CWE-310: Cryptographic Issues
Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
From the CWE List. © The MITRE Corporation.
Newest
- dell secureworksDell SecureWorks app before 2.1 for iOS does not validate SSL certificates, which allows man-in...6.8 Medium
- google android, mozilla firefox +1 moreMozilla Firefox before 44.0 on Android does not ensure that HTTPS is used for a lightweight-theme...5.3 Medium
- westermo weosWestermo WeOS before 4.19.0 uses the same SSL private key across different customers'...9.0 Critical
- mozilla firefox, nss, opensuse leap +1 more +3 moreThe s_mp_div function in lib/freebl/mpi/mpi.c in Mozilla Network Security Services (NSS) before 3...6.5 Medium
- google chromeBlink, as used in Google Chrome before 48.0.2564.82, does not ensure that a proper...6.5 Medium
- samsung web viewerWeb Viewer 1.0.0.193 on Samsung SRN-1670D devices allows attackers to bypass filesystem...7.5 High
- avm fritz\! osAVM FRITZ!OS before 6.30 extracts the contents of firmware updates before verifying their...8.1 High
- pacom rtu gms, 1000 ccu gms +1 morePacom 1000 CCU and RTU GMS devices allow remote attackers to spoof the controller-to-base data...7.5 High
- nettle project nettle, canonical ubuntu linux, opensuse leap +1 more +3 moreThe ecc_256_modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry...9.8 Critical
- nettle project nettle, canonical ubuntu linux, opensuse leap +1 more +3 morex86_64/ecc-384-modp.asm in Nettle before 3.2 does not properly handle carry propagation and...9.8 Critical
- nettle project nettle, canonical ubuntu linux, opensuse leap +1 more +3 moreThe ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry...9.8 Critical
- juniper screenosThe encryption implementation in Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3...5.0 Medium
- csl dualcom gprs cs2300-r firmwareCSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 rely on a polyalphabetic...6.4 Medium
- sap manufacturing integration and intelligenceSAP Manufacturing Integration and Intelligence (aka MII, formerly xMII) uses weak encryption ...5.0 Medium
- microsoft windows 7, windows 8, windows 8.1 +5 more +7 moreSChannel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1,...5.8 Medium
- adways party track sdkThe Adways Party Track SDK before 1.6.6 for iOS does not verify X.509 certificates from SSL...5.8 Medium
- bouncycastle bouncy castle crypto package, opensuse leap, opensuse +4 more +6 moreModerate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk155.0 Medium
- hp arcsight smartconnectorsHP ArcSight SmartConnectors before 7.1.6 do not verify X.509 certificates from Logger devices,...6.8 Medium
- qolsys iq panelQolsys IQ Panel (aka QOL) before 1.5.1 does not verify the digital signatures of software updates...9.3 High
- ibm maximo asset management, smartcloud control desk, change and configuration management database +10 more +12 moreIBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX002, and 7.6.0 before...5.0 Medium
- vmware vcenter serverVMware vCenter Server 5.5 before u3 and 6.0 before u1 does not verify X.509 certificates from TLS...5.8 Medium
- apple iphone osWebKit in Apple iOS before 9 allows man-in-the-middle attackers to conduct redirection attacks by...2.6 Low
- apple iphone os, mac os x, watchos +2 moreThe NSURL implementation in the CFNetwork SSL component in Apple iOS before 9 does not properly...4.3 Medium
- siemens compasThe Siemens COMPAS Mobile application before 1.6 for Android does not properly verify X.509...5.8 Medium
- kde kmailKDE KMail does not encrypt attachments in emails when "automatic encryption" is enabled, which...5.9 Medium
- microsoft windows 7, windows 8, windows 8.1 +5 more +7 moreThe WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7...2.6 Low
- microsoft xml core servicesMicrosoft XML Core Services 3.0, 5.0, and 6.0 supports SSL 2.0, which makes it easier for remote...4.3 Medium
- microsoft xml core servicesMicrosoft XML Core Services 3.0 and 5.0 supports SSL 2.0, which makes it easier for remote...4.3 Medium
- theforeman foremanForman before 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in...5.0 Medium
- fortinet fortiosFortiOS 5.0.x before 5.0.12 and 5.2.x before 5.2.4 supports anonymous, export, RC4, and possibly...6.4 Medium
- garrettcom magnum 10k firmware, magnum 6k firmware +1 moreThe firmware in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches uses...4.3 Medium
- cisco content security management appliance, email security appliance, web security appliance +2 moreThe LDAP implementation on the Cisco Web Security Appliance (WSA) 8.5.0-000, Email Security...4.3 Medium
- cisco adaptive security appliance softwareThe TLS implementation in the Cavium cryptographic-module firmware, as distributed with Cisco...4.3 Medium
- f5 big-iq cloud, big-iq adc, big-iq device +1 more +3 moreThe REST API in F5 BIG-IQ Cloud, Device, and Security 4.4.0 and 4.5.0 before HF2 and ADC 4.5.0...4.3 Medium
- cisco unified computing systemThe Integrated Management Controller on Cisco Unified Computing System (UCS) C servers with...4.3 Medium
- mozilla firefox, firefox esr, oracle solaris +2 moreMozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 do not...4.3 Medium
- mozilla network security services, debian linux, novell suse linux enterprise desktop +4 more +6 moreMozilla Network Security Services (NSS) before 3.19.1, as used in Mozilla Firefox before 39.0,...4.3 Medium
- mozilla network security services, canonical ubuntu linux, debian linux +5 more +7 moreMozilla Network Security Services (NSS) before 3.19, as used in Mozilla Firefox before 39.0,...4.3 Medium
- ibm rational test virtualization server, rational test workbench +1 moreRational Test Control Panel in IBM Rational Test Workbench and Rational Test Virtualization...5.0 Medium
- ibm integration bus, websphere message broker +1 moreIBM WebSphere Message Broker Toolkit 7 before 7007 IF2 and 8 before 8005 IF1 and Integration...4.3 Medium
- cisco email security virtual appliance, web security virtual appliance, content security management virtual appliance +2 moreThe remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual...4.3 Medium
- mcafee epolicy orchestratorIntel McAfee ePolicy Orchestrator (ePO) 4.x through 4.6.9 and 5.x through 5.1.2 does not validate...5.8 Medium
- cisco adaptive security appliance softwareThe Cavium cryptographic-module firmware on Cisco Adaptive Security Appliance (ASA) devices with...4.3 Medium
- n-tron 702w industrial wireless access pointN-Tron 702-W Industrial Wireless Access Point devices use the same (1) SSH and (2) HTTPS private...8.8 High
- kankun smartsocketThe Kankun Smart Socket device and mobile application uses a hardcoded AES 256 bit key, which...6.8 Medium
- rockwellautomation rsview32Rockwell Automation RSView32 7.60.00 (aka CPR9 SR4) and earlier does not properly encrypt...4.9 Medium
- phpmyadminlibraries/Config.class.php in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x...4.3 Medium
- fedora pacemaker configuration systemThe pcs daemon (pcsd) in PCS 0.9.137 and earlier does not include the HTTPOnly flag in a Set...4.3 Medium
- fedora pacemaker configuration system, redhat enterprise linux high availability, enterprise linux high availability eus +2 more +4 moreThe pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an...6.8 Medium
- microsoft .net frameworkMicrosoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allows remote attackers to...5.0 Medium
- Show moreLoading…