CWE-327 · Use of a Broken or Risky Cryptographic Algorithm (page 7)
Page 7 of 8 — CVEs classified under CWE-327, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-9399 | Medium | 5.9 | 2019-09-27 | The Print Service is susceptible to man in the middle attacks due to improperly used crypto. This could lead to remote information disclosure with no additiona… |
CVE-2019-16370 | Medium | 5.9 | 2019-09-16 | The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has t… |
CVE-2019-1563 | Low | 3.7 | 2019-09-10 | In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large numbe… |
CVE-2019-16143 | Critical | 9.8 | 2019-09-09 | An issue was discovered in the blake2 crate before 0.8.1 for Rust. The BLAKE2b and BLAKE2s algorithms, when used with HMAC, produce incorrect results because t… |
CVE-2019-15955 | Medium | 6.5 | 2019-09-05 | An issue was discovered in Total.js CMS 12.0.0. A low privilege user can perform a simple transformation of a cookie to obtain the random values inside it. If… |
CVE-2019-12587 | High | 8.1 | 2019-09-04 | The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 allows the installation of a zero Pairwise Maste… |
CVE-2018-18371 | Medium | 6.5 | 2019-08-30 | The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browser. An information… |
CVE-2019-9155 | Medium | 5.9 | 2019-08-22 | A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages… |
CVE-2019-12621 | High | 7.4 | 2019-08-21 | A vulnerability in Cisco HyperFlex Software could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack. The vulnerability is due to… |
CVE-2019-5035 | Critical | 9.0 | 2019-08-20 | An exploitable information disclosure vulnerability exists in the Weave PASE pairing functionality of the Nest Cam IQ Indoor, version 4620002. A set of special… |
CVE-2019-9013 | High | 8.8 | 2019-08-15 | An issue was discovered in 3S-Smart CODESYS V3 products. The application may utilize non-TLS based encryption, which results in user credentials being insuffic… |
CVE-2019-9506 | High | 8.1 | 2019-08-14 | The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influen… |
CVE-2019-10929 | Medium | 5.9 | 2019-08-13 | A vulnerability has been identified in SIMATIC CP 1626 (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), S… |
CVE-2016-5431 | High | 7.5 | 2019-08-07 | The PHP JOSE Library by Gree Inc. before version 2.2.1 is vulnerable to key confusion/algorithm substitution in the JWS component resulting in bypassing the si… |
CVE-2019-5502 | Critical | 9.1 | 2019-08-05 | SMB in Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 has weak cryptography which when exploited could lead to information disclosure or addition or… |
CVE-2019-7858 | High | 7.5 | 2019-08-02 | A cryptographic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9 and Magento 2.3 prior to 2.3.2 resulted in storage of sensitive information wit… |
CVE-2019-13604 | Medium | 5.9 | 2019-07-15 | There is a short key vulnerability in HID Global DigitalPersona (formerly Crossmatch) U.are.U 4500 Fingerprint Reader v24. The key for obfuscating the fingerpr… |
CVE-2019-13052 | Medium | 6.5 | 2019-06-29 | Logitech Unifying devices allow live decryption if the pairing of a keyboard to a receiver is sniffed. |
CVE-2019-9836 | Medium | 5.3 | 2019-06-25 | Secure Encrypted Virtualization (SEV) on Advanced Micro Devices (AMD) Platform Security Processor (PSP; aka AMD Secure Processor or AMD-SP) 0.17 build 11 and e… |
CVE-2019-4156 | Medium | 5.9 | 2019-06-25 | IBM Security Access Manager 9.0.1 through 9.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive inf… |
CVE-2019-11323 | Medium | 5.9 | 2019-05-09 | HAProxy before 1.9.7 mishandles a reload with rotated keys, which triggers use of uninitialized, and very predictable, HMAC keys. This is related to an include… |
CVE-2019-1706 | High | 8.6 | 2019-05-03 | A vulnerability in the software cryptography module of the Cisco Adaptive Security Virtual Appliance (ASAv) and Firepower 2100 Series running Cisco Adaptive Se… |
CVE-2018-1720 | Medium | 5.9 | 2019-04-25 | IBM Sterling B2B Integrator Standard Edition 5.2.0.1, 5.2.6.3_6, 6.0.0.0, and 6.0.0.1 uses weaker than expected cryptographic algorithms that could allow an at… |
CVE-2019-0688 | High | 7.5 | 2019-04-09 | An information disclosure vulnerability exists when the Windows TCP/IP stack improperly handles fragmented IP packets, aka 'Windows TCP/IP Information Disclosu… |
CVE-2019-1828 | Medium | 5.9 | 2019-04-04 | A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remo… |
CVE-2019-7477 | High | 7.5 | 2019-04-02 | A vulnerability in SonicWall SonicOS and SonicOSv TLS CBC Cipher allow remote attackers to obtain sensitive plaintext data when CBC cipher suites are enabled… |
CVE-2019-5723 | Critical | 9.8 | 2019-03-21 | An issue was discovered in portier vision 4.4.4.2 and 4.4.4.6. Passwords are stored using reversible encryption rather than as a hash value, and the used Vigen… |
CVE-2019-5919 | Critical | 9.1 | 2019-03-12 | An incomplete cryptography of the data store function by using hidden tag in Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to obtain information of t… |
CVE-2019-1543 | High | 7.4 | 2019-03-06 | ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 9… |
CVE-2019-0187 | Critical | 9.8 | 2019-03-06 | Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options). Attacker can establish a RMI connection to a jmeter-se… |
CVE-2019-9483 | Critical | 9.1 | 2019-03-01 | Amazon Ring Doorbell before 3.4.7 mishandles encryption, which allows attackers to obtain audio and video data, or insert spoofed video that does not correspon… |
CVE-2019-7006 | Medium | 5.5 | 2019-02-27 | Avaya one-X Communicator uses weak cryptographic algorithms in the client authentication component that could allow a local attacker to decrypt sensitive infor… |
CVE-2019-6593 | Medium | 5.9 | 2019-02-26 | On BIG-IP 11.5.1-11.5.4, 11.6.1, and 12.1.0, a virtual server configured with a Client SSL profile may be vulnerable to a chosen ciphertext attack against CBC… |
CVE-2019-6485 | Medium | 5.9 | 2019-02-22 | Citrix NetScaler Gateway 12.1 before build 50.31, 12.0 before build 60.9, 11.1 before build 60.14, 11.0 before build 72.17, and 10.5 before build 69.5 and Appl… |
CVE-2019-5754 | Medium | 6.5 | 2019-02-19 | Implementation error in QUIC Networking in Google Chrome prior to 72.0.3626.81 allowed an attacker running or able to cause use of a proxy server to obtain cle… |
CVE-2018-1996 | Medium | 5.3 | 2019-02-19 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could provide weaker than expected security, caused by the improper TLS configuration. A remote attacke… |
CVE-2019-7673 | High | 7.5 | 2019-02-09 | An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. Administrator Credentials are stored in the 13-character DES hash format. |
CVE-2019-3818 | High | 7.5 | 2019-02-05 | The kube-rbac-proxy container before version 0.4.1 as used in Red Hat OpenShift Container Platform does not honor TLS configurations, allowing for use of insec… |
CVE-2019-0030 | High | 7.2 | 2019-01-15 | Juniper ATP uses DES and a hardcoded salt for password hashing, allowing for trivial de-hashing of the password file contents. This issue affects Juniper ATP 5… |
CVE-2019-5719 | Medium | 5.5 | 2019-01-08 | In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the ISAKMP dissector could crash. This was addressed in epan/dissectors/packet-isakmp.c by properly handling t… |
CVE-2018-7959 | Medium | 5.9 | 2018-11-27 | There is a short key vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-middle attack to intercept and decrypt the… |
CVE-2018-0734 | Medium | 5.9 | 2018-10-30 | The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm… |
CVE-2018-0735 | Medium | 5.9 | 2018-10-29 | The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorith… |
CVE-2018-18587 | Medium | 5.3 | 2018-10-23 | BigProf AppGini 5.70 stores the passwords in the database using the MD5 hash. |
CVE-2018-11070 | Medium | 5.9 | 2018-09-11 | RSA BSAFE Crypto-J versions prior to 6.2.4 and RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during PKCS #1 unpadding o… |
CVE-2018-11069 | Medium | 5.9 | 2018-09-11 | RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during RSA decryption, also known as a Bleichenbacher attack on RSA decry… |
CVE-2018-16806 | Medium | 6.5 | 2018-09-10 | A Pektron Passive Keyless Entry and Start (PKES) system, as used on the Tesla Model S and possibly other vehicles, relies on the DST40 cipher, which makes it e… |
CVE-2018-11057 | Medium | 5.9 | 2018-08-31 | RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x) contains a Covert Timing Channel vulnerability during RSA de… |
CVE-2018-7792 | High | 7.5 | 2018-08-29 | A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware… |
CVE-2018-10846 | Medium | 5.6 | 2018-08-22 | A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. An attacker could use a combination… |
CVE-2018-10845 | Medium | 5.9 | 2018-08-22 | It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct di… |
CVE-2018-10844 | Medium | 5.9 | 2018-08-22 | It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct di… |
CVE-2018-15355 | Medium | 5.9 | 2018-08-17 | Usage of SSLv2 and SSLv3 leads to transmitted data decryption in Kraftway 24F2XG Router firmware 3.5.30.1118. |
CVE-2017-1575 | Medium | 5.1 | 2018-07-20 | IBM Sterling B2B Integrator Standard Edition (IBM Sterling File Gateway 2.2.0 through 2.2.6) uses weaker than expected cryptographic algorithms that could allo… |
CVE-2017-16718 | Medium | 5.9 | 2018-06-27 | Beckhoff TwinCAT 3 supports communication over ADS. ADS is a protocol for industrial automation in protected environments. This protocol uses user configured r… |
CVE-2018-12420 | High | 7.5 | 2018-06-14 | IceHrm before 23.0.1.OS has a risky usage of a hashed password in a request. |
CVE-2018-5152 | Medium | 6.5 | 2018-06-11 | WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to network traffic to the si… |
CVE-2018-1000180 | High | 7.5 | 2018-06-05 | Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pai… |
CVE-2015-9235 | Critical | 9.8 | 2018-05-29 | In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES fami… |
CVE-2018-11209 | High | 7.2 | 2018-05-16 | An issue was discovered in Z-BlogPHP 2.0.0. zb_system/cmd.php?act=verify relies on MD5 for the password parameter, which might make it easier for attackers to… |
CVE-2017-12129 | High | 8.0 | 2018-05-14 | An exploitable Weak Cryptography for Passwords vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. An attacker could inte… |
CVE-2018-6619 | High | 7.8 | 2018-05-11 | Easy Hosting Control Panel (EHCP) v0.37.12.b makes it easier for attackers to crack database passwords by leveraging use of a weak hashing algorithm without a… |
CVE-2018-10831 | High | 7.5 | 2018-05-09 | Z-NOMP before 2018-04-05 has an incorrect Equihash solution verifier that allows attackers to spoof mining shares, as demonstrated by providing a solution with… |
CVE-2018-0737 | Medium | 5.9 | 2018-04-16 | The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cac… |
CVE-2018-5382 | Medium | 4.4 | 2018-04-16 | The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle releas… |
CVE-2018-10084 | High | 8.8 | 2018-04-13 | CMS Made Simple (CMSMS) through 2.2.6 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the eff_uid value within… |
CVE-2018-5458 | High | 7.5 | 2018-03-26 | Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have a vulnerability using SSL legacy encryption that could allow an attacker to gain unauthorized… |
CVE-2017-15326 | Medium | 4.3 | 2018-03-23 | DBS3900 TDD LTE V100R003C00, V100R004C10 have a weak encryption algorithm security vulnerability. DBS3900 TDD LTE supports SSL/TLS protocol negotiation using i… |
CVE-2018-1428 | Medium | 6.2 | 2018-03-22 | IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) uses weaker than expected cryptographic algorithms that could allow an attacker to de… |
CVE-2017-1571 | Medium | 5.1 | 2018-03-22 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 uses weaker than expected cryptographic algorithms that could allow… |
CVE-2017-17167 | Medium | 5.9 | 2018-03-09 | Huawei DP300 V500R002C00; TP3206 V100R002C00; ViewPoint 9030 V100R011C02; V100R011C03 have a use of a broken or risky cryptographic algorithm vulnerability. Th… |
CVE-2017-17428 | Medium | 5.9 | 2018-03-05 | Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenba… |
CVE-2018-7211 | High | 8.1 | 2018-02-18 | An issue was discovered in iDashboards 9.6b. The SSO implementation is affected by a weak obfuscation library, allowing man-in-the-middle attackers to discover… |
CVE-2018-6829 | High | 7.5 | 2018-02-07 | cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive… |
CVE-2017-17878 | Critical | 9.8 | 2017-12-27 | An issue was discovered in Valve Steam Link build 643. Root passwords longer than 8 characters are truncated because of the default use of DES (aka the CONFIG_… |
CVE-2017-1598 | High | 7.5 | 2017-12-20 | IBM Security Guardium 10.0 Database Activity Monitor uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitiv… |
CVE-2017-17717 | Critical | 9.8 | 2017-12-17 | Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature. |
CVE-2017-17382 | Medium | 5.9 | 2017-12-13 | Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.5 before build 67.13, 11.0 before build 71.22, 11.1 before build 56.19, and 12… |
CVE-2017-8866 | Medium | 5.9 | 2017-12-11 | Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 share a fixed small pool of hardcoded keys, allowing a remote attacker to use a dif… |
CVE-2017-8191 | Medium | 5.9 | 2017-11-22 | FusionSphere OpenStack V100R006C00SPC102(NFV)has a week cryptographic algorithm vulnerability. Attackers may exploit the vulnerability to crack the cipher text… |
CVE-2017-8157 | Medium | 5.9 | 2017-11-22 | OceanStor 5800 V3 with software V300R002C00 and V300R002C10, OceanStor 6900 V3 V300R001C00 has an information leakage vulnerability. Products use TLS1.0 to enc… |
CVE-2012-4449 | Critical | 9.8 | 2017-10-30 | Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security features are enabled… |
CVE-2015-0226 | High | 7.5 | 2017-10-30 | Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, whic… |
CVE-2017-15998 | High | 7.5 | 2017-10-29 | In the "NQ Contacts Backup & Restore" application 1.1 for Android, DES encryption with a static key is used to secure transmitted contact data. This makes it e… |
CVE-2017-15997 | High | 7.8 | 2017-10-29 | In the "NQ Contacts Backup & Restore" application 1.1 for Android, RC4 encryption is used to secure the user password locally stored in shared preferences. Bec… |
CVE-2017-14937 | Medium | 4.7 | 2017-10-20 | The airbag detonation algorithm allows injury to passenger-car occupants via predictable Security Access (SA) data to the internal CAN bus (or the OBD connecto… |
CVE-2017-1339 | Medium | 4.4 | 2017-10-05 | IBM Spectrum Protect 7.1 and 8.1 (formerly Tivoli Storage Manager) Server uses weak encryption for the password. A database administrator may be able to decryp… |
CVE-2014-9969 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, the GPS client may use an insecure cryptographic algorithm. |
CVE-2017-9859 | Critical | 9.8 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. The inverters make use of a weak hashing algorithm to encrypt the password for REGISTER requests. Thi… |
CVE-2017-11133 | High | 7.5 | 2017-08-01 | An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. To encrypt messages, AES… |
CVE-2017-10668 | Medium | 5.9 | 2017-06-30 | A Padding Oracle exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET). Under an MITM condition wit… |
CVE-2017-9466 | Critical | 9.8 | 2017-06-26 | The executable httpd on the TP-Link WR841N V8 router before TL-WR841N(UN)_V8_170210 contained a design flaw in the use of DES for block encryption. This result… |
CVE-2016-3099 | High | 7.5 | 2017-06-08 | mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation… |
CVE-2014-8687 | Critical | 9.8 | 2017-06-08 | Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root privileges by leveraging use of a stati… |
CVE-2017-4917 | Critical | 9.8 | 2017-06-07 | VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x locally stores vCenter Server credentials using reversible encryption. This issue may allow… |
CVE-2017-5243 | High | 8.5 | 2017-06-06 | The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other imp… |
CVE-2017-9136 | High | 7.5 | 2017-05-21 | An issue was discovered on Mimosa Client Radios before 2.2.3. In the device's web interface, there is a page that allows an attacker to use an unsanitized GET… |
CVE-2017-5186 | High | 7.5 | 2017-04-27 | Novell iManager 2.7 before SP7 Patch 9, NetIQ iManager 3.x before 3.0.2.1, Novell eDirectory 8.8.x before 8.8 SP8 Patch 9 Hotfix 2, and NetIQ eDirectory 9.x be… |
CVE-2016-6485 | High | 7.5 | 2017-03-01 | The __construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, w… |
CVE-2016-8370 | High | 7.5 | 2017-02-13 | An issue was discovered in Mitsubishi Electric Automation MELSEC-Q series Ethernet interface modules QJ71E71-100, all versions, QJ71E71-B5, all versions, and Q… |