encryption and hashing. Prior to version 1.1.4, EnroCrypt used the MD5 hashing algorithm in the hashing file. Beginners who ar… |
CVE-2020-14264 | Low | 3.9 | 2021-10-25 | "HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK" |
CVE-2021-41168 | Medium | 6.5 | 2021-10-21 | Snudown is a reddit-specific fork of the Sundown Markdown parser used by GitHub, with Python integration added. In affected versions snudown was found to be vu… |
CVE-2021-31352 | Medium | 5.3 | 2021-10-19 | An Information Exposure vulnerability in Juniper Networks SRC Series devices configured for NETCONF over SSH permits the negotiation of weak ciphers, which cou… |
CVE-2021-36298 | High | 8.1 | 2021-10-01 | Dell EMC InsightIQ, versions prior to 4.1.4, contain risky cryptographic algorithms in the SSH component. A remote unauthenticated attacker could potentially e… |
CVE-2021-29894 | High | 7.5 | 2021-09-30 | IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to dec… |
CVE-2021-41096 | High | 7.5 | 2021-09-27 | Rucky is a USB HID Rubber Ducky Launch Pad for Android. Versions 2.2 and earlier for release builds and versions 425 and earlier for nightly builds suffer from… |
CVE-2021-29750 | High | 7.5 | 2021-09-15 | IBM QRadar SIEM 7.3 and 7.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Forc… |
CVE-2021-40530 | Medium | 5.9 | 2021-09-06 | The ElGamal implementation in Crypto++ through 8.5 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangero… |
CVE-2021-40529 | Medium | 5.9 | 2021-09-06 | The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between tw… |
CVE-2021-40528 | Medium | 5.9 | 2021-09-06 | The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dange… |
CVE-2021-31796 | High | 7.5 | 2021-09-02 | An inadequate encryption vulnerability discovered in CyberArk Credential Provider before 12.1 may lead to Information Disclosure. An attacker may realistically… |
CVE-2021-33003 | Medium | 5.5 | 2021-08-30 | Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to retrieve passwords in cleartext due to a weak hashing algorithm. |
CVE-2021-29723 | High | 7.5 | 2021-08-30 | IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly… |
CVE-2021-29722 | High | 7.5 | 2021-08-30 | IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly… |
CVE-2021-27913 | Low | 3.5 | 2021-08-30 | The function mt_rand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker ca… |
CVE-2021-29704 | High | 7.5 | 2021-08-23 | IBM Security SOAR uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. |
CVE-2020-36363 | Critical | 9.8 | 2021-08-12 | Amazon AWS CloudFront TLSv1.2_2019 allows TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 and TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, which some entities consider to be w… |
CVE-2019-25052 | Critical | 9.1 | 2021-08-11 | In Linaro OP-TEE before 3.7.0, by using inconsistent or malformed data, it is possible to call update and final cryptographic functions directly, causing a cra… |
CVE-2021-37546 | Medium | 5.3 | 2021-08-06 | In JetBrains TeamCity before 2021.1, an insecure key generation mechanism for encrypted properties was used. |
CVE-2021-37588 | Medium | 5.9 | 2021-07-30 | In Charm 0.43, any two users can collude to achieve the ability to decrypt YCT14 data. |
CVE-2021-37587 | Medium | 6.5 | 2021-07-30 | In Charm 0.43, any single user can decrypt DAC-MACS or MA-ABE-YJ14 data. |
CVE-2021-20337 | High | 7.5 | 2021-07-26 | IBM QRadar SIEM 7.3.0 to 7.3.3 Patch 8 and 7.4.0 to 7.4.3 GA uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly… |
CVE-2021-2351 | High | 8.3 | 2021-07-21 | Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Diffi… |
CVE-2021-20497 | High | 7.5 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informatio… |
CVE-2021-34687 | Medium | 5.3 | 2021-07-15 | iDrive RemotePC before 7.6.48 on Windows allows information disclosure. A man in the middle can recover a system's Personal Key when a client attempts to make… |
CVE-2021-29794 | High | 7.5 | 2021-07-12 | IBM Tivoli Netcool/Impact 7.1.0.20 and 7.1.0.21 uses an insecure SSH server configuration which enables weaker than expected cryptographic algorithms that coul… |
CVE-2021-20379 | High | 7.5 | 2021-07-07 | IBM Guardium Data Encryption (GDE) 3.0.0.3 and 4.0.0.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensit… |
CVE-2021-20566 | High | 7.5 | 2021-06-16 | IBM Resilient SOAR V38.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force I… |
CVE-2021-22212 | Medium | 4.0 | 2021-06-08 | ntpkeygen can generate keys that ntpd fails to parse. NTPsec 1.2.0 allows ntpkeygen to generate keys with '#' characters. ntpd then either pads, shortens the k… |
CVE-2020-26515 | High | 7.5 | 2021-06-08 | An insufficiently protected credentials issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The remember-me cookie (CB_LOGIN) issued by the a… |
CVE-2021-22738 | Critical | 9.8 | 2021-05-26 | Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior that could cause unauthorized a… |
CVE-2021-20419 | High | 7.5 | 2021-05-24 | IBM Security Guardium 11.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force… |
CVE-2021-27457 | High | 7.5 | 2021-05-20 | A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected products utilize a weak encryption algorithm for… |
CVE-2020-26140 | Medium | 6.5 | 2021-05-11 | An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext frames in a prote… |
CVE-2020-24588 | Low | 3.5 | 2021-05-11 | The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the… |
CVE-2020-24587 | Low | 2.6 | 2021-05-11 | The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments of a fram… |
CVE-2021-29694 | High | 7.5 | 2021-04-26 | IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive inf… |
CVE-2020-4965 | High | 7.5 | 2021-04-12 | IBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-For… |
CVE-2020-36315 | Medium | 5.3 | 2021-04-07 | In RELIC before 2020-08-01, RSA PKCS#1 v1.5 signature forgery can occur because certain checks of the padding (and of the first two bytes) are inadequate. NOTE… |
CVE-2021-20305 | High | 8.1 | 2021-04-05 | A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Cur… |
CVE-2021-3446 | Medium | 5.5 | 2021-03-25 | A flaw was found in libtpms in versions before 0.8.2. The commonly used integration of libtpms with OpenSSL contained a vulnerability related to the returned I… |
CVE-2019-14852 | High | 7.5 | 2021-03-18 | A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol. An attacker could target traffic using this weaker protocol and break its encry… |
CVE-2020-4831 | High | 7.5 | 2021-03-12 | IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive inf… |
CVE-2021-20441 | Medium | 5.9 | 2021-03-03 | IBM Security Verify Bridge uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force… |
CVE-2020-12702 | Medium | 4.6 | 2021-02-24 | Weak encryption in the Quick Pairing mode in the eWeLink mobile application (Android application V4.9.2 and earlier, iOS application V4.9.1 and earlier) allows… |
CVE-2021-23839 | Low | 3.7 | 2021-02-16 | OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both SSLv2 and more recent SSL and TLS versio… |
CVE-2021-20406 | Low | 2.2 | 2021-02-12 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensiti… |
CVE-2020-25493 | High | 7.5 | 2021-02-11 | Oclean Mobile Application 2.1.2 communicates with an external website using HTTP so it is possible to eavesdrop the network traffic. The content of HTTP payloa… |
CVE-2020-14246 | High | 7.5 | 2021-02-04 | HCL OneTest Performance V9.5, V10.0, V10.1 uses basic authentication which is relatively weak. An attacker could potentially decode the encoded credentials. |
CVE-2021-25763 | Medium | 5.3 | 2021-02-03 | In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default. |
CVE-2020-28498 | Medium | 6.8 | 2021-02-02 | The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm t… |
CVE-2020-29536 | Medium | 4.3 | 2021-01-29 | Archer before 6.8 P2 (6.8.0.2) is affected by a path exposure vulnerability. A remote authenticated malicious attacker with access to service files may obtain… |
CVE-2020-36201 | High | 7.5 | 2021-01-26 | An issue was discovered in certain Xerox WorkCentre products. They do not properly encrypt passwords. This affects 3655, 3655i, 58XX, 58XXi 59XX, 59XXi, 6655… |
CVE-2020-23162 | High | 7.5 | 2021-01-26 | Sensitive information disclosure and weak encryption in Pyrescom Termod4 time management devices before 10.04k allows remote attackers to read a session-file a… |
CVE-2020-4968 | Medium | 6.5 | 2021-01-21 | IBM Security Identity Governance and Intelligence 5.2.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensi… |
CVE-2020-20949 | Medium | 5.9 | 2021-01-20 | Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in STM32 cryptographic firmware library software expansion for STM32Cube (UM1924). The vulnerability ca… |
CVE-2020-20950 | Medium | 5.9 | 2021-01-19 | Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in Microchip Libraries for Applications 2018-11-26 All up to 2018-11-26. The vulnerability can allow on… |
CVE-2013-1053 | Medium | 5.5 | 2021-01-13 | In crypt.c of remote-login-service, the cryptographic algorithm used to cache usernames and passwords is insecure. An attacker could use this vulnerability to… |
CVE-2020-4596 | High | 7.5 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. I… |
CVE-2020-4595 | High | 7.5 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. I… |
CVE-2020-4594 | High | 7.5 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. I… |
CVE-2020-4898 | High | 7.5 | 2021-01-07 | IBM Emptoris Strategic Supply Management 10.1.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive inf… |