CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation
To fulfill the need for a cryptographic primitive, the product implements a cryptographic algorithm using a non-standard, unproven, or disallowed/non-compliant cryptographic implementation.
A kind of CWE-327 Use of a Broken or Risky Cryptographic Algorithm.
From the CWE List. © The MITRE Corporation.
Newest
- switchbot lock, app, keypad +7 more +9 more Misuse and Misconfiguration of Cryptographic Algorithm in Bluetooth Communication 8.5 High
- hclsoftware hcl hive HCL Hive is affected by use of a cryptographic primitive with a risky implementation 5.3 Medium
- hclsoftware hcl hive HCL Hive is affected by use of a cryptographic primitive with a risky implementation 7.4 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +14 more +16 more Windows Key Guard Security Feature Bypass Vulnerability 5.5 Medium
- zte zxunipos nds-lte Function Abusement Vulnerability in ZTE ZXUniPOS NDS-LTE 3.8 Low
- plonky3 Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss 8.9 High
- apache tomcat, red hat enterprise linux 10, enterprise linux 10.0 extended update support +18 more +20 more Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default 7.5 High
- ibm concert Multiple Vulnerabilities in IBM Concert Software 5.9 Medium
-
libcrux-ed25519crates.io libcrux has All-Zero Key Generation Upon Catastrophic RNG Failure 8.2 High - refraction-networking utls uTLS has a Chrome Parrot Fingerprint Vulnerability due to GREASE ECH Cipher Suite Mismatch 2.3 Low
- parsec.cloud parsec, scille parsec-cloud +1 more `libparsec_crypto` does not check for weak order point of curve 25519 8.3 High
- apache streampark Apache StreamPark: Uses the user’s password as the secret key 5.9 Medium
- rustcrypto signatures RustCrypto: Signatures has timing side-channel in ML-DSA decomposition 6.4 Medium
- dell cloudlink Dell CloudLink, versions prior to 8.2, contain use of a Cryptographic Primitive with a Risky... 6.7 Medium
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +19 more +21 more Windows Cryptographic Services Information Disclosure Vulnerability 7.8 High
- microsoft windows server 2022 Windows Cryptographic Services Information Disclosure Vulnerability 5.5 Medium
- davidosipov postquantum-feldman-vss Post-Quantum Secure Feldman's Verifiable Secret Sharing has Inadequate Fault Injection Countermeasures in `secure_redundant_execution` 5.4 Medium
-
ellipticnpm,node-ellipticDebian,@rootio/ellipticRoot +2 more Elliptic Cryptanalysis vulnerability when `k` has leading zeros 5.6 Medium - dell powerprotect dd, data domain operating system +1 more Dell PowerProtect DD, versions prior to DDOS 8.3.0.0, 7.10.1.50, and 7.13.1.10 contains a use of... 3.7 Low
- 0xpolygonzero plonky2 Soundness issue with Plonky2 look up tables 8.6 High
-
pqcrypto-hqccrates.io PQClean has a correctness error in HQC decapsulation No score - dell cloudlink Dell Key Trust Platform, v3.0.6 and prior, contains Use of a Cryptographic Primitive with a Risky... 3.8 Low
-
illuminate/encryptionPackagist Laravel Encrypter Failure to decryption vulnerability No score - silabs emberznet, silabs.com ember znet sdk +1 more Silicon Labs EFR32xxx parts with classic key storage do not use hardware accelerated AES-CCM 6.2 Medium
- b&r industrial automation automation studio, technology guarding +1 more B&R products use insufficient communication encryption 8.3 High
- b&r industrial automation automation runtime FTP uses unsecure encryption mechanisms 9.8 Critical
- flarum framework Laravel has a File Validation Bypass 6.9 Medium
- flarum framework, debian linux +1 more Laravel allows environment manipulation via query string 8.7 High
- laravel framework SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database 8.8 High
- flarum framework, laravel +1 more Query Binding Exploitation in Laravel 7.2 High
- laravel SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database 7.5 High
- laravel, laravel framework +1 more Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior 8.1 High
- laravel In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as... 7.5 High
- laravel Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior 5.9 Medium
- sodiumoxide project sodiumoxide scalarmult() vulnerable to degenerate public keys 6.5 Medium