CWE-327 · Use of a Broken or Risky Cryptographic Algorithm (page 5)
Page 5 of 7 — CVEs classified under CWE-327, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-45512 | High | 8.6 | 2021-12-26 | Certain NETGEAR devices are affected by weak cryptography. This affects D7000v2 before 1.0.0.62, D8500 before 1.0.3.50, EX3700 before 1.0.0.84, EX3800 before 1… |
CVE-2021-45486 | Low | 3.5 | 2021-12-25 | In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash table is very small. |
CVE-2021-45485 | High | 7.5 | 2021-12-25 | In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of certain use of a hash table which, alth… |
CVE-2021-43989 | High | 7.5 | 2021-12-23 | mySCADA myPRO Versions 8.20.0 and prior stores passwords using MD5, which may allow an attacker to crack the previously retrieved password hashes. |
CVE-2017-2488 | High | 7.5 | 2021-12-23 | A cryptographic weakness existed in the authentication protocol of Remote Desktop. This issue was addressed by implementing the Secure Remote Password authenti… |
CVE-2021-45451 | High | 7.5 | 2021-12-21 | In Mbed TLS before 3.1.0, psa_aead_generate_nonce allows policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to a… |
CVE-2021-45450 | High | 7.5 | 2021-12-21 | In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psa_cipher_generate_iv and psa_cipher_encrypt allow policy bypass or oracle-based decryption when the output bu… |
CVE-2021-39058 | High | 7.5 | 2021-12-13 | IBM Spectrum Copy Data Management 2.2.13 and earlier uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitiv… |
CVE-2021-39002 | High | 7.5 | 2021-12-09 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 uses weaker than expected cryptographic algorithms that could… |
CVE-2021-43808 | Medium | 5.3 | 2021-12-08 | Laravel is a web application framework. Laravel prior to versions 8.75.0, 7.30.6, and 6.20.42 contain a possible cross-site scripting (XSS) vulnerability in th… |
CVE-2021-22170 | Medium | 6.2 | 2021-12-06 | Assuming a database breach, nonce reuse issues in GitLab 11.6+ allows an attacker to decrypt some of the database's encrypted content |
CVE-2021-22356 | Medium | 5.9 | 2021-11-23 | There is a weak secure algorithm vulnerability in Huawei products. A weak secure algorithm is used in a module. Attackers can exploit this vulnerability by cap… |
CVE-2021-41278 | Medium | 5.7 | 2021-11-19 | Functions SDK for EdgeX is meant to provide all the plumbing necessary for developers to get started in processing/transforming/exporting data out of the EdgeX… |
CVE-2021-41263 | High | 8.3 | 2021-11-15 | rails_multisite provides multi-db support for Rails applications. In affected versions this vulnerability impacts any Rails applications using `rails_multisite… |
CVE-2021-39182 | High | 7.5 | 2021-11-08 | EnroCrypt is a Python module for encryption and hashing. Prior to version 1.1.4, EnroCrypt used the MD5 hashing algorithm in the hashing file. Beginners who ar… |
CVE-2020-14264 | Low | 3.9 | 2021-10-25 | "HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK" |
CVE-2021-41168 | Medium | 6.5 | 2021-10-21 | Snudown is a reddit-specific fork of the Sundown Markdown parser used by GitHub, with Python integration added. In affected versions snudown was found to be vu… |
CVE-2021-31352 | Medium | 5.3 | 2021-10-19 | An Information Exposure vulnerability in Juniper Networks SRC Series devices configured for NETCONF over SSH permits the negotiation of weak ciphers, which cou… |
CVE-2021-36298 | High | 8.1 | 2021-10-01 | Dell EMC InsightIQ, versions prior to 4.1.4, contain risky cryptographic algorithms in the SSH component. A remote unauthenticated attacker could potentially e… |
CVE-2021-29894 | High | 7.5 | 2021-09-30 | IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to dec… |
CVE-2021-41096 | High | 7.5 | 2021-09-27 | Rucky is a USB HID Rubber Ducky Launch Pad for Android. Versions 2.2 and earlier for release builds and versions 425 and earlier for nightly builds suffer from… |
CVE-2021-29750 | High | 7.5 | 2021-09-15 | IBM QRadar SIEM 7.3 and 7.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Forc… |
CVE-2021-40530 | Medium | 5.9 | 2021-09-06 | The ElGamal implementation in Crypto++ through 8.5 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangero… |
CVE-2021-40529 | Medium | 5.9 | 2021-09-06 | The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between tw… |
CVE-2021-40528 | Medium | 5.9 | 2021-09-06 | The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dange… |
CVE-2021-31796 | High | 7.5 | 2021-09-02 | An inadequate encryption vulnerability discovered in CyberArk Credential Provider before 12.1 may lead to Information Disclosure. An attacker may realistically… |
CVE-2021-33003 | Medium | 5.5 | 2021-08-30 | Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to retrieve passwords in cleartext due to a weak hashing algorithm. |
CVE-2021-29723 | High | 7.5 | 2021-08-30 | IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly… |
CVE-2021-29722 | High | 7.5 | 2021-08-30 | IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly… |
CVE-2021-27913 | Low | 3.5 | 2021-08-30 | The function mt_rand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker ca… |
CVE-2021-29704 | High | 7.5 | 2021-08-23 | IBM Security SOAR uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. |
CVE-2020-36363 | Critical | 9.8 | 2021-08-12 | Amazon AWS CloudFront TLSv1.2_2019 allows TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 and TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, which some entities consider to be w… |
CVE-2019-25052 | Critical | 9.1 | 2021-08-11 | In Linaro OP-TEE before 3.7.0, by using inconsistent or malformed data, it is possible to call update and final cryptographic functions directly, causing a cra… |
CVE-2021-37546 | Medium | 5.3 | 2021-08-06 | In JetBrains TeamCity before 2021.1, an insecure key generation mechanism for encrypted properties was used. |
CVE-2021-37588 | Medium | 5.9 | 2021-07-30 | In Charm 0.43, any two users can collude to achieve the ability to decrypt YCT14 data. |
CVE-2021-37587 | Medium | 6.5 | 2021-07-30 | In Charm 0.43, any single user can decrypt DAC-MACS or MA-ABE-YJ14 data. |
CVE-2021-20337 | High | 7.5 | 2021-07-26 | IBM QRadar SIEM 7.3.0 to 7.3.3 Patch 8 and 7.4.0 to 7.4.3 GA uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly… |
CVE-2021-2351 | High | 8.3 | 2021-07-21 | Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Diffi… |
CVE-2021-20497 | High | 7.5 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informatio… |
CVE-2021-34687 | Medium | 5.3 | 2021-07-15 | iDrive RemotePC before 7.6.48 on Windows allows information disclosure. A man in the middle can recover a system's Personal Key when a client attempts to make… |
CVE-2021-29794 | High | 7.5 | 2021-07-12 | IBM Tivoli Netcool/Impact 7.1.0.20 and 7.1.0.21 uses an insecure SSH server configuration which enables weaker than expected cryptographic algorithms that coul… |
CVE-2021-20379 | High | 7.5 | 2021-07-07 | IBM Guardium Data Encryption (GDE) 3.0.0.3 and 4.0.0.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensit… |
CVE-2021-20566 | High | 7.5 | 2021-06-16 | IBM Resilient SOAR V38.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force I… |
CVE-2021-22212 | Medium | 4.0 | 2021-06-08 | ntpkeygen can generate keys that ntpd fails to parse. NTPsec 1.2.0 allows ntpkeygen to generate keys with '#' characters. ntpd then either pads, shortens the k… |
CVE-2020-26515 | High | 7.5 | 2021-06-08 | An insufficiently protected credentials issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The remember-me cookie (CB_LOGIN) issued by the a… |
CVE-2021-22738 | Critical | 9.8 | 2021-05-26 | Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior that could cause unauthorized a… |
CVE-2021-20419 | High | 7.5 | 2021-05-24 | IBM Security Guardium 11.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force… |
CVE-2021-27457 | High | 7.5 | 2021-05-20 | A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected products utilize a weak encryption algorithm for… |
CVE-2020-26140 | Medium | 6.5 | 2021-05-11 | An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext frames in a prote… |
CVE-2020-24588 | Low | 3.5 | 2021-05-11 | The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the… |
CVE-2020-24587 | Low | 2.6 | 2021-05-11 | The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments of a fram… |
CVE-2021-29694 | High | 7.5 | 2021-04-26 | IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive inf… |
CVE-2020-4965 | High | 7.5 | 2021-04-12 | IBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-For… |
CVE-2020-36315 | Medium | 5.3 | 2021-04-07 | In RELIC before 2020-08-01, RSA PKCS#1 v1.5 signature forgery can occur because certain checks of the padding (and of the first two bytes) are inadequate. NOTE… |
CVE-2021-20305 | High | 8.1 | 2021-04-05 | A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Cur… |
CVE-2021-3446 | Medium | 5.5 | 2021-03-25 | A flaw was found in libtpms in versions before 0.8.2. The commonly used integration of libtpms with OpenSSL contained a vulnerability related to the returned I… |
CVE-2019-14852 | High | 7.5 | 2021-03-18 | A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol. An attacker could target traffic using this weaker protocol and break its encry… |
CVE-2020-4831 | High | 7.5 | 2021-03-12 | IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive inf… |
CVE-2021-20441 | Medium | 5.9 | 2021-03-03 | IBM Security Verify Bridge uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force… |
CVE-2020-12702 | Medium | 4.6 | 2021-02-24 | Weak encryption in the Quick Pairing mode in the eWeLink mobile application (Android application V4.9.2 and earlier, iOS application V4.9.1 and earlier) allows… |
CVE-2021-23839 | Low | 3.7 | 2021-02-16 | OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both SSLv2 and more recent SSL and TLS versio… |
CVE-2021-20406 | Low | 2.2 | 2021-02-12 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensiti… |
CVE-2020-25493 | High | 7.5 | 2021-02-11 | Oclean Mobile Application 2.1.2 communicates with an external website using HTTP so it is possible to eavesdrop the network traffic. The content of HTTP payloa… |
CVE-2020-14246 | High | 7.5 | 2021-02-04 | HCL OneTest Performance V9.5, V10.0, V10.1 uses basic authentication which is relatively weak. An attacker could potentially decode the encoded credentials. |
CVE-2021-25763 | Medium | 5.3 | 2021-02-03 | In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default. |
CVE-2020-28498 | Medium | 6.8 | 2021-02-02 | The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm t… |
CVE-2020-29536 | Medium | 4.3 | 2021-01-29 | Archer before 6.8 P2 (6.8.0.2) is affected by a path exposure vulnerability. A remote authenticated malicious attacker with access to service files may obtain… |
CVE-2020-36201 | High | 7.5 | 2021-01-26 | An issue was discovered in certain Xerox WorkCentre products. They do not properly encrypt passwords. This affects 3655, 3655i, 58XX, 58XXi 59XX, 59XXi, 6655… |
CVE-2020-23162 | High | 7.5 | 2021-01-26 | Sensitive information disclosure and weak encryption in Pyrescom Termod4 time management devices before 10.04k allows remote attackers to read a session-file a… |
CVE-2020-4968 | Medium | 6.5 | 2021-01-21 | IBM Security Identity Governance and Intelligence 5.2.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensi… |
CVE-2020-20949 | Medium | 5.9 | 2021-01-20 | Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in STM32 cryptographic firmware library software expansion for STM32Cube (UM1924). The vulnerability ca… |
CVE-2020-20950 | Medium | 5.9 | 2021-01-19 | Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in Microchip Libraries for Applications 2018-11-26 All up to 2018-11-26. The vulnerability can allow on… |
CVE-2013-1053 | Medium | 5.5 | 2021-01-13 | In crypt.c of remote-login-service, the cryptographic algorithm used to cache usernames and passwords is insecure. An attacker could use this vulnerability to… |
CVE-2020-4596 | High | 7.5 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. I… |
CVE-2020-4595 | High | 7.5 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. I… |
CVE-2020-4594 | High | 7.5 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. I… |
CVE-2020-4898 | High | 7.5 | 2021-01-07 | IBM Emptoris Strategic Supply Management 10.1.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive inf… |
CVE-2020-23250 | Low | 2.3 | 2021-01-05 | GigaVUE-OS (GVOS) 5.4 - 5.9 uses a weak algorithm for a hash stored in internal database. |
CVE-2019-25006 | High | 7.5 | 2020-12-31 | An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can produce the wrong answer. |
CVE-2020-14254 | High | 7.5 | 2020-12-16 | TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10.0.2. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively reco… |
CVE-2020-28396 | High | 7.3 | 2020-12-14 | A vulnerability has been identified in SICAM A8000 CP-8000 (All versions < V16), SICAM A8000 CP-8021 (All versions < V16), SICAM A8000 CP-8022 (All versions <… |
CVE-2020-25232 | High | 7.5 | 2020-12-14 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Due to the usage of an insecure random number generation funct… |
CVE-2020-25230 | High | 7.5 | 2020-12-14 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Due to the usage of an outdated cipher mode on port 10005/tcp… |
CVE-2020-7339 | Medium | 6.3 | 2020-12-10 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in McAfee Database Security Server and Sensor prior to 4.8.0 in the form of a SHA1 signed certif… |
CVE-2020-4624 | Medium | 5.3 | 2020-11-30 | IBM Cloud Pak for Security 1.3.0.1 (CP4S) uses weaker than expected cryptographic algorithms during negotiation could allow an attacker to decrypt sensitive in… |
CVE-2020-29063 | High | 7.5 | 2020-11-24 | An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S… |
CVE-2020-4937 | High | 7.5 | 2020-11-20 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt… |
CVE-2020-8897 | Medium | 4.8 | 2020-11-16 | A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript prior to versions 2.0.0. Due to the non-committing propert… |
CVE-2020-25694 | High | 8.1 | 2020-11-16 | A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that cre… |
CVE-2020-25658 | High | 7.5 | 2020-11-12 | It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the c… |
CVE-2020-5943 | Medium | 6.5 | 2020-11-05 | In versions 14.1.0-14.1.0.1 and 14.1.2.5-14.1.2.7, when a BIG-IP object is created or listed through the REST interface, the protected fields are obfuscated in… |
CVE-2020-27653 | High | 8.3 | 2020-10-29 | Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and ob… |
CVE-2020-27652 | High | 8.3 | 2020-10-29 | Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof server… |
CVE-2020-27611 | High | 7.3 | 2020-10-21 | BigBlueButton through 2.2.28 uses STUN/TURN resources from a third party, which may represent an unintended endpoint. |
CVE-2020-4254 | High | 7.5 | 2020-10-16 | IBM Security Guardium Big Data Intelligence 1.0 (SonarG) uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sens… |
CVE-2020-4778 | High | 7.5 | 2020-10-12 | IBM Curam Social Program Management 7.0.9 and 7.0.10 uses MD5 algorithm for hashing token in a single instance which less safe than default SHA-256 cryptograph… |
CVE-2019-4325 | Medium | 5.3 | 2020-10-06 | "HCL AppScan Enterprise makes use of broken or risky cryptographic algorithm to store REST API user details." |
CVE-2020-9491 | High | 7.5 | 2020-10-01 | In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like Liste… |
CVE-2020-11031 | High | 7.8 | 2020-09-23 | In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data encrypted relies on the password used, if a user sets a weak/… |
CVE-2020-4614 | High | 7.5 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive information. IBM X-Forc… |