Weakness (CWE)
CWE-310: Cryptographic Issues
Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
Source: MITRE CWE-310
15 results · Clear filters · Feed
-
High 7.0
Cryptography Implementation Flaw vulnerability in ZTE ZXUniPOS NDS-LTE product
An insecure password scheme refers to vulnerabilities arising from improper selection of encryption algorithms, inadequate key management, or flawed code implementation, which may lead to data leakage or tampering, such as hard-coded keys or the use of weak e…
-
High 7.1
Cryptographic Issues in Core
Cryptographic issue while performing RSA PKCS padding decoding.
-
High 7.1
Cryptographic Issues in Automotive
Cryptographic issue while processing crypto API calls, missing checks may lead to corrupted key usage or IV reuses.
-
High 8.2
Cryptographic Issues in BT Controller
Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.
-
High 7.8
Windows Cryptographic Services Security Feature Bypass Vulnerability
Windows Cryptographic Services Security Feature Bypass Vulnerability
-
High 7.1
Cryptographic Issues in Automotive
Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data.
-
High 7.5
RVTools, Version 3.9.2 and above, contain a sensitive data exposure vulnerability in the password encryption utility (R…
-
High 7.1
Cryptographic issue in Core
information disclosure due to cryptographic issue in Core during RPMB read request.
-
High 7.5
A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not c…
-
High 7.2
PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests
PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. An attacker with the ability to execute code on the target machine maybe able to exploit and spoof the local Java service us…
-
High 7.7
PingID Mac Login prior to 1.1 vulnerable to pre-computed dictionary attacks
A misconfiguration of RSA in PingID Mac Login prior to 1.1 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass.
-
High 8.0
PingID Desktop encryption libraries misconfiguration can lead to sensitive data exposure
PingID Desktop prior to 1.7.3 has a misconfiguration in the encryption libraries which can lead to sensitive data exposure. An attacker capable of exploiting this vulnerability may be able to successfully complete an MFA challenge via OTP.
-
High 7.7
PingID Windows Login RSA cryptographic weakness with possible offline MFA bypass
A misconfiguration of RSA in PingID Windows Login prior to 2.7 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass.
-
High 7.6CVE-2019-9506 Public exploit
Blutooth BR/EDR specification does not specify sufficient encryption key length and allows an attacker to influence key length negotiation
The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can dec…
-
High 8.1
golang.org/x/crypto/ssh Man-in-the-Middle attack
The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism.