Weakness (CWE)
CWE-757: Algorithm Downgrade
A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used in a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.
Source: MITRE CWE-757
7 results · Clear filters · Feed
-
Critical 9.2
Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade
Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of Apache PLC4X (PLC4J) allows an attacker in a network position between client and server to impersonate the OPC UA server and to read, forge or modify …
-
Critical 9.8
Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify
Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify. verify resolves the signature method class from the signature_method parameter of the incoming message. signature_method is required on every request, so th…
-
Critical 9.8
Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token
Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token. Passing a callback to the constructor selects OAuth 1.0a. get_request_token then revokes that choice when the reque…
-
Critical 9.1
TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication
The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates the negotia…
-
Critical 9.1
An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 18.3 and iPadOS 18.3, m…
-
Critical 9.1
Protocol Downgrade in Wapro ERP Desktop
Wapro ERP Desktop is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification. This issue affects Wapro ERP Desktop versions before 9.00.0.
-
Critical 9.1
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allow…