CWE-310: Cryptographic Issues
Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
From the CWE List. © The MITRE Corporation.
Newest
- vsecurity tandberg video communication serverThe SSH service on the TANDBERG Video Communication Server (VCS) before X5.1 uses a fixed DSA key...8.5 High
- stafford.uklinux libesmtpThe match_component function in smtp-tls.c in libESMTP 1.0.3.r1, and possibly other versions...6.8 Medium
- stafford.uklinux libesmtplibESMTP, probably 1.0.4 and earlier, does not properly handle a '\0' character in a domain name...6.8 Medium
- apple mac os x, mac os x server +1 moreMail in Apple Mac OS X before 10.6.3 does not properly enforce the key usage extension during...5.0 Medium
- microsoft 27mhz wireless keyboardThe Microsoft wireless keyboard uses XOR encryption with a key derived from the MAC address,...7.6 High
- phpThe Linear Congruential Generator (LCG) in PHP before 5.2.13 does not provide the expected...6.4 Medium
- cisco iosThe IKE implementation in Cisco IOS 12.2 through 12.4 on Cisco 7200 and 7301 routers with VAM2+...7.8 High
- opensslOpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed...4.0 Medium
- novell edirectoryThe dhost web service in Novell eDirectory 8.8.5 uses a predictable session cookie, which makes...7.5 High
- microsoft windows 2000, windows 7, windows server 2008 +3 more +5 moreThe SMB implementation in the Server service in Microsoft Windows 2000 SP4, Windows XP SP2 and...10.0 High
- ibm websphere commerceIBM WebSphere Commerce 7.0 does not properly encrypt data in a database, which makes it easier...1.5 Low
- ibm websphere commerceIBM WebSphere Commerce 7.0 uses the same cryptographic key for session attributes and merchant...4.3 Medium
- zeus web serverZeus Web Server before 4.3r5 does not use random transaction IDs for DNS requests, which makes it...5.0 Medium
- phpmyadminphpMyAdmin unsafely handles temporary files10.0 High
- verbatim corporate secureVerbatim Corporate Secure and Corporate Secure FIPS Edition USB flash drives use a fixed 256-bit...4.6 Medium
- kingston datatraveler blackbox, datatraveler elite, datatraveler secure +2 moreKingston DataTraveler BlackBox (DTBB), DataTraveler Secure Privacy Edition (DTSP), and...4.6 Medium
- sendmailsendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of...7.5 High
- gnome networkmanagerNetworkManager (NM) 0.7.2 does not ensure that the configured Certification Authority (CA)...6.8 Medium
- moodlelogin/index_form.html in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 links to an index page on...5.0 Medium
- postgresqlPostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8...5.8 Medium
- sun ray server softwareSun Ray Server Software 4.0 and 4.1 does not generate a unique DSA private key for the firmware...7.8 High
- apple mac os x, mac os x server +1 moreJava for Mac OS X 10.5 before Update 6 and 10.6 before Update 1 accepts expired certificates for...5.0 Medium
- ibm communications enabled applications, websphere application server +1 moreFeature Pack for Communications Enabled Applications (CEA) before 1.0.0.1 for IBM WebSphere...6.4 Medium
- martin lambers msmtpMartin Lambers msmtp before 1.4.19, when OpenSSL is used, does not properly handle a '\0'...6.4 Medium
- martin lambers mpopMartin Lambers mpop before 1.0.19, when OpenSSL is used, does not properly handle a '\0'...5.0 Medium
- citrix online plug-in for mac, online plug-in for windows, receiver for iphone +2 moreUnspecified vulnerability in Citrix Online Plug-in for Windows 11.0.x before 11.0.150 and 11.x...5.8 Medium
- apple mac os x, mac os x server +1 moreCertificate Assistant in Apple Mac OS X before 10.6.2 does not properly handle a '\0' character...4.3 Medium
- apple mac os x, mac os x server +1 moreHelp Viewer in Apple Mac OS X before 10.6.2 does not use an HTTPS connection to retrieve Apple...5.4 Medium
- sun jdk, jre, sdk +2 moreThe MessageDigest.isEqual function in Java Runtime Environment (JRE) in Sun Java SE in JDK and...5.0 Medium
- linux kernelThe get_instantiation_keyring function in security/keys/keyctl.c in the KEYS subsystem in the...4.6 Medium
- proftpdThe mod_tls module in ProFTPD before 1.3.2b, and 1.3.3 before 1.3.3rc2, when the dNSNameRequired...5.8 Medium
- muttmutt_ssl.c in mutt 1.5.16 and other versions before 1.5.19, when OpenSSL is used, does not verify...6.8 Medium
- muttmutt_ssl.c in mutt 1.5.19 and 1.5.20, when OpenSSL is used, does not properly handle a '\0'...6.8 Medium
- wordpressAlgorithmic complexity vulnerability in wp-trackback.php in WordPress before 2.8.5 allows remote...4.3 Medium
- adobe acrobat, acrobat reader +1 moreAn unspecified certificate in Adobe Reader and Acrobat 9.x before 9.2, 8.x before 8.1.7, and...9.3 High
- microsoft windows 2000, windows 7, windows server 2008 +3 more +5 moreThe CryptoAPI component in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server...6.8 Medium
- nlnetlabs unboundUnbound before 1.3.4 does not properly verify signatures for NSEC3 records, which allows remote...7.5 High
- osisoft pi serverPI Server in OSIsoft PI System before 3.4.380.x does not properly use encryption in the default...6.4 Medium
- gnu wgetGNU Wget before 1.12 does not properly handle a '\0' character in a domain name in the Common...6.8 Medium
- rim blackberry device softwareThe Blackberry Browser in RIM BlackBerry Device Software 4.5.0 before 4.5.0.173, 4.6.0 before 4.6...6.8 Medium
- google chromeGoogle Chrome, possibly 3.0.195.21 and earlier, does not properly handle a '\0' character in a...7.5 High
- apple safariApple Safari, possibly before 4.0.3, on Mac OS X does not properly handle a '\0' character in a...7.5 High
- internet2 shibboleth-spInternet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when...7.5 High
- internet2 opensaml, xmltooling, shibboleth-sp +2 moreOpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth...7.5 High
- qnap ts-239 pro turbo nas, ts-639 pro turbo nas +1 moreThe QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815 create a...4.9 Medium
- apple iphone osiPhone Mail in Apple iPhone OS, and iPhone OS for iPod touch, does not validate X.509...7.5 High
- qnap ts-239 pro turbo nas, ts-639 pro turbo nas +1 moreThe QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815 create an...5.9 Medium
- apple xsanThe screensharing feature in the Admin application in Apple Xsan before 2.2 places a cleartext...2.1 Low
- rivetcode rivettrackerRivetTracker before 1.0 stores passwords in cleartext in config.php, which allows local users to...2.1 Low
- kde kdelibsKDE KSSL in kdelibs 3.5.4, 4.2.4, and 4.3 does not properly handle a '\0' character in a domain...7.5 High
- Show moreLoading…