Weakness (CWE)
CWE-757: Algorithm Downgrade
A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used in a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.
Source: MITRE CWE-757
45 results · Feed
-
Medium 5.4CVE-2020-10135 Public exploit
Bluetooth devices supporting BR/EDR v5.2 and earlier are vulnerable to impersonation attacks
Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. An unauthenticated, adjacent att…
-
High 7.4
A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly c…
-
Medium 6.9
downgrade of effective Strict Transport Security (STS) policy in postfix-mta-sts-resolver
In postfix-mta-sts-resolver before 0.5.1, All users can receive incorrect response from daemon under rare conditions, rendering downgrade of effective STS policy.
-
Medium 6.5
eDirectory LDAP peer certificate validation issue
In Novell eDirectory before 9.0.3.1 the LDAP interface was not strictly enforcing cipher restrictions allowing weaker ciphers to be used during SSL BIND operations.
-
High 7.7
lack of keypinning in libzypp could lead to repository switching
In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.