Weakness (CWE)
CWE-326: Inadequate Encryption Strength
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
How to prevent it (1 mitigation)
-
Architecture and Design
Use an encryption scheme that is currently considered to be strong by experts in the field.
Source: MITRE CWE-326
246 results · Feed
-
Medium 4.3
Exposure of unencrypted plaintext hash in github.com/aws/aws-sdk-go
The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field, but older SDK versi…
-
Medium 6.5
Collision of hash values in github.com/bnb-chain/tss-lib
IO FinNet tss-lib before 2.0.0 allows a collision of hash values.
-
Medium 6.0
HCL BigFix Platform is affected by insecure credential storage
In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent.
-
High 7.5
The Config-files of Horner Automation’s RCC 972 with firmware version 15.40 are encrypted with weak XOR encryption vuln…
-
High 8.0
Whole-script approval in Jenkins Script Security Plugin vulnerable to SHA-1 collisions
Jenkins Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script approvals as the SHA-1 hash of the script, making it vulnerable to collision attacks.
-
Medium 5.9
HCL Verse for Android is susceptible to an APK signing key check vulnerability
The application was signed using a key length less than or equal to 1024 bits, making it potentially vulnerable to forged digital signatures. An attacker could forge the same digital signature of the app after maliciously modifying the app.
-
Medium 5.2
SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses encryption method which lacks proper diffusi…
-
Medium 6.5
Hashed Credential Exposure Vulnerability
An entity in Network Configuration Manager product is misconfigured and exposing password field to Solarwinds Information Service (SWIS). Exposed credentials are encrypted and require authenticated access with an NCM role.
-
Low 3.6
Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a4.
-
High 7.5CVE-2022-35513 Public exploit
Blink1Control2 uses weak password encryption
The Blink1Control2 application <= 2.2.7 uses weak password encryption and an insecure method of storage.
-
Medium 6.5
Update
Passwords are not adequately encrypted during the communication process between all versions of LS Industrial Systems (LSIS) Co. Ltd LS Electric XG5000 software prior to V4.0 and LS Electric PLCs: all versions of XGK-CPUU/H/A/S/E prior to V3.50, all versions …
-
High 8.8
Inadequate encryption strength for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to pot…
-
Unscored —
Weak Master Keys
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encoded resulti…
-
Unscored —
Execution of Untrusted Macros Due to Improper Certificate Validation
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector fo…
-
High 7.5CVE-2022-2097 Public exploit
AES OCB fails to encrypt some bytes
AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the…
-
High 7.5
Reversible One-Way Hash and Use of a Broken or Risky Cryptographic Algorithm in io.github.javaezlib.JavaEZ
JavaEZ is a library that adds new functions to make Java easier. A weakness in JavaEZ 1.6 allows force decryption of locked text by unauthorized actors. The issue is NOT critical for non-secure applications, however may be critical in a situation where the hi…
-
Low 3.8
Emerson OpenEnterprise - Inadequate Encryption Strength
Inadequate encryption may allow the credentials used by Emerson OpenEnterprise, up through version 3.3.5, to access field devices and external systems to be obtained.
-
Medium 5.4
Crypto script service uses hashing algorithm SHA1 with RSA for certificate signature in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The XWiki Crypto API will generate X509 certificates signed by default using SHA1 with RSA, which is not considered safe anymore for use in certificate si…
-
Medium 5.6
Clients may connect to a GateManager with TLS 1.0
Inadequate Encryption Strength vulnerability in TLS stack of Secomea SiteManager, LinkManager, GateManager may facilitate man in the middle attacks. This issue affects: Secomea SiteManager All versions prior to 9.7. Secomea LinkManager versions prior to 9.7. …
-
Medium 6.2
Hills ComNav Inadequate Encryption Strength
Hills ComNav version 3002-19 suffers from a weak communication channel. Traffic across the local network for the configuration pages can be viewed by a malicious actor. The size of certain communications packets are predictable. This would allow an attacker t…
-
High 7.5
MDT AutoSave Inadequate Encryption Strength
An attacker could decipher the encryption and gain access to MDT AutoSave versions prior to v6.02.06.
-
Low 3.7
Discoverability of user password hash in Statamic CMS
Statamic is a Laravel and Git powered CMS. Before versions 3.2.39 and 3.3.2, it is possible to confirm a single character of a user's password hash using a specially crafted regular expression filter in the users endpoint of the REST API. Multiple such reques…
-
Medium 6.7
A vulnerability has been identified in RUGGEDCOM i800 (All versions < V4.3.8), RUGGEDCOM i801 (All versions < V4.3.8), …
-
Medium 6.5
ICSA-20-140-02 Emerson OpenEnterprise
Inadequate encryption may allow the passwords for Emerson OpenEnterprise versions through 3.3.4 user accounts to be obtained.
-
Unscored —
A CWE-326: Inadequate Encryption Strength vulnerability exists that could cause non-encrypted communication with the se…
-
High 7.5
Hardcoded credentials
Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encryption class, the cipher is initialized with a hardcoded key and IV. If users use class PasswordPlacehol…
-
Medium 5.9
Hash collision in typelevel jawn
Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack which may result in a denial of service. Most applicat…
-
Medium 6.5
Dell Wyse Management Suite version 3.3.1 and prior support insecure Transport Security Protocols TLS 1.0 and TLS 1.1 wh…
-
High 7.5
Use of Password Hash With Insufficient Computational Effort and Use of a Broken or Risky Cryptographic Algorithm and Reversible One-Way Hash in hashing.py
EnroCrypt is a Python module for encryption and hashing. Prior to version 1.1.4, EnroCrypt used the MD5 hashing algorithm in the hashing file. Beginners who are unfamiliar with hashes can face problems as MD5 is considered an insecure hashing algorithm. The v…
-
Medium 6.4
InHand Networks IR615 Router
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 have inadequate encryption strength, which may allow an attacker to intercept the communication and steal sensitive information or hijack the session.
-
Medium 5.3
Missing Cryptographic Step in star7th/showdoc
showdoc is vulnerable to Missing Cryptographic Step
-
Unscored —
In VOS compromised, an attacker at network endpoints can possibly view communications between an unsuspecting user and …
-
Unscored —
A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected products …
-
High 7.5
Dell PowerScale OneFS 8.1.0 - 9.1.0 contains an LDAP Provider inability to connect over TLSv1.2 vulnerability. It may m…
-
Unscored —
SSH server configuration file does not implement some best practices. This could lead to a weakening of the SSH protoco…
-
High 8.1
Partial secret key disclosure, improper safety number calculation, & inadequate encryption strength
Wrongthink peer-to-peer, end-to-end encrypted messenger with PeerJS and Axolotl ratchet. In wrongthink from version 2.0.0 and before 2.3.0 there was a set of vulnerabilities causing inadequate encryption strength. Part of the secret identity key was disclosed…
-
Low 2.2
IBM Security Verify Information Queue information disclosure
IBM Security Verify Information Queue 1.0.6 and 1.0.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 196184.
-
Unscored —
A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward…
-
High 7.5
RSA vulnerability in tslite-ng
tlslite-ng is an open source python library that implements SSL and TLS cryptographic protocols. In tlslite-ng before versions 0.7.6 and 0.8.0-alpha39, the code that performs decryption and padding check in RSA PKCS#1 v1.5 decryption is data dependant. In par…
-
High 7.1
A CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 (all references, all versions) that coul…