Skip to content
OpenAdvisories

Weakness (CWE)

CWE-326: Inadequate Encryption Strength

Class Draft

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

How to prevent it (1 mitigation)

  1. Architecture and Design

    Use an encryption scheme that is currently considered to be strong by experts in the field.

Source: MITRE CWE-326

All Critical High Medium Low Exploited only Public exploit

90 results · Clear filters · Feed

  • Medium 6.5
    CVE-2019-19101

    Incomplete communication encryption and validation in B&R Automation Studio upgrade service

    A missing secure communication definition and an incomplete TLS validation in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, < 4.3.11SP, < 4.4.9SP, < 4.5.5SP, < 4.6.4 and < 4.7.2 enable unauthenticated users to perform MITM attacks…

    B&R Automation Studio
  • Medium 5.9
    CVE-2019-19097

    ABB eSOMS: SSL medium strength Cipher Suites

    ABB eSOMS versions 4.0 to 6.0.3 accept connections using medium strength ciphers. If a connection is enabled using such a cipher, an attacker might be able to eavesdrop and/or intercept the connection.

    ABB eSOMS ICS / OT
  • Medium 5.3
    CVE-2019-14855

    A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An at…

    Red Hat gnupg2 gnupg2 gnupg2 Debian Ubuntu Alpine
  • Medium 4.8
    CVE-2010-3670

    TYPO3 is vulnerable to insecure randomness during hash generation in forgot password function

    TYPO3 before 4.3.4 and 4.4.x before 4.4.1 contains insecure randomness during generation of a hash with the "forgot password" function.

    typo3/cms-frontend Packagist
  • Medium 4.3
    CVE-2017-2598

    Inadequate Encryption Strength in Jenkins

    Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored secrets vulnerable to unnecessary risks (SECURITY-304).

    [UNKNOWN] jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  • Medium 5.9
    CVE-2017-12871

    SimpleSAMLphp Incorrect IV generation for encryption

    The aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.x through 1.14.11 makes it easier for context-dependent attackers to bypass the encryption protection mechanism by leveraging use of the first 16 bytes of the secret key as the ini…

    simplesamlphp simplesamlphp simplesamlphp/simplesamlphp Debian Ubuntu Packagist
  • Medium —
    CVE-2013-6372

    Jenkins Subversion Plugin Stores Credentials with Base64 Encoding

    The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file.

    org.jenkins-ci.plugins:subversion Maven
  • Medium —
    CVE-2012-5575 Public exploit

    Inadequate Encryption Strength in Apache CXF

    Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force…

    org.apache.cxf:cxf-rt-transports-http Maven
  • Medium 5.3
    CVE-2012-3458

    Beaker Sensitive Information Disclosure vulnerability

    Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors.

    beaker beaker Debian PyPI
  • Medium 5.5
    CVE-2002-1975

    Sharp Zaurus PDA SL-5000D and SL-5500 uses a salt of "A0" to encrypt the screen-locking password as stored in the Secur…