CWE-310: Cryptographic Issues
Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
From the CWE List. © The MITRE Corporation.
Newest
- enghouseinteractive ivr proAn unspecified Enghouse Interactive Professional Services "addon product" in Enghouse Interactive...10.0 High
- almanah project almanahAlmanah Diary 0.9.0 and 0.10.0 does not encrypt the database when closed, which allows local...2.1 Low
- apple itunesApple iTunes before 11.1.4 uses HTTP for the iTunes Tutorials window, which allows man-in-the...5.8 Medium
- checkpoint endpoint security mi server r73Check Point Endpoint Security MI Server through R73 3.0.0 HFA2.5 does not configure X.509...4.3 Medium
- simon mcvittie telepathy gabbleA certain hashing algorithm in Telepathy Gabble 0.16.x before 0.16.5 and 0.17.x before 0.17.3...5.0 Medium
- ibm platform symphonyIBM Platform Symphony 5.2 before build 229037 and 6.1.0.1 before build 229073 uses the same...4.3 Medium
- ibm bladecenter, flex system manager node 7955, flex system manager node 8731 +28 more +30 moreIntegrated Management Module (IMM) 2 1.00 through 2.00 on IBM System X and Flex System servers...4.3 Medium
- mozilla network security servicesThe ssl_Do1stHandshake function in sslsecur.c in libssl in Mozilla Network Security Services (NSS...5.8 Medium
- torproject torTor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting...4.0 Medium
- google chromeGoogle Chrome before 21.0.1180.82 on iOS on iPad devices allows remote attackers to spoof the...5.0 Medium
- fatfreecrm fat free crmFat Free CRM has fixed token value5.0 Medium
- opensslThe DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f...5.8 Medium
- nextdc onedcThe ONEDC app before 1.7 for iOS does not properly verify X.509 certificates from SSL servers,...5.8 Medium
- emc watch4netEMC Watch4Net before 6.3 stores cleartext polled-device passwords in the installation repository,...2.1 Low
- x display managerX.Org xdm 1.1.10, 1.1.11, and possibly other versions, when performing authentication using...4.3 Medium
- duckcorp bip, fedoraproject fedora +1 moreconnection.c in Bip before 0.8.9 does not properly close sockets, which allows remote attackers...4.3 Medium
- typo3TYPO3 vulnerable to Insecure Unserialize via Content Editing Wizards component6.5 Medium
- opensslThe ssl_get_algorithm2 function in ssl/s3_lib.c in OpenSSL before 1.0.2 obtains a certain version...4.3 Medium
- upc ireland cisco epc2425The UPC Ireland Cisco EPC 2425 router (aka Horizon Box) does not have a sufficiently large number...9.3 High
- valvesoftware steamosValve Bug Reporter in the valve-bugreporter package 2.10+bsos1 in Valve SteamOS Beta stores...2.1 Low
- apple mac os x, safari +1 moreApple Safari 6.0.5 on Mac OS X 10.7.5 and 10.8.5 stores cleartext credentials in LastSession...2.1 Low
- ibm global security kit, content manager ondemand for multiplatforms, security access manager for web +2 moreIBM Global Security Kit (aka GSKit), as used in Content Manager OnDemand 8.5 and 9.0 and other...7.8 High
- percona xtrabackup, opensuse +1 morePercona XtraBackup before 2.1.6 uses a constant string for the initialization vector (IV), which...2.1 Low
- sonarsource jenkins pluginJenkins SonarQube Plugin Stores Passwords in Cleartext4.0 Medium
- cisco unified communications manager** DISPUTED ** The TFTP service in Cisco Unified Communications Manager (aka CUCM or Unified CM)...5.0 Medium
- zippyyum subway ordering for californiaThe ZippyYum Subway CA Kiosk app 3.4 for iOS uses cleartext storage in SQLite cache databases,...2.1 Low
- mozilla firefox, seamonkey, thunderbird +6 more +8 moreMozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey...5.9 Medium
- novell suse lifecycle management serverSUSE Lifecycle Management Server (SLMS) before 1.3.7 does not generate a new secret key when the...4.3 Medium
- ibm advanced management module firmwareThe Advanced Management Module (AMM) with firmware 3.64B, 3.64C, and 3.64G for IBM BladeCenter...6.4 Medium
- drupalDrupal 6.x before 6.29 and 7.x before 7.24 uses the PHP mt_rand function to generate random...6.8 Medium
- canonical maas, ubuntu linux +1 moremaas-import-pxe-files in MAAS before 13.10 does not verify the integrity of downloaded files,...5.8 Medium
- duckcorp bip, fedoraproject fedora +1 moreBip before 0.8.9, when running as a daemon, writes SSL handshake errors to an unexpected file...5.1 Medium
- kingsoft kdriveKingsoft KDrive Personal before 1.21.0.1880 on Windows does not verify X.509 certificates from...5.8 Medium
- linux kernelThe ath9k_htc_set_bssid_mask function in drivers/net/wireless/ath/ath9k/htc_drv_main.c in the...4.3 Medium
- ibm websphere application serverIBM WebSphere Application Server (WAS) Liberty Profile 8.5 before 8.5.5.1 uses weak permissions...4.3 Medium
- haxx curl, libcurl +1 morecURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and...4.3 Medium
- ibm tivoli directory serverGSKit in IBM Tivoli Directory Server (ITDS) 6.0 before 6.0.0.73-ISS-ITDS-IF0073, 6.1 before 6.1.0...4.3 Medium
- ibm java sdkThe IBMSecureRandom component in the IBMJCE and IBMSecureRandom cryptographic providers in IBM...5.8 Medium
- sambaSamba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses...1.2 Low
- dell emc unisphereEMC Unisphere for VMAX before 1.6.1.6, when using an unspecified level of debug logging in LDAP...1.9 Low
- emc networkerThe NetWorker Management Console (NMC) in EMC NetWorker 8.0.x before 8.0.2.3, when using Active...3.5 Low
- openstack compute, redhat openstack +1 moreOpenStack Nova Denial of Service in network source security groups4.0 Medium
- novell libzyppThe RPM GPG key import and handling feature in libzypp 12.15.0 and earlier reports a different...4.3 Medium
- urbanairship python-oauth2SimpleGeo python-oauth2 vulnerable to the use of Insufficiently Random Values to generate nonces5.8 Medium
- ibm security appscanIBM Security AppScan Enterprise 8.x before 8.8 sends a cleartext AppScan Source database password...3.5 Low
- apple mac os xThe ldapsearch command-line program in OpenLDAP in Apple Mac OS X before 10.9 does not properly...4.3 Medium
- apple mac os xMail in Apple Mac OS X before 10.9 allows remote attackers to spoof the existence of a...5.0 Medium
- apple mac os xThe auto-configuration feature in Mail in Apple Mac OS X before 10.9 selects plaintext...4.3 Medium
- apple mac os xThe srandomdev function in Libc in Apple Mac OS X before 10.9, when the kernel random-number...4.3 Medium
- apple mac os xThe random-number generator in the kernel in Apple Mac OS X before 10.9 provides lengthy...2.1 Low
- Show moreLoading…