CWE-310: Cryptographic Issues
Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
From the CWE List. © The MITRE Corporation.
Newest
- dlink dir-685The D-Link DIR-685 router, when certain WPA and WPA2 configurations are used, does not maintain...7.5 High
- dell kace k2000 systems deployment applianceThe Dell KACE K2000 System Deployment Appliance stores the recovery account password in cleartext...5.0 Medium
- merethis centreonwww/include/configuration/nconfigObject/contact/DB-Func.php in Merethis Centreon before 2.3.2...5.0 Medium
- apple mac os x, mac os x server +1 moreCoreStorage in Apple Mac OS X 10.7 before 10.7.2 does not ensure that all disk data is encrypted...2.1 Low
- adam kennedy crypt-dsaThe Crypt::DSA (aka Crypt-DSA) module 1.17 and earlier for Perl, when /dev/random is absent, uses...5.8 Medium
- cherokee-project cherokeeThe generate_admin_password function in Cherokee before 1.2.99 uses time and PID values for...2.1 Low
- netsaro enterprise messenger serverNetSaro Enterprise Messenger Server 2.0 allows local users to discover cleartext server...1.9 Low
- netsaro enterprise messenger serverNetSaro Enterprise Messenger Server 2.0 stores cleartext console credentials in configuration.xml...1.9 Low
- tembria server monitorTembria Server Monitor before 6.0.5 Build 2252 uses a substitution cipher to encrypt application...1.9 Low
- manageengine servicedesk plusThe encryptPassword function in Login.js in ManageEngine ServiceDesk Plus (SDP) 8012 and earlier...5.0 Medium
- phpThe crypt function in PHP 5.3.7, when the MD5 hash type is used, returns the value of the salt...4.3 Medium
- rsa envisionRSA enVision 4.x before 4 SP4 P3 places cleartext administrative credentials in Task Escalation e...5.0 Medium
- php, postgresql, openwall crypt blowfish +2 morecrypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8...5.0 Medium
- ibm tivoli federated identity managerIBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.2, when com.tivoli.am.fim...1.9 Low
- novell data synchronizer, mobility pack +1 moreWebAdmin in the Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428...5.0 Medium
- novell data synchronizer, mobility pack +1 moreThe Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 sends the...5.0 Medium
- ruby-lang rubyRuby before 1.8.6-p114 does not reset the random seed upon forking, which makes it easier for...5.0 Medium
- ruby-lang rubyRuby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for...5.0 Medium
- apple cfnetwork, safari +1 moreCFNetwork in Apple Safari before 5.0.6 on Windows does not properly handle an untrusted attribute...5.0 Medium
- google androidAndroid Picasa in Android 3.0 and 2.x through 2.3.4 uses a cleartext HTTP session when...10.0 High
- apple mac os x, mac os x server +1 moreThe MobileMe component in Apple Mac OS X before 10.6.8 uses a cleartext HTTP session for the Mail...5.0 Medium
- simplemachines smfThe loadUserSettings function in Load.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x...7.5 High
- opensslThe elliptic curve cryptography (ECC) subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic...2.6 Low
- erlang crypto, ssh, erlang erlang\/otp +2 moreThe random number generator in the Crypto application before 2.0.2.2, and SSH before 2.0.5, as...7.8 High
- smartertools smarterstatsThe (1) Admin/frmEmailReportSettings.aspx, (2) Admin/frmGeneralSettings.aspx, (3) Admin/frmSite...5.0 Medium
- trendmicro trend micro internet securityThe Keystroke Encryption feature in Trend Micro Internet Security 2009 (aka Virus Buster 2009 and...2.1 Low
- zeacom chat serverZeacom Chat Server before 5.1 uses too short a random string for the JSESSIONID value, which...5.8 Medium
- ibm datacap taskmaster captureThe Web Client Service in IBM Datacap Taskmaster Capture 8.0.1 before FP1 requires a cleartext...5.0 Medium
- martinicreations passmanlite password managerThe MartiniCreations PassmanLite Password Manager application before 1.48 for Android stores the...2.1 Low
- inventivetec mediacastauthenticate_ad_setup_finished.cfm in MediaCAST 8 and earlier allows remote attackers to discover...5.0 Medium
- vmware esx, esxi, vcenter +2 moreThe self-extracting installer in the vSphere Client Installer package in VMware vCenter 4.0...5.0 Medium
- ibm websphere application serverIBM WebSphere Application Server (WAS) 6.1 before 6.1.0.39 and 7.0 before 7.0.0.17 uses a weak WS...4.3 Medium
- broadcom total defenseThe management.asmx module in the Management Web Service in the Unified Network Control (UNC)...7.5 High
- cisco iosThe PKI functionality in Cisco IOS 15.0 and 15.1 does not prevent permanent caching of certain...10.0 High
- netgear prosafe wnap210, prosafe wnap210 firmware +1 moreBackupConfig.php on the NetGear ProSafe WNAP210 allows remote attackers to obtain the...5.0 Medium
- otrsThe (1) AgentInterface and (2) CustomerInterface components in Open Ticket Request System (OTRS)...5.0 Medium
- otrsinstaller.pl in Open Ticket Request System (OTRS) before 3.0.3 has an Inbound Mail Password field...1.9 Low
- otrsThe S/MIME feature in Open Ticket Request System (OTRS) before 2.3.4 does not configure the...5.0 Medium
- emc avamarThe service utility in EMC Avamar 5.x before 5.0.4 uses cleartext to transmit event details in (1...3.5 Low
- gplhost domain technologie controlThe register_user function in client/new_account_form.php in Domain Technologie Control (DTC)...5.0 Medium
- ubuntu edubuntu, live dvd +1 moreThe Live DVD for Edubuntu 9.10, 10.04 LTS, and 10.10 does not correctly regenerate iTALC private...9.3 High
- mit kerberos, kerberos 5 +1 moreThe unparse implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.6...5.0 Medium
- microsoft windows xp, windows 2003 server, windows server 2003 +2 moreKerberos in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 supports weak hashing algorithms...7.2 High
- smc networks smcd3g-ccr, smcd3g-ccr firmware +1 moreThe web management portal on the SMC SMCD3G-CCR (aka Comcast Business Gateway) with firmware...4.3 Medium
- zikula application frameworkZikula before 1.3.1 uses the rand and srand PHP functions for random number generation, which...5.0 Medium
- oracle passlogix v-go self-service password reset and oemPasslogix v-GO Self-Service Password Reset (SSPR) and OEM before 7.0A allows physically proximate...6.2 Medium
- collabnet scrumworksCollabNet ScrumWorks Basic 1.8.4 uses cleartext credentials for network communication and the...5.0 Medium
- miloslav trmac libuserlibuser before 0.57 uses a cleartext password value of (1) !! or (2) x for new LDAP user accounts...6.4 Medium
- bestpractical rtBest Practical Solutions RT 3.x before 3.8.9rc2 and 4.x before 4.0.0rc4 uses the MD5 algorithm...4.3 Medium
- io-socket-sslThe IO::Socket::SSL module 1.35 for Perl, when verify_mode is not VERIFY_NONE, fails open to...4.0 Medium
- Show moreLoading…