CWE-327 · Use of a Broken or Risky Cryptographic Algorithm (page 7)
Page 7 of 7 — CVEs classified under CWE-327, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-0688 | High | 7.5 | 2019-04-09 | An information disclosure vulnerability exists when the Windows TCP/IP stack improperly handles fragmented IP packets, aka 'Windows TCP/IP Information Disclosu… |
CVE-2019-1828 | Medium | 5.9 | 2019-04-04 | A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remo… |
CVE-2019-7477 | High | 7.5 | 2019-04-02 | A vulnerability in SonicWall SonicOS and SonicOSv TLS CBC Cipher allow remote attackers to obtain sensitive plaintext data when CBC cipher suites are enabled… |
CVE-2019-5723 | Critical | 9.8 | 2019-03-21 | An issue was discovered in portier vision 4.4.4.2 and 4.4.4.6. Passwords are stored using reversible encryption rather than as a hash value, and the used Vigen… |
CVE-2019-5919 | Critical | 9.1 | 2019-03-12 | An incomplete cryptography of the data store function by using hidden tag in Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to obtain information of t… |
CVE-2019-1543 | High | 7.4 | 2019-03-06 | ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 9… |
CVE-2019-0187 | Critical | 9.8 | 2019-03-06 | Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options). Attacker can establish a RMI connection to a jmeter-se… |
CVE-2019-9483 | Critical | 9.1 | 2019-03-01 | Amazon Ring Doorbell before 3.4.7 mishandles encryption, which allows attackers to obtain audio and video data, or insert spoofed video that does not correspon… |
CVE-2019-7006 | Medium | 5.5 | 2019-02-27 | Avaya one-X Communicator uses weak cryptographic algorithms in the client authentication component that could allow a local attacker to decrypt sensitive infor… |
CVE-2019-6593 | Medium | 5.9 | 2019-02-26 | On BIG-IP 11.5.1-11.5.4, 11.6.1, and 12.1.0, a virtual server configured with a Client SSL profile may be vulnerable to a chosen ciphertext attack against CBC… |
CVE-2019-6485 | Medium | 5.9 | 2019-02-22 | Citrix NetScaler Gateway 12.1 before build 50.31, 12.0 before build 60.9, 11.1 before build 60.14, 11.0 before build 72.17, and 10.5 before build 69.5 and Appl… |
CVE-2019-5754 | Medium | 6.5 | 2019-02-19 | Implementation error in QUIC Networking in Google Chrome prior to 72.0.3626.81 allowed an attacker running or able to cause use of a proxy server to obtain cle… |
CVE-2018-1996 | Medium | 5.3 | 2019-02-19 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could provide weaker than expected security, caused by the improper TLS configuration. A remote attacke… |
CVE-2019-7673 | High | 7.5 | 2019-02-09 | An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. Administrator Credentials are stored in the 13-character DES hash format. |
CVE-2019-3818 | High | 7.5 | 2019-02-05 | The kube-rbac-proxy container before version 0.4.1 as used in Red Hat OpenShift Container Platform does not honor TLS configurations, allowing for use of insec… |
CVE-2019-0030 | High | 7.2 | 2019-01-15 | Juniper ATP uses DES and a hardcoded salt for password hashing, allowing for trivial de-hashing of the password file contents. This issue affects Juniper ATP 5… |
CVE-2019-5719 | Medium | 5.5 | 2019-01-08 | In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the ISAKMP dissector could crash. This was addressed in epan/dissectors/packet-isakmp.c by properly handling t… |
CVE-2018-7959 | Medium | 5.9 | 2018-11-27 | There is a short key vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-middle attack to intercept and decrypt the… |
CVE-2018-0734 | Medium | 5.9 | 2018-10-30 | The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm… |
CVE-2018-0735 | Medium | 5.9 | 2018-10-29 | The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorith… |
CVE-2018-18587 | Medium | 5.3 | 2018-10-23 | BigProf AppGini 5.70 stores the passwords in the database using the MD5 hash. |
CVE-2018-11070 | Medium | 5.9 | 2018-09-11 | RSA BSAFE Crypto-J versions prior to 6.2.4 and RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during PKCS #1 unpadding o… |
CVE-2018-11069 | Medium | 5.9 | 2018-09-11 | RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during RSA decryption, also known as a Bleichenbacher attack on RSA decry… |
CVE-2018-16806 | Medium | 6.5 | 2018-09-10 | A Pektron Passive Keyless Entry and Start (PKES) system, as used on the Tesla Model S and possibly other vehicles, relies on the DST40 cipher, which makes it e… |
CVE-2018-11057 | Medium | 5.9 | 2018-08-31 | RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x) contains a Covert Timing Channel vulnerability during RSA de… |
CVE-2018-7792 | High | 7.5 | 2018-08-29 | A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware… |
CVE-2018-10846 | Medium | 5.6 | 2018-08-22 | A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. An attacker could use a combination… |
CVE-2018-10845 | Medium | 5.9 | 2018-08-22 | It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct di… |
CVE-2018-10844 | Medium | 5.9 | 2018-08-22 | It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct di… |
CVE-2018-15355 | Medium | 5.9 | 2018-08-17 | Usage of SSLv2 and SSLv3 leads to transmitted data decryption in Kraftway 24F2XG Router firmware 3.5.30.1118. |
CVE-2017-1575 | Medium | 5.1 | 2018-07-20 | IBM Sterling B2B Integrator Standard Edition (IBM Sterling File Gateway 2.2.0 through 2.2.6) uses weaker than expected cryptographic algorithms that could allo… |
CVE-2017-16718 | Medium | 5.9 | 2018-06-27 | Beckhoff TwinCAT 3 supports communication over ADS. ADS is a protocol for industrial automation in protected environments. This protocol uses user configured r… |
CVE-2018-12420 | High | 7.5 | 2018-06-14 | IceHrm before 23.0.1.OS has a risky usage of a hashed password in a request. |
CVE-2018-5152 | Medium | 6.5 | 2018-06-11 | WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to network traffic to the si… |
CVE-2018-1000180 | High | 7.5 | 2018-06-05 | Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pai… |
CVE-2015-9235 | Critical | 9.8 | 2018-05-29 | In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES fami… |
CVE-2018-11209 | High | 7.2 | 2018-05-16 | An issue was discovered in Z-BlogPHP 2.0.0. zb_system/cmd.php?act=verify relies on MD5 for the password parameter, which might make it easier for attackers to… |
CVE-2017-12129 | High | 8.0 | 2018-05-14 | An exploitable Weak Cryptography for Passwords vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. An attacker could inte… |
CVE-2018-6619 | High | 7.8 | 2018-05-11 | Easy Hosting Control Panel (EHCP) v0.37.12.b makes it easier for attackers to crack database passwords by leveraging use of a weak hashing algorithm without a… |
CVE-2018-10831 | High | 7.5 | 2018-05-09 | Z-NOMP before 2018-04-05 has an incorrect Equihash solution verifier that allows attackers to spoof mining shares, as demonstrated by providing a solution with… |
CVE-2018-0737 | Medium | 5.9 | 2018-04-16 | The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cac… |
CVE-2018-5382 | Medium | 4.4 | 2018-04-16 | The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle releas… |
CVE-2018-10084 | High | 8.8 | 2018-04-13 | CMS Made Simple (CMSMS) through 2.2.6 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the eff_uid value within… |
CVE-2018-5458 | High | 7.5 | 2018-03-26 | Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have a vulnerability using SSL legacy encryption that could allow an attacker to gain unauthorized… |
CVE-2017-15326 | Medium | 4.3 | 2018-03-23 | DBS3900 TDD LTE V100R003C00, V100R004C10 have a weak encryption algorithm security vulnerability. DBS3900 TDD LTE supports SSL/TLS protocol negotiation using i… |
CVE-2018-1428 | Medium | 6.2 | 2018-03-22 | IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) uses weaker than expected cryptographic algorithms that could allow an attacker to de… |
CVE-2017-1571 | Medium | 5.1 | 2018-03-22 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 uses weaker than expected cryptographic algorithms that could allow… |
CVE-2017-17167 | Medium | 5.9 | 2018-03-09 | Huawei DP300 V500R002C00; TP3206 V100R002C00; ViewPoint 9030 V100R011C02; V100R011C03 have a use of a broken or risky cryptographic algorithm vulnerability. Th… |
CVE-2017-17428 | Medium | 5.9 | 2018-03-05 | Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenba… |
CVE-2018-7211 | High | 8.1 | 2018-02-18 | An issue was discovered in iDashboards 9.6b. The SSO implementation is affected by a weak obfuscation library, allowing man-in-the-middle attackers to discover… |
CVE-2018-6829 | High | 7.5 | 2018-02-07 | cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive… |
CVE-2017-17878 | Critical | 9.8 | 2017-12-27 | An issue was discovered in Valve Steam Link build 643. Root passwords longer than 8 characters are truncated because of the default use of DES (aka the CONFIG_… |
CVE-2017-1598 | High | 7.5 | 2017-12-20 | IBM Security Guardium 10.0 Database Activity Monitor uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitiv… |
CVE-2017-17717 | Critical | 9.8 | 2017-12-17 | Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature. |
CVE-2017-17382 | Medium | 5.9 | 2017-12-13 | Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.5 before build 67.13, 11.0 before build 71.22, 11.1 before build 56.19, and 12… |
CVE-2017-8866 | Medium | 5.9 | 2017-12-11 | Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 share a fixed small pool of hardcoded keys, allowing a remote attacker to use a dif… |
CVE-2017-8191 | Medium | 5.9 | 2017-11-22 | FusionSphere OpenStack V100R006C00SPC102(NFV)has a week cryptographic algorithm vulnerability. Attackers may exploit the vulnerability to crack the cipher text… |
CVE-2017-8157 | Medium | 5.9 | 2017-11-22 | OceanStor 5800 V3 with software V300R002C00 and V300R002C10, OceanStor 6900 V3 V300R001C00 has an information leakage vulnerability. Products use TLS1.0 to enc… |
CVE-2012-4449 | Critical | 9.8 | 2017-10-30 | Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security features are enabled… |
CVE-2015-0226 | High | 7.5 | 2017-10-30 | Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, whic… |
CVE-2017-15998 | High | 7.5 | 2017-10-29 | In the "NQ Contacts Backup & Restore" application 1.1 for Android, DES encryption with a static key is used to secure transmitted contact data. This makes it e… |
CVE-2017-15997 | High | 7.8 | 2017-10-29 | In the "NQ Contacts Backup & Restore" application 1.1 for Android, RC4 encryption is used to secure the user password locally stored in shared preferences. Bec… |
CVE-2017-14937 | Medium | 4.7 | 2017-10-20 | The airbag detonation algorithm allows injury to passenger-car occupants via predictable Security Access (SA) data to the internal CAN bus (or the OBD connecto… |
CVE-2017-1339 | Medium | 4.4 | 2017-10-05 | IBM Spectrum Protect 7.1 and 8.1 (formerly Tivoli Storage Manager) Server uses weak encryption for the password. A database administrator may be able to decryp… |
CVE-2014-9969 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, the GPS client may use an insecure cryptographic algorithm. |
CVE-2017-9859 | Critical | 9.8 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. The inverters make use of a weak hashing algorithm to encrypt the password for REGISTER requests. Thi… |
CVE-2017-11133 | High | 7.5 | 2017-08-01 | An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. To encrypt messages, AES… |
CVE-2017-10668 | Medium | 5.9 | 2017-06-30 | A Padding Oracle exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET). Under an MITM condition wit… |
CVE-2017-9466 | Critical | 9.8 | 2017-06-26 | The executable httpd on the TP-Link WR841N V8 router before TL-WR841N(UN)_V8_170210 contained a design flaw in the use of DES for block encryption. This result… |
CVE-2016-3099 | High | 7.5 | 2017-06-08 | mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation… |
CVE-2014-8687 | Critical | 9.8 | 2017-06-08 | Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root privileges by leveraging use of a stati… |
CVE-2017-4917 | Critical | 9.8 | 2017-06-07 | VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x locally stores vCenter Server credentials using reversible encryption. This issue may allow… |
CVE-2017-5243 | High | 8.5 | 2017-06-06 | The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other imp… |
CVE-2017-9136 | High | 7.5 | 2017-05-21 | An issue was discovered on Mimosa Client Radios before 2.2.3. In the device's web interface, there is a page that allows an attacker to use an unsanitized GET… |
CVE-2017-5186 | High | 7.5 | 2017-04-27 | Novell iManager 2.7 before SP7 Patch 9, NetIQ iManager 3.x before 3.0.2.1, Novell eDirectory 8.8.x before 8.8 SP8 Patch 9 Hotfix 2, and NetIQ eDirectory 9.x be… |
CVE-2016-6485 | High | 7.5 | 2017-03-01 | The __construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, w… |
CVE-2016-8370 | High | 7.5 | 2017-02-13 | An issue was discovered in Mitsubishi Electric Automation MELSEC-Q series Ethernet interface modules QJ71E71-100, all versions, QJ71E71-B5, all versions, and Q… |
CVE-2016-6602 | Critical | 9.8 | 2017-01-23 | ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwor… |
CVE-2005-4900 | Medium | 5.9 | 2016-10-14 | SHA-1 is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of S… |
CVE-2016-0923 | High | 7.5 | 2016-09-18 | The client in EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.9 and 4.1.x before 4.1.5 places the weakest algorithms first in a signature-algorithm li… |
CVE-2015-0535 | High | 7.5 | 2015-08-20 | EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3 and RSA BSAFE SSL-C 2.8.9 and earlier do not properly restrict TLS state tran… |
CVE-2015-0533 | High | 7.5 | 2015-08-20 | EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3 and RSA BSAFE SSL-C 2.8.9 and earlier allow remote SSL servers to conduct ECD… |
CVE-2015-2808 | Low | 3.7 | 2015-04-01 | The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which make… |
CVE-2007-6755 | | 2013-10-11 | The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a… | |
CVE-2013-2566 | Medium | 5.9 | 2013-03-15 | The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-r… |
CVE-2009-2273 | | 2009-07-01 | The default configuration of the Wi-Fi component on the Huawei D100 does not use encryption, which makes it easier for remote attackers to obtain sensitive inf… | |
CVE-2008-3775 | Medium | 4.4 | 2008-08-22 | Folder Lock 5.9.5 and earlier uses weak encryption (ROT-25) for the password, which allows local administrators to obtain sensitive information by reading and… |
CVE-2008-3188 | High | 7.5 | 2008-07-22 | libxcrypt in SUSE openSUSE 11.0 uses the DES algorithm when the configuration specifies the MD5 algorithm, which makes it easier for attackers to conduct brute… |
CVE-2007-6013 | Critical | 9.8 | 2007-11-19 | Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the M… |
CVE-2007-5460 | Medium | 4.6 | 2007-10-15 | Microsoft ActiveSync 4.1, as used in Windows Mobile 5.0, uses weak encryption (XOR obfuscation with a fixed key) when sending the user's PIN/Password over the… |
CVE-2007-4150 | High | 7.5 | 2007-08-03 | The Visionsoft Audit on Demand Service (VSAOD) in Visionsoft Audit 12.4.0.0 uses weak cryptography (XOR) when (1) transmitting passwords, which allows remote a… |
CVE-2005-4860 | High | 7.8 | 2005-12-31 | Spectrum Cash Receipting System before 6.504 uses weak cryptography (static substitution) in the PASSFILE password file, which makes it easier for local users… |
CVE-2005-2946 | High | 7.5 | 2005-09-16 | The default configuration on OpenSSL before 0.9.8 uses MD5 for creating message digests instead of a more cryptographically strong algorithm, which makes it ea… |
CVE-2002-2058 | High | 7.5 | 2002-12-31 | TeeKai Tracking Online 1.0 uses weak encryption of web usage statistics in data/userlog/log.txt, which allows remote attackers to identify IP's visiting the si… |
CVE-1999-0007 | | 1998-06-26 | Information from SSL-encrypted sessions via PKCS #1. |