CWE-327 · Use of a Broken or Risky Cryptographic Algorithm (page 6)
Page 6 of 7 — CVEs classified under CWE-327, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-4613 | High | 7.5 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM… |
CVE-2020-14517 | Critical | 9.8 | 2020-09-16 | Protocol encryption can be easily broken for CodeMeter (All versions prior to 6.90 are affected, including Version 6.90 or newer only if CodeMeter Runtime is r… |
CVE-2020-1596 | Medium | 5.4 | 2020-09-11 | <p>A information disclosure vulnerability exists when TLS components use weak hash algorithms. An attacker who successfully exploited this vulnerability could… |
CVE-2019-14089 | High | 7.8 | 2020-09-08 | u'Keymaster attestation key and device IDs provisioning which is a one time process is incorrectly allowed to be re-provisioned after a user data erase or a fa… |
CVE-2020-6874 | Critical | 9.1 | 2020-09-01 | A ZTE product is impacted by the cryptographic issues vulnerability. The encryption algorithm is not properly used, so remote attackers could use this vulnerab… |
CVE-2020-4174 | High | 7.5 | 2020-08-27 | IBM Security Guardium Insights 2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. I… |
CVE-2020-4169 | High | 7.5 | 2020-08-27 | IBM Security Guardium Insights 2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. I… |
CVE-2020-8912 | Low | 2.5 | 2020-08-11 | A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted b… |
CVE-2020-8911 | Medium | 5.6 | 2020-08-11 | A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without comp… |
CVE-2020-9528 | High | 7.5 | 2020-08-10 | Firmware developed by Shenzhen Hichip Vision Technology (V6 through V20), as used by many different vendors in millions of Internet of Things devices, suffers… |
CVE-2020-9526 | Medium | 5.9 | 2020-08-10 | CS2 Network P2P through 3.x, as used in millions of Internet of Things devices, suffers from an information exposure flaw that exposes user session data to sup… |
CVE-2020-15128 | Medium | 6.1 | 2020-07-31 | In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of… |
CVE-2020-3681 | Critical | 9.8 | 2020-07-31 | Authenticated and encrypted payload MMEs can be forged and remotely sent to any HPAV2 system using a jailbreak key recoverable from code. |
CVE-2020-4185 | High | 7.5 | 2020-07-30 | IBM Security Guardium 10.5, 10.6, and 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informat… |
CVE-2020-15098 | High | 8.8 | 2020-07-29 | In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been discovered that an inte… |
CVE-2020-10927 | High | 8.8 | 2020-07-28 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentica… |
CVE-2020-7514 | High | 7.8 | 2020-07-23 | A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker a… |
CVE-2020-7689 | Medium | 5.9 | 2020-07-01 | Data is truncated wrong when its length is greater than 255 bytes. |
CVE-2020-4452 | High | 7.5 | 2020-06-29 | IBM API Connect V2018.4.1.0 through 2018.4.1.11 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive inf… |
CVE-2020-7511 | High | 7.5 | 2020-06-16 | A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attack… |
CVE-2020-4191 | Medium | 4.4 | 2020-06-04 | IBM Security Guardium 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force… |
CVE-2020-13777 | High | 7.4 | 2020-06-04 | GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in T… |
CVE-2020-4367 | High | 7.5 | 2020-06-02 | IBM Planning Analytics Local 2.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X… |
CVE-2020-13757 | High | 7.5 | 2020-06-01 | Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an a… |
CVE-2020-4379 | High | 7.5 | 2020-05-27 | IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informat… |
CVE-2020-4350 | High | 7.5 | 2020-05-27 | IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informat… |
CVE-2020-4349 | High | 7.5 | 2020-05-27 | IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informat… |
CVE-2020-13135 | Medium | 6.5 | 2020-05-18 | D-Link DSP-W215 1.26b03 devices allow information disclosure by intercepting messages on the local network, as demonstrated by a Squid Proxy. |
CVE-2019-13022 | Critical | 9.8 | 2020-05-14 | Bond JetSelect (all versions) has an issue in the Java class (ENCtool.jar) and corresponding password generation algorithm (used to set initial passwords upon… |
CVE-2020-6861 | Medium | 5.5 | 2020-05-06 | A flawed protocol design in the Ledger Monero app before 1.5.1 for Ledger Nano and Ledger S devices allows a local attacker to extract the master spending key… |
CVE-2020-11035 | High | 7.5 | 2020-05-05 | In GLPI after version 0.83.3 and before version 9.4.6, the CSRF tokens are generated using an insecure algorithm. The implementation uses rand and uniqid and M… |
CVE-2020-11876 | High | 7.5 | 2020-04-17 | airhost.exe in Zoom Client for Meetings 4.6.11 uses the SHA-256 hash of 0123425234234fsdfsdr3242 for initialization of an OpenSSL EVP AES-256 CBC context. NOTE… |
CVE-2019-20775 | Medium | 5.5 | 2020-04-17 | An issue was discovered on LG mobile devices with Android OS 9.0 (Qualcomm SDM450, SDM845, SM6150, and SM8150 chipsets) software. Weak encryption leads to loca… |
CVE-2020-10377 | Critical | 9.8 | 2020-04-17 | A weak encryption vulnerability in Mitel MiVoice Connect Client before 214.100.1214.0 could allow an unauthenticated attacker to gain access to user credential… |
CVE-2020-11872 | High | 7.5 | 2020-04-17 | The Cloud Functions subsystem in OpenTrace 1.0 might allow fabrication attacks by making billions of TempID requests before an AES-256-GCM key rotation occurs. |
CVE-2019-14001 | High | 7.8 | 2020-04-16 | Wrong public key usage from existing oem_keystore for hash generation in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile… |
CVE-2020-10932 | Medium | 4.7 | 2020-04-15 | An issue was discovered in Arm Mbed TLS before 2.16.6 and 2.7.x before 2.7.15. An attacker that can get precise enough side-channel measurements can recover th… |
CVE-2020-11005 | Medium | 5.1 | 2020-04-14 | The WindowsHello open source library (NuGet HaemmerElectronics.SeppPenner.WindowsHello), before version 1.0.4, has a vulnerability where encrypted data could p… |
CVE-2018-6402 | High | 7.5 | 2020-04-14 | Ecobee Ecobee4 4.2.0.171 devices can be forced to deauthenticate and connect to an unencrypted Wi-Fi network with the same SSID, even if the device settings sp… |
CVE-2018-21058 | Critical | 9.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.0), O(8.0) (exynos7420 or Exynos 8890/8996 chipsets) software. Cache attacks can occur against the K… |
CVE-2020-10601 | High | 7.8 | 2020-04-03 | VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module allow weak hashing algorithm and insecure permissions which may allow a local attacker to bypas… |
CVE-2020-11500 | High | 7.5 | 2020-04-03 | Zoom Client for Meetings through 4.6.9 uses the ECB mode of AES for video and audio encryption. Within a meeting, all participants use a single 128-bit key. |
CVE-2019-15795 | Medium | 4.7 | 2020-03-26 | python-apt only checks the MD5 sums of downloaded files in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py in version 1.9.0ubuntu1 and… |
CVE-2020-7001 | High | 7.5 | 2020-03-24 | In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the affected products use a weak cryptographic algorithm, which may allow confidential information to… |
CVE-2020-6987 | High | 7.5 | 2020-03-24 | In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the affected products use a weak cryptographic algori… |
CVE-2019-4553 | High | 7.5 | 2020-03-24 | IBM API Connect V5.0.0.0 through 5.0.8.7iFix3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive infor… |
CVE-2019-15075 | High | 7.5 | 2020-03-20 | An issue was discovered in iNextrix ASTPP before 4.0.1. web_interface/astpp/application/config/config.php does not have strong random keys, as demonstrated by… |
CVE-2019-15653 | High | 7.5 | 2020-03-19 | Comba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via an insecure authentication mechanism. The HTML source code of the login page… |
CVE-2020-6984 | High | 7.5 | 2020-03-16 | Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Softw… |
CVE-2019-5135 | Medium | 5.3 | 2020-03-11 | An exploitable timing discrepancy vulnerability exists in the authentication functionality of the Web-Based Management (WBM) web application on WAGO PFC100/200… |
CVE-2011-2487 | Medium | 5.9 | 2020-03-11 | The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack. |
CVE-2019-9095 | Critical | 9.8 | 2020-03-11 | An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices… |
CVE-2012-5623 | High | 7.5 | 2020-02-13 | Squirrelmail 4.0 uses the outdated MD5 hash algorithm for passwords. |
CVE-2019-4427 | High | 7.5 | 2020-02-12 | IBM Cloud CLI 0.6.0 through 0.16.1 windows installers are signed using SHA1 certificate. An attacker might be able to exploit the weak algorithm to generate a… |
CVE-2013-2213 | Medium | 5.5 | 2020-02-11 | The KRandom::random function in KDE Paste Applet after 4.10.5 in kdeplasma-addons uses the GNU C Library rand function's linear congruential generator, which m… |
CVE-2019-4540 | High | 7.5 | 2020-02-04 | IBM Security Directory Server 6.4.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IB… |
CVE-2020-5229 | High | 7.7 | 2020-01-30 | Opencast before 8.1 stores passwords using the rather outdated and cryptographically insecure MD5 hash algorithm. Furthermore, the hashes are salted using the… |
CVE-2019-4639 | High | 7.5 | 2020-01-28 | IBM Security Secret Server 10.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-… |
CVE-2019-3700 | Low | 2.9 | 2020-01-24 | yast2-security didn't use secure defaults to protect passwords. This became a problem on 2019-10-07 when configuration files that set secure settings were move… |
CVE-2020-6857 | Medium | 5.5 | 2020-01-21 | CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local FTP server passwords is hard-coded in the… |
CVE-2019-19891 | Medium | 5.9 | 2020-01-13 | An encryption key vulnerability on Mitel SIP-DECT wireless devices 8.0 and 8.1 could allow an attacker to launch a man-in-the-middle attack. A successful explo… |
CVE-2020-1810 | Medium | 5.3 | 2020-01-09 | There is a weak algorithm vulnerability in some Huawei products. The affected products use the RSA algorithm in the SSL key exchange algorithm which have been… |
CVE-2020-1826 | Medium | 4.4 | 2020-01-09 | Huawei Honor Magic2 mobile phones with versions earlier than 10.0.0.175(C00E59R2P11) have an information leak vulnerability. Due to a module using weak encrypt… |
CVE-2019-20138 | High | 7.5 | 2019-12-30 | The HTTP Authentication library before 2019-12-27 for Nim has weak password hashing because the default algorithm for libsodium's crypto_pwhash_str is not used. |
CVE-2019-4609 | High | 7.5 | 2019-12-18 | IBM API Connect 2018.4.1.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force… |
CVE-2019-18832 | High | 8.1 | 2019-12-17 | Barco ClickShare Button R9861500D01 devices before 1.9.0 have incorrect Credentials Management. The ClickShare Button implements encryption at rest which uses… |
CVE-2019-18340 | Medium | 5.5 | 2019-12-12 | A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0), Control Center Server (CCS) (All versions >= V1.5.0), SiNVR/SiVMS V… |
CVE-2019-17428 | Medium | 5.9 | 2019-12-12 | An issue was discovered in Intesync Solismed 3.3sp1. An flaw in the encryption implementation exists, allowing for all encrypted data stored within the databas… |
CVE-2019-16863 | Medium | 5.9 | 2019-11-14 | STMicroelectronics ST33TPHF2ESPI TPM devices before 2019-09-12 allow attackers to extract the ECDSA private key via a side-channel timing attack because ECDSA… |
CVE-2019-16208 | High | 7.5 | 2019-11-08 | Password-based encryption (PBE) algorithm, of Brocade SANnav versions before v2.0, has a weakness in generating cryptographic keys that may allow an attacker t… |
CVE-2019-4399 | High | 7.5 | 2019-10-25 | IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt h… |
CVE-2019-8237 | Critical | 9.8 | 2019-10-23 | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.3049… |
CVE-2019-11341 | Medium | 4.6 | 2019-10-09 | On certain Samsung P(9.0) phones, an attacker with physical access can start a TCP Dump capture without the user's knowledge. This feature of the Service Mode… |
CVE-2018-5745 | Medium | 4.9 | 2019-10-09 | "managed-keys" is a feature which allows a BIND resolver to automatically maintain the keys used by trust anchors which operators configure for use in DNSSEC v… |
CVE-2019-13629 | Medium | 5.9 | 2019-10-03 | MatrixSSL 4.2.1 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or a remote attacker, able to measure the duratio… |
CVE-2019-16116 | Medium | 4.3 | 2019-10-02 | EnterpriseDT CompleteFTP Server prior to version 12.1.3 is vulnerable to information exposure in the Bootstrap.log file. This allows an attacker to obtain the… |
CVE-2019-3736 | High | 7.2 | 2019-09-27 | Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a password storage vulnerability in the ACM component. A remote authenticated malic… |
CVE-2019-9399 | Medium | 5.9 | 2019-09-27 | The Print Service is susceptible to man in the middle attacks due to improperly used crypto. This could lead to remote information disclosure with no additiona… |
CVE-2019-16370 | Medium | 5.9 | 2019-09-16 | The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has t… |
CVE-2019-1563 | Low | 3.7 | 2019-09-10 | In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large numbe… |
CVE-2019-16143 | Critical | 9.8 | 2019-09-09 | An issue was discovered in the blake2 crate before 0.8.1 for Rust. The BLAKE2b and BLAKE2s algorithms, when used with HMAC, produce incorrect results because t… |
CVE-2019-15955 | Medium | 6.5 | 2019-09-05 | An issue was discovered in Total.js CMS 12.0.0. A low privilege user can perform a simple transformation of a cookie to obtain the random values inside it. If… |
CVE-2019-12587 | High | 8.1 | 2019-09-04 | The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 allows the installation of a zero Pairwise Maste… |
CVE-2018-18371 | Medium | 6.5 | 2019-08-30 | The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browser. An information… |
CVE-2019-9155 | Medium | 5.9 | 2019-08-22 | A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages… |
CVE-2019-12621 | High | 7.4 | 2019-08-21 | A vulnerability in Cisco HyperFlex Software could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack. The vulnerability is due to… |
CVE-2019-5035 | Critical | 9.0 | 2019-08-20 | An exploitable information disclosure vulnerability exists in the Weave PASE pairing functionality of the Nest Cam IQ Indoor, version 4620002. A set of special… |
CVE-2019-9013 | High | 8.8 | 2019-08-15 | An issue was discovered in 3S-Smart CODESYS V3 products. The application may utilize non-TLS based encryption, which results in user credentials being insuffic… |
CVE-2019-9506 | High | 8.1 | 2019-08-14 | The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influen… |
CVE-2019-10929 | Medium | 5.9 | 2019-08-13 | A vulnerability has been identified in SIMATIC CP 1626 (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), S… |
CVE-2016-5431 | High | 7.5 | 2019-08-07 | The PHP JOSE Library by Gree Inc. before version 2.2.1 is vulnerable to key confusion/algorithm substitution in the JWS component resulting in bypassing the si… |
CVE-2019-5502 | Critical | 9.1 | 2019-08-05 | SMB in Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 has weak cryptography which when exploited could lead to information disclosure or addition or… |
CVE-2019-7858 | High | 7.5 | 2019-08-02 | A cryptographic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9 and Magento 2.3 prior to 2.3.2 resulted in storage of sensitive information wit… |
CVE-2019-13604 | Medium | 5.9 | 2019-07-15 | There is a short key vulnerability in HID Global DigitalPersona (formerly Crossmatch) U.are.U 4500 Fingerprint Reader v24. The key for obfuscating the fingerpr… |
CVE-2019-13052 | Medium | 6.5 | 2019-06-29 | Logitech Unifying devices allow live decryption if the pairing of a keyboard to a receiver is sniffed. |
CVE-2019-9836 | Medium | 5.3 | 2019-06-25 | Secure Encrypted Virtualization (SEV) on Advanced Micro Devices (AMD) Platform Security Processor (PSP; aka AMD Secure Processor or AMD-SP) 0.17 build 11 and e… |
CVE-2019-4156 | Medium | 5.9 | 2019-06-25 | IBM Security Access Manager 9.0.1 through 9.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive inf… |
CVE-2019-11323 | Medium | 5.9 | 2019-05-09 | HAProxy before 1.9.7 mishandles a reload with rotated keys, which triggers use of uninitialized, and very predictable, HMAC keys. This is related to an include… |
CVE-2019-1706 | High | 8.6 | 2019-05-03 | A vulnerability in the software cryptography module of the Cisco Adaptive Security Virtual Appliance (ASAv) and Firepower 2100 Series running Cisco Adaptive Se… |
CVE-2018-1720 | Medium | 5.9 | 2019-04-25 | IBM Sterling B2B Integrator Standard Edition 5.2.0.1, 5.2.6.3_6, 6.0.0.0, and 6.0.0.1 uses weaker than expected cryptographic algorithms that could allow an at… |