CWE-310: Cryptographic Issues
Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
From the CWE List. © The MITRE Corporation.
Newest
- vllm aibrixvLLM AIBrix Prefix Caching hash.go random values2.1 Low
- intelbras incontrol, incontrol web +1 moreIntelbras InControl Registered User usuario cleartext transmission6.3 Medium
- qualcomm 315 5g iot modem firmware, aqt1000 firmware, ar8035 firmware +233 more +235 moreCryptographic Issues in BT Controller8.2 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +31 more +33 moreWindows Cryptographic Services Security Feature Bypass Vulnerability7.8 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +10 more +12 moreWindows Nearby Sharing Spoofing Vulnerability6.5 Medium
- qualcomm ar8035 firmware, fastconnect 6200 firmware, fastconnect 6700 firmware +81 more +83 moreCryptographic Issues in Automotive7.1 High
- dell rvtoolsRVTools, Version 3.9.2 and above, contain a sensitive data exposure vulnerability in the...7.5 High
- qualcomm 315 5g iot modem firmware, 8953pro firmware, 9205 lte modem firmware +346 more +348 moreCryptographic issue in Core7.1 High
- acronis cyber protect 15, cyber protect +1 moreTLS/SSL weak cipher suites enabled. The following products are affected: Acronis Cyber Protect 15...5.3 Medium
- nodejs node, node.js +1 moreA cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in...7.5 High
- fortinet fortinac, fortinac-f +1 moreSome cryptographic issues in Fortinet FortiNAC versions 9.4.0 through 9.4.1, 9.2.0 through 9.2.7,...6.0 Medium
- click studios passwordstate, passwordstate browser extension chrome +1 moreClick Studios Passwordstate risky encryption1.9 Low
- unspecified whohaswhohas Package Information cleartext transmission3.7 Low
- nodejs node, node.js, siemens sinec ins +2 moreA cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0...5.3 Medium
- ping identity pingid windows login, pingidentity pingid integration for windows login +1 morePingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests7.2 High
- ping identity pingid mac login, pingidentity pingid integration for mac login +1 morePingID Mac Login prior to 1.1 vulnerable to pre-computed dictionary attacks7.7 High
- ping identity pingid integration for windows loginPingID Integration for Windows Login MFA Bypass6.4 Medium
- ping identity pingid desktopPingID Desktop encryption libraries misconfiguration can lead to sensitive data exposure8.0 High
- pingidentity pingid, pingid windows login, ping identity pingid mobile application +2 morePingID iOS mobile application prior to 1.19 vulnerable to pre-computed dictionary attacks6.6 Medium
- pingidentity pingid, pingid windows login, ping identity pingid mobile application +2 morePingID Android mobile application prior to 1.19 vulnerable to pre-computed dictionary attacks6.6 Medium
- ping identity pingid windows login, pingidentity pingid integration for windows login +1 morePingID Windows Login RSA cryptographic weakness with possible offline MFA bypass7.7 High
- haxx curl, apple macos, debian linux +26 more +28 moreWhen curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using...5.9 Medium
- amazon aws encryption sdk, aws sdk +1 moreRobustness weakness in AWS KMS and Encryption SDKs4.8 Medium
- hackerone nextcloud server, nextcloud server +1 moreA cryptographic issue in Nextcloud Server 19.0.1 allowed an attacker to downgrade the encryption...4.1 Medium
- hackerone nextcloud server, nextcloud server +1 moreA too small set of random characters being used for encryption in Nextcloud Server 18.0.4 allowed...2.2 Low
- cisco hyperflex hx-series software, hyperflex hx data platform +1 moreCisco Hyperflex HX-Series Software Weak Storage Vulnerability4.4 Medium
- dell rsa bsafe crypto-c micro edition, bsafe crypto-c-micro-edition, bsafe micro-edition-suite +1 more +3 moreRSA BSAFE Crypto-C Micro Edition versions prior to 4.1.4 and RSA Micro Edition Suite versions...5.9 Medium
- dell bsafe crypto-j, rsa bsafe crypto-j, bsafe cert-j +16 more +18 moreRSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through...6.5 Medium
- dell bsafe crypto-j, rsa bsafe crypto-j, bsafe cert-j +14 more +16 moreRSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing...6.5 Medium
- abus secvest wireless alarm system fuaa50000 firmwareAn issue was discovered on ABUS Secvest FUAA50000 3.01.01 devices. Due to an insufficient...7.5 High
- cospas-sarsat systemThe COSPAS-SARSAT protocol allows remote attackers to forge messages, replay encrypted messages,...9.1 Critical
- bluetooth br/edr, apple iphone os, mac os x +145 more +147 moreBlutooth BR/EDR specification does not specify sufficient encryption key length and allows an attacker to influence key length negotiation7.6 High
- cisco industrial network directorCisco Industrial Network Director Web Services Management Agent Unauthorized Information Disclosure Vulnerability5.3 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, qualcomm mdm9150 firmware, mdm9206 firmware +49 more +51 moreA non-time constant function memcmp is used which creates a side channel that could leak...7.8 High
- siemens simatic mv400 family, simatic mv420 firmware, simatic mv440 firmware +2 moreA vulnerability has been identified in SIMATIC Ident MV420 family (All versions), SIMATIC Ident...5.3 Medium
- cloudera navigator key trustee kms, manager +1 moreIn Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote...4.9 Medium
- orpak siteomatAn insecure communication was found between a user and the Orpak SiteOmat management console for...9.8 Critical
- siemens simatic wincc (tia portal), simatic wincc runtime advanced, simatic wincc runtime professional +16 more +18 moreA vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1...7.5 High
- abus secvest wireless alarm system fuaa50000 firmwareDue to the use of an insecure RFID technology (MIFARE Classic), ABUS proximity chip keys (RFID...8.1 High
- cisco nx-os software for nexus 9000 series fabric switches aci mode 11.0.1b, nexus 93108tc-ex firmware, nexus 93120tx firmware +11 more +13 moreCisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Default SSH Key Vulnerability9.8 Critical
- etsi enterprise transport securityThe ETSI Enterprise Transport Security (ETS, formerly known as eTLS) protocol does not provide...5.9 Medium
- schneider electric se iiot monitor 3.1.38, schneider-electric iiot monitor +1 moreA Cryptographic Issue (CWE-310) vulnerability exists in IIoT Monitor 3.1.38 which could allow...5.5 Medium
- qualcomm mdm9635m firmware, mdm9645 firmware, mdm9650 firmware +6 more +8 moreAGPS session failure in GNSS module due to cyphersuites are hardcoded and needed manual update...9.8 Critical
- wolfsslIt was found that wolfssl before 3.15.7 is vulnerable to a new variant of the Bleichenbacher...5.9 Medium
- qualcomm mdm9607 firmware, mdm9635m firmware, mdm9640 firmware +26 more +28 moreSecurity keys are logged when any WCDMA call is configured or reconfigured in snapdragon...5.5 Medium
- ibm security guardiumIBM Security Guardium 10 and 10.5 uses a one-way cryptographic hash against an input that should...5.9 Medium
- hashicorp consulHashiCorp Consul can use cleartext agent-to-agent RPC communication5.9 Medium
- auto-maskin dcu-210e, marine pro observer, rp-210e +2 more +4 moreThe Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App use an embedded webserver that uses unencrypted plaintext for the transmission of the administrator PIN9.1 Critical
- huawei usg2205bsr firmware, usg2220bsr firmware, usg5120bsr firmware +2 more +4 moreSome Huawei Firewall products USG2205BSR V300R001C10SPC600; USG2220BSR V300R001C00; USG5120BSR...5.9 Medium
- cisco systems, inc. small business 100 series wireless access points, small business 300 series wireless access points, cisco wap121 firmware +7 more +9 moreA vulnerability in the implementation of Extensible Authentication Protocol over LAN (EAPOL)...5.3 Medium
- Show moreLoading…