CWE-310: Cryptographic Issues
Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
From the CWE List. © The MITRE Corporation.
Newest
- mybbThe my_rand function in functions.php in MyBB (aka MyBulletinBoard) before 1.4.12 does not...5.1 Medium
- opera browserOpera before 11.00, when Opera Turbo is used, does not properly present information about...2.6 Low
- rim blackberry desktop softwareRIM BlackBerry Desktop Software 4.7 through 6.0 for PC, and 1.0 for Mac, uses a weak password to...2.1 Low
- ibm lotus notes travelerThe encrypted e-mail feature in IBM Lotus Notes Traveler before 8.5.0.2 sends unencrypted...5.8 Medium
- opensslOpenSSL before 0.9.8j, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not prevent...4.3 Medium
- mit kerberos 5MIT Kerberos 5 (aka krb5) 1.8.x through 1.8.3 does not reject RC4 key-derivation checksums, which...6.3 Medium
- mit kerberos 5MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x through 1.8.3 does not properly determine the...3.7 Low
- mit kerberos, kerberos 5 +1 moreMIT Kerberos 5 (aka krb5) 1.3.x, 1.4.x, 1.5.x, 1.6.x, 1.7.x, and 1.8.x through 1.8.3 does not...3.7 Low
- dustincowell free simple softwareFree Simple Software 1.0 stores passwords in cleartext, which allows context-dependent attackers...5.0 Medium
- cisco unified videoconferencing system 3515 multipoint control unit, unified videoconferencing system 3515 multipoint control unit firmware, unified videoconferencing system 3522 basic rate interface gateway +11 more +13 moreCisco Unified Videoconferencing (UVC) System 3545, 5110, 5115, and 5230; Unified...5.0 Medium
- cisco unified videoconferencing system 3515 multipoint control unit, unified videoconferencing system 3515 multipoint control unit firmware, unified videoconferencing system 3522 basic rate interface gateway +11 more +13 moreThe web interface in Cisco Unified Videoconferencing (UVC) System 3545, 5110, 5115, and 5230;...6.4 Medium
- cisco unified videoconferencing system 5110, unified videoconferencing system 5110 firmware, unified videoconferencing system 5115 +1 more +3 more/opt/rv/Versions/CurrentVersion/Mcu/Config/Mcu.val in Cisco Unified Videoconferencing (UVC)...4.9 Medium
- apple safari, webkit +1 moreThe JavaScript implementation in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10...5.0 Medium
- pgp desktop for mac, desktop for windows +1 morePGP Desktop 10.0.x before 10.0.3 SP2 and 10.1.0 before 10.1.0 SP1 does not properly implement the...4.3 Medium
- redhat certificate system, dogtag certificate system +1 moreRed Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System allow remote...4.0 Medium
- ibm websphere mqIBM WebSphere MQ 6.0 before 6.0.2.9 and 7.0 before 7.0.1.1 does not encrypt the username and...4.3 Medium
- wellsfargo wells fargo mobileThe Wells Fargo Mobile application 1.1 for Android stores a username and password, along with...4.3 Medium
- bankofamerica bank of americaThe Bank of America application 2.12 for Android stores a security question's answer in cleartext...4.3 Medium
- turbogears turbogears2The default quickstart configuration of TurboGears2 (aka tg2) before 2.0.2 has a weak cookie salt...7.5 High
- netsupportsoftware netsupport managerNetSupport Manager (NSM) before 11.00.0005 sends HTTP headers with cleartext fields containing...5.0 Medium
- mozilla firefox, seamonkey, thunderbird +2 moreThe SSL implementation in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird...7.5 High
- mozilla firefox, seamonkey, thunderbird +2 moreMozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before...4.3 Medium
- oracle mojarraOracle Mojarra uses an encrypted View State without a Message Authentication Code (MAC), which...5.0 Medium
- apache myfacesImproper Authentication in Apache MyFaces5.0 Medium
- rim blackberry desktop softwareThe offline backup mechanism in Research In Motion (RIM) BlackBerry Desktop Software uses single...4.7 Medium
- arg0 encfsEncFS before 1.7.0 encrypts multiple blocks by means of the CFB cipher mode with the same...5.0 Medium
- arg0 encfsSSL_Cipher.cpp in EncFS before 1.7.0 uses an improper combination of an AES cipher and a CBC...2.1 Low
- arg0 encfsSSL_Cipher.cpp in EncFS before 1.7.0 does not properly handle integer data sizes when...2.1 Low
- mozilla firefox, seamonkey +1 moreThe js_InitRandom function in the JavaScript implementation in Mozilla Firefox 3.5.x before 3.5...5.8 Medium
- mozilla firefoxThe js_InitRandom function in the JavaScript implementation in Mozilla Firefox 3.5.10 through 3.5...5.8 Medium
- mozilla firefoxThe Math.random function in the JavaScript implementation in Mozilla Firefox 3.5.10 through 3.5...5.8 Medium
- apache derbyUse of Password Hash With Insufficient Computational Effort in Apache Derby2.1 Low
- mozilla bugzillaThe sudo feature in Bugzilla 2.22rc1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and...6.5 Medium
- cisco unified wireless network solution softwareCisco Unified Wireless Network (UWN) Solution 7.x before 7.0.98.0 does not use an adequate...10.0 High
- windriver vxworksThe loginDefaultEncrypt algorithm in loginLib in Wind River VxWorks before 6.9 does not properly...7.8 High
- linearcorp emerge 50, s2sys netbox, sonitrol eaccess +1 more +3 moreThe S2 Security NetBox 2.x and 3.x, as used in the Linear eMerge 50 and 5000 and the Sonitrol...10.0 High
- apple mac os x, mac os x server +1 moreOpen Directory in Apple Mac OS X 10.6 before 10.6.4 creates an unencrypted connection upon...9.3 High
- radovan garabik pyftpdPyftpd 0.8.4 creates log files with predictable names in a temporary directory, which allows...3.6 Low
- accoria rock web serverAccoria Web Server (aka Rock Web Server) 1.4.7 uses a predictable httpmod-sessionid cookie, which...7.5 High
- apple safari, webkit +1 moreWebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on...5.0 Medium
- opensslThe Cryptographic Message Syntax (CMS) implementation in crypto/cms/cms_asn1.c in OpenSSL before...7.5 High
- gnu gnutlsThe _gnutls_x509_oid2mac_algorithm function in lib/gnutls_algorithms.c in GnuTLS before 1.4.2...5.0 Medium
- microsoft dynamics gpMicrosoft Dynamics GP uses a substitution cipher to encrypt the system password field and...4.0 Medium
- cisco ironport desktop flag plugin for outlookThe Send Secure functionality in the Cisco IronPort Desktop Flag Plug-in for Outlook before 6.5.0...5.0 Medium
- consona dynamic agent, live assistance, subscriber assistance +2 moreThe site-locking implementation in the SdcWebSecureBase interface in tgctlcm.dll in Consona Live...9.3 High
- consona dynamic agent, repair manager, subscriber activation +1 more +3 moretgsrv.exe in the Repair Service in Consona Dynamic Agent, Repair Manager, Subscriber Activation,...7.2 High
- microsoft exchange server, windows 2000, windows server 2003 +2 more +4 moreThe DNS implementation in smtpsvc.dll before 6.0.2600.5949 in Microsoft Windows 2000 SP4 and...6.4 Medium
- toutvirtual virtualiqThe configuration page in ToutVirtual VirtualIQ Pro 3.2 build 7882 contains cleartext SSH...5.0 Medium
- ibm websphere application serverIBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.31 and 7.0.x before 7.0.0.11, when...1.9 Low
- ibm websphere application serverIBM WebSphere Application Server (WAS) 6.0.x before 6.0.2.41, 6.1.x before 6.1.0.31, and 7.0.x...1.9 Low
- Show moreLoading…