CWE-310: Cryptographic Issues
Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
From the CWE List. © The MITRE Corporation.
Newest
- lenovo system updateLenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 does not properly...8.3 High
- siemens homecontrol for room automationThe Siemens HomeControl for Room Automation application before 2.0.1 for Android does not verify...5.4 Medium
- lenovo thinkserver system manager baseboard management controller firmwareThe ThinkServer System Manager (TSM) Baseboard Management Controller before firmware 1.27.73476...4.3 Medium
- lenovo thinkserver rd350, thinkserver rd350 firmware, thinkserver rd450 +7 more +9 moreLenovo ThinkServer RD350, RD450, RD550, RD650, and TD350 servers before 1.26.0 use weak...5.0 Medium
- librsync project librsynclibrsync before 1.0.0 uses a truncated MD4 checksum to match blocks, which makes it easier for...5.8 Medium
- digium asterisk, certified asterisk +1 moreAsterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x...4.3 Medium
- apple mac os xThe Code Signing implementation in Apple OS X before 10.10.3 does not properly validate...1.9 Low
- apple mac os xThe Code Signing implementation in Apple OS X before 10.10.3 does not properly validate...1.9 Low
- apple safari, iphone os +1 moreApple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 does not properly select X.509...4.3 Medium
- ibm rational clearcaseThe MSCAPI/MSCNG interface implementation in GSKit in IBM Rational ClearCase 7.1.2.x before 7.1.2...9.4 High
- kanaka novncnoVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it...4.3 Medium
- hospira mednetHospira MedNet Use of Hard-coded Cryptographic Key6.8
- inetc project inetcThe Inetc plugin for Nullsoft Scriptable Install System (NSIS), as used in CERT/CC Failure...4.3 Medium
- opensslThe ssl3_client_hello function in s3_clnt.c in OpenSSL 1.0.2 before 1.0.2a does not ensure that...4.3 Medium
- apple iphone os, mac os x, tvos +2 moreSecure Transport in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1...4.3 Medium
- apache mod-gnutlsThe authentication hook (mgs_hook_authz) in mod-gnutls 0.5.10 and earlier does not validate...5.0 Medium
- theforeman foreman, redhat openstack +1 moreSmart Proxy (aka Smart-Proxy and foreman-proxy) in Foreman before 1.5.4 and 1.6.x before 1.6.2...7.5 High
- siemens spcanywhereThe Siemens SPCanywhere application for Android and iOS does not properly verify X.509...5.8 Medium
- microsoft windows 7, windows 8, windows 8.1 +6 more +8 moreSchannel (aka Secure Channel) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows...4.3 Medium
- komodia redirector sdkThe SDK for Komodia Redirector with SSL Digestor, as used in Lavasoft Ad-Aware Web Companion 1.1...5.0 Medium
- siemens winccThe remote-management module in the (1) Multi Panels, (2) Comfort Panels, and (3) RT Advanced...5.0 Medium
- siemens simatic step 7Siemens SIMATIC STEP 7 (TIA Portal) before 13 SP1 uses a weak password-hash algorithm, which...2.1 Low
- microsoft windows 7, windows 8, windows 8.1 +6 more +8 moreThe CryptProtectMemory function in cng.sys (aka the Cryptography Next Generation driver) in the...1.9 Low
- fortinet fortios** DISPUTED ** The CAPWAP DTLS protocol implementation in Fortinet FortiOS 5.0 Patch 7 build 4457...4.3 Medium
- fortinet forticlientThe Endpoint Control protocol implementation in Fortinet FortiClient 5.2.3.091 for Android and 5...4.3 Medium
- fortinet forticlientFortinet FortiClient 5.2.028 for iOS does not validate certificates, which makes it easier for...4.3 Medium
- bluecoat proxyclient, unified agent +1 moreBlue Coat ProxyClient before 3.3.3.3 and 3.4.x before 3.4.4.10 and Unified Agent before 4.1.3...7.1 High
- fortinet forticlientThe qm class in Fortinet FortiClient 5.2.3.091 for Android uses a hardcoded encryption key of...5.0 Medium
- ibm security appscanIBM Security AppScan Standard 8.x and 9.x before 9.0.1.1 FP1 does not properly verify X.509...5.8 Medium
- ibm security appscanIBM Security AppScan Standard 8.x and 9.x before 9.0.1.1 FP1 supports unencrypted sessions, which...5.0 Medium
- vmware vsphere data protectionVMware vSphere Data Protection (VDP) 5.1, 5.5 before 5.5.9, and 5.8 before 5.8.1 and the proxy...4.3 Medium
- apple iphone osThe iTunes Store component in Apple iOS before 8.1.3 allows remote attackers to bypass a Safari...6.8 Medium
- google chromeThe AppCacheUpdateJob::URLFetcher::OnResponseStarted function in content/browser/appcache...4.3 Medium
- kde applicationskwalletd in KWallet before KDE Applications 14.12.0 uses Blowfish with ECB mode instead of CBC...5.0 Medium
- ge multilink ml800, multilink ml810, ml810/3000/3100 series switch +13 more +15 moreGE Multilink Use of Hard-coded Cryptographic Key10.0
- panasonic arbitrator back-end server mk 2.0 vpu, arbitrator back-end server mk 2.0 vpu firmware, arbitrator back-end server mk 3.0 vpu +1 more +3 morePanasonic Arbitrator Back-End Server (BES) MK 2.0 VPU before 9.3.1 build 4.08.003.0, when USB Wi...4.3 Medium
- mozilla firefox, seamonkey, opensuse +2 moreMozilla Firefox before 35.0 and SeaMonkey before 2.32 do not consider the id-pkix-ocsp-nocheck...4.3 Medium
- dell bsafe ssl-j, bsafe micro-edition-suite +1 moreEMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.6 and RSA BSAFE SSL-J before 6.1.4 do...4.3 Medium
- facebook hiphop virtual machineThe mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp in Facebook HipHop...5.0 Medium
- ibm websphere service registry and repositoryThe Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3.x through 6.3.0.5, 7.0.x...4.3 Medium
- ekahau activator, b4 staff badge tag firmware, real-time location system controller +2 moreEkahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System (RTLS) Controller 6...4.3 Medium
- pwgen project pwgenPassword Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom...5.0 Medium
- ibm security access manager for mobile, security access manager for web +1 moreIBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x...5.0 Medium
- ibm security access manager for mobile, security access manager for web +1 moreIBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x...5.0 Medium
- ibm business process manager, websphere enterprise service bus, websphere process server +2 moreIBM WebSphere Process Server 7.0, WebSphere Enterprise Service Bus 7.0, and Business Process...4.3 Medium
- f5 big-iq cloud, big-ip access policy manager, big-ip advanced firewall manager +11 more +13 moreThe SSL profiles component in F5 BIG-IP LTM, APM, and ASM 10.0.0 through 10.2.4 and 11.0.0...4.3 Medium
- vmware vcenter server applianceVMware vCenter Server Appliance (vCSA) 5.5 before Update 2, 5.1 before Update 3, and 5.0 before...4.3 Medium
- ibm tivoli endpoint manager mobile device managementIBM Tivoli Endpoint Manager Mobile Device Management (MDM) before 9.0.60100 uses the same secret...9.3 High
- wordpress, debian linux, mageia project mageia +2 moreWordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow...6.8 Medium
- polarsslPolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows remote...5.0 Medium
- Show moreLoading…