Skip to content

CWE-310: Cryptographic Issues

Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

From the CWE List. © The MITRE Corporation.

Newest

bea weblogic serverSSL libraries in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold...CVE-2007-46136.8 MediumAugust 31, 2007
linux kernelThe xfer_secondary_pool function in drivers/char/random.c in the Linux kernel 2.4 before 2.4.35...CVE-2007-43116.8 MediumAugust 13, 2007
clavister coreplusThe IKE implementation in Clavister CorePlus before 8.80.03, and 8.80.00, does not properly...CVE-2007-38055.4 MediumJuly 16, 2007
sun chainkey java code protectionChainKey Java Code Protection allows attackers to decompile Java class files via a Java class...CVE-2007-00144.4 MediumJanuary 17, 2007
ozeki http-sms gatewayOzeki HTTP-SMS Gateway 1.0, and possibly earlier, stores usernames and passwords in plaintext in...CVE-2006-66742.1 LowDecember 21, 2006
biba software seleniumserver ftp serverSeleniumServer FTP Server 1.0, and possibly earlier, stores user passwords in plaintext in the...CVE-2006-598210.0 HighNovember 20, 2006
openssl, red hat enterprise linux 10, enterprise linux 3 +11 more +13 moreOpenssl: openssl: signature forgery via improper pkcs-1 padding removal leading to certificate validation bypassCVE-2006-4339Fix available9.1 CriticalSeptember 5, 2006
freebsd, linux kernel +1 moreThe Linux kernel before 2.6.16.9 and the FreeBSD kernel, when running on AMD64 and other 7th and...CVE-2006-10562.1 LowApril 20, 2006
solar designer crypt blowfishThe crypt_gensalt functions for BSDI-style extended DES-based and FreeBSD-sytle MD5-based...CVE-2006-05911.2 LowFebruary 8, 2006
oracle database serverUnspecified vulnerability in the Transparent Data Encryption (TDE) Wallet component of Oracle...CVE-2006-027010.0 HighJanuary 18, 2006
christian ghisler total commanderTotal Commander 6.53 uses weak encryption to store FTP usernames and passwords in WCX_FTP.INI,...CVE-2005-40664.9 MediumDecember 7, 2005
nortel contivityNortel VPN client 5.01 stores the cleartext password in the memory of the Extranet.exe process,...CVE-2005-08444.6 MediumMarch 24, 2005
heiko stamer openskatThe CheckGroup function in openSkat VTMF before 2.1 generates public key pairs in which the "p"...CVE-2004-27214.3 MediumDecember 31, 2004
clearswift mailsweeper business suite i, mailsweeper for smtp, mailsweeper business suite ii +1 more +3 moreClearswift MIMEsweeper 5.0.5, when it has been upgraded from MAILsweeper for SMTP version 4.3 or...CVE-2004-27034.3 MediumDecember 31, 2004
flashfxpFlashFXP 1.4 uses a weak encryption algorithm for user passwords, which allows attackers to...CVE-2003-14836.4 MediumDecember 31, 2003
mysqlMySQL 3.20 through 4.1.0 uses a weak algorithm for hashed passwords, which makes it easier for...CVE-2003-1480Public exploit4.3 MediumDecember 31, 2003
ibm websphere application serverIBM WebSphere Advanced Server Edition 4.0.4 uses a weak encryption algorithm (XOR and base64...CVE-2003-14471.9 LowDecember 31, 2003
research triangle software cryptobuddy, microsoft all windows +1 moreCryptoBuddy 1.0 and 1.2 does not use the user-supplied passphrase to encrypt data, which could...CVE-2003-13926.6 MediumDecember 31, 2003
research triangle software cryptobuddyRTS CryptoBuddy 1.0 and 1.2 uses a weak encryption algorithm for the passphrase and generates...CVE-2003-13917.5 HighDecember 31, 2003
research triangle software cryptobuddyRTS CryptoBuddy 1.2 and earlier stores bytes 53 through 55 of a 55-byte passphrase in plaintext,...CVE-2003-13907.5 HighDecember 31, 2003
research triangle software cryptobuddyRTS CryptoBuddy 1.2 and earlier truncates long passphrases without warning the user, which may...CVE-2003-13897.5 HighDecember 31, 2003
trend micro virus control systemTrend Micro Virus Control System (TVCS) Log Collector allows remote attackers to obtain usernames...CVE-2003-1344Public exploit5.0 MediumDecember 31, 2003
cisco iosCisco IOS 12.2 and earlier generates a "% Login invalid" message instead of prompting for a...CVE-2003-05125.0 MediumJuly 29, 2003
cisco as5350** DISPUTED ** Cisco AS5350 IOS 12.2(11)T with access control lists (ACLs) applied and possibly...CVE-2002-2379Public exploitDisputed7.8 HighDecember 31, 2002
apple mac os xThe default configuration of Mail.app in Mac OS X 10.0 through 10.0.4 and 10.1 through 10.1.5...CVE-2002-23265.0 MediumDecember 31, 2002
3d3.com shopfactory3D3.Com ShopFactory 5.8 uses client-side encryption and decryption for sensitive price data,...CVE-2002-23037.8 HighDecember 31, 2002
solarwinds serv-u file serverThe remote administration client for RhinoSoft Serv-U 3.0 sends the user password in plaintext...CVE-2001-14637.5 HighNovember 19, 2001
openbsd openssh, ssh +1 moreImplementations of SSH version 1.5, including (1) OpenSSH up to version 2.3.0, (2) AppGate, and ...CVE-2001-03614.0 MediumJune 27, 2001
coffeecup software free ftp, direct ftp +1 moreCoffeeCup Direct and Free FTP clients uses weak encryption to store passwords in the FTPServers...CVE-2001-01034.6 MediumFebruary 2, 2001
sshThe SSH-1 protocol allows remote servers to conduct man-in-the-middle attacks and replay a client...CVE-2001-14737.5 HighJanuary 18, 2001
sawmillSawMill 5.0.21 uses weak encryption to store passwords, which allows attackers to easily decrypt...CVE-2000-0589Public exploit7.5 HighJune 26, 2000