Weakness (CWE)
CWE-326: Inadequate Encryption Strength
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
How to prevent it (1 mitigation)
-
Architecture and Design
Use an encryption scheme that is currently considered to be strong by experts in the field.
Source: MITRE CWE-326
246 results · Feed
-
High 8.0
Insecure IPsec transport encryption in Cilium
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Users of IPsec transparent encryption in Cilium may be vulnerable to cryptographic attacks that render the transparent encryption ineffective. In particular, Cilium is …
-
Medium 4.5
IBM Security Verify Directory information disclosure
IBM Security Verify Directory 10.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 228444.
-
High 7.8
Information Disclosure Vulnerability in CDAC AppSamvid Software
This vulnerability exists in AppSamvid software due to the usage of a weaker cryptographic algorithm (hash) SHA1 in user login component. An attacker with local administrative privileges could exploit this to obtain the password of AppSamvid on the targeted s…
-
High 7.1
Information Disclosure Vulnerability in CDAC USB Pratirodh
This vulnerability exists in USB Pratirodh due to the usage of a weaker cryptographic algorithm (hash) SHA1 in user login component. A local attacker with administrative privileges could exploit this vulnerability to obtain the password of USB Pratirodh on th…
-
Medium 6.8CVE-2024-22894 Public exploit
An issue fixed in AIT-Deutschland Alpha Innotec Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later and Nove…
-
High 7.5
Dex 2.37.0 is discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers
Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. `cmd/dex/serve.go` line 425 seemingly sets TLS 1.2 as minimum version, but the whole `tlsConfig` is ignored …
-
Medium 5.7
Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
-
High 7.5
upydev has weak encryption padding
An issue in /upydev/keygen.py in upydev v0.4.3 allows attackers to decrypt sensitive information via weak encryption padding.
-
High 7.5
esptool allows attackers to view sensitive information via weak cryptographic algorithm
An issue discovered in esptool 4.6.2 allows attackers to view sensitive information via weak cryptographic algorithm.
-
Medium 5.9
Weak ciphers vulnerability in Softing smartLink SW-HT
Weak ciphers in Softing smartLink SW-HT before 1.30 are enabled during secure communication (SSL).
-
High 7.5
mycli has Inadequate Encryption Strength
Inadequate encryption strength in mycli 1.27.0 allows attackers to view sensitive information via /mycli/config.py
-
Medium 5.9
Dell Data Protection Central, version 19.9, contains an Inadequate Encryption Strength Vulnerability. An unauthenticate…
-
Unscored —
Vulnerability of 5G messages being sent without being encrypted in a VPN environment in the SMS message module. Success…
-
High 7.1
QTS, QuTS hero
An inadequate encryption strength vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows local network clients to decrypt the data using brute force attacks via unspecified vectors. We have already fi…
-
Unscored —
Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by server
Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by server
-
Unscored —
In updatePictureInPictureMode of ActivityRecord.java, there is a possible bypass of background launch restrictions due …
-
Unscored —
In openMmapStream of AudioFlinger.cpp, there is a possible way to record audio without displaying the microphone privac…
-
Medium 6.8
Windows Remote Desktop Protocol Security Feature Bypass
Windows Remote Desktop Protocol Security Feature Bypass
-
Medium 5.9
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versi…
-
High 7.6
Inadequate Encryption Strength
AMI SPx contains a vulnerability in the BMC where a user may cause an inadequate encryption strength by hash-based message authentication code (HMAC). A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availabilit…
-
Unscored —
An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3. Because it doesn't use EditEntit…
-
High 8.3
** UNSUPPORTED WHEN ASSIGNED ** [An attacker can capture an authenticating hash and utilize it to create new sessions. …
-
Unscored —
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.4. An app may be able to break ou…
-
Medium 5.5
Marval MSM through 14.19.0.12476 uses a static encryption key for secrets. An attacker that gains access to encrypted s…
-
Medium 6.5
Under certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm. This ma…
-
Medium 5.9
Bramble Handshake Protocol (BHP) in Briar before 1.5.3 is not forward secure: eavesdroppers can decrypt network traffic…
-
Low 3.3
Dgraph Audit Log Encryption nonce reuse
Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. The first 12 bytes come from a baseIv which is initialized when an audit log is created. The last 4 bytes come fro…
-
Medium 6.5
Canon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: OS X 10.9.5-macOS 13),IJ Network Tool/Ver.4.7.3 and earlier …
-
High 7.7
CODESYS V3 prone to Inadequate Encryption Stregth
Inadequate Encryption Strength in CODESYS Development System V3 versions prior to V3.5.18.40 allows an unauthenticated local attacker to access and manipulate code of the encrypted boot application.
-
High 7.8CVE-2023-21109 Public exploit
In multiple places of AccessibilityService, there is a possible way to hide the app from the user due to a logic error …
-
Low 2.5
Vault Enterprise Vulnerable to Padding Oracle Attacks When Using a CBC-based Encryption Mechanism with a HSM
HashiCorp Vault Enterprise 1.13.0 up to 1.13.1 is vulnerable to a padding oracle attack when using an HSM in conjunction with the CKM_AES_CBC_PAD or CKM_AES_CBC encryption mechanisms. An attacker with privileges to modify storage and restart Vault may be able…
-
Medium 5.5
Improper usage of symmetric encryption in UI Desktop for Windows (Version 0.59.1.71 and earlier) could allow users with…
-
Medium 6.7
A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions…
-
High 7.2
Inadequate encryption strength vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker w…
-
Critical 9.1
Apache Linkis gateway module token authentication bypass
In Apache Linkis <=1.3.1, due to the default token generated by Linkis Gateway deployment being too simple, it is easy for attackers to obtain the default token for the attack. Generation rules should add random values. We recommend users upgrade the version …
-
Critical 9.8
Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and p…
-
Medium 5.5
SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) con…
-
High 7.5
Improper cryptographic implementation in Samsung Flow for PC 4.9.14.0 allows adjacent attackers to decrypt encrypted me…
-
High 7.5
Improper cryptographic implementation in Samsung Flow for Android prior to version 4.9.04 allows adjacent attackers to …
-
High 7.1
Weak DES encryption
DES cipher, which has inadequate encryption strength, is used Hitachi Energy FOXMAN-UN to encrypt user credentials used to access the Network Elements. Successful exploitation allows sensitive information to be decrypted easily. This issue affects * FOXMAN-U…