CWE-326: Inadequate Encryption Strength
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- pidgin mxitThe Mxit protocol uses weak encryption when encrypting user passwords, which might allow...8.8 High
- go-jose project go-joseElliptic Curve Key Disclosure in go-jose9.1 Critical
- eview ev-07s gps tracker, eviewgps ev-07s gps tracker firmware +1 moreDue to a lack of standard encryption when transmitting sensitive information over the internet to...7.5 High
- percona xtrabackup, fedoraproject fedora, opensuse leap +2 morexbcrypt in Percona XtraBackup before 2.3.6 and 2.4.x before 2.4.5 does not properly set the...5.9 Medium
- syspassAn issue was discovered in sysPass 2.x before 2.1, in which an algorithm was never sufficiently...7.5 High
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar 7.2 uses outdated hashing algorithms to hash certain passwords, which could allow a...7.8 High
- apple watchos, iphone os, mac os x +2 moreAn issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10...7.5 High
- apple iphone osAn issue was discovered in certain Apple products. iOS before 10.1 is affected. The issue...5.9 Medium
- ibm corporation access manager, ibm security access manager 9.0 firmware, security access manager for mobile +2 more +4 moreIBM Security Access Manager for Web 7.0.0, 8.0.0, and 9.0.0 uses weaker than expected...7.5 High
- hcl software appscan source, ibm security appscan source +1 moreIBM AppScan Source uses a one-way hash without salt to encrypt highly sensitive information,...4.4 Medium
- hiteksoftware automizeInformation Disclosure can occur in sshProfiles.jsd in Hitek Software's Automize because of the...5.9 Medium
- hiteksoftware automizeInformation Disclosure can occur in encryptionProfiles.jsd in Hitek Software's Automize because...8.1 High
- hiteksoftware automizehitek.jar in Hitek Software's Automize uses weak encryption when encrypting SSH/SFTP and...8.1 High
- hiteksoftware automizeInformation Disclosure can occur in Hitek Software's Automize 10.x and 11.x passManager.jsd....8.1 High
- google chromeSHA-1 is not collision resistant, which makes it easier for context-dependent attackers to...5.9 Medium
- ruby-lang openssl, debian linux +1 moreOpenSSL gem for Ruby using inadequate encryption strength7.5 High
- huawei ar firmware, quidway s5300 firmware, quidway s9300 firmware +4 more +6 moreHuawei AR routers with software before V200R007C00SPC100; Quidway S9300 routers with software...4.9 Medium
- huawei ar firmware, quidway s5300 firmware, quidway s9300 firmware +4 more +6 moreHuawei AR routers with software before V200R007C00SPC100; Quidway S9300 routers with software...4.9 Medium
- moxa mgate mb3170 firmware, mgate mb3180 firmware, mgate mb3270 firmware +2 more +4 moreMoxa MGate MB3180 before 1.8, MGate MB3280 before 2.7, MGate MB3480 before 2.6, MGate MB3170...9.8 Critical
- clorius controls a\/s java web client, clorius controls a/s java web client +1 moreClorius Controls A/S ISC SCADA Insecure Java Client Inadequate Encryption Strength10.0
- invensys wonderware information server, schneider electric wonderware information server portal +1 moreSchneider Electric Wonderware Inadequate Encryption Strength2.1
- invensys wonderware information server, schneider electric wonderware information server portal +1 moreSchneider Electric Wonderware Inadequate Encryption Strength7.8
- jenkins-ci subversion-pluginJenkins Subversion Plugin Stores Credentials with Base64 Encoding2.1 Low
- mozilla firefox, network security services, seamonkey +10 more +12 moreMozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0,...4.3 Medium
- lighttpd, debian linux, opensuse +2 morelighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier...7.5 High
- apache cxf, redhat jboss enterprise application platform, jboss enterprise portal platform +3 more +5 moreInadequate Encryption Strength in Apache CXF6.4 Medium
- canonical ubuntu linux, fujitsu m10-1 firmware, m10-4 firmware +13 more +15 moreThe RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases,...5.9 Medium
- mozilla firefox, seamonkey, thunderbird +6 more +8 moreThe nsSOCKSSocketInfo::ConnectToProxy function in Mozilla Firefox before 18.0, Firefox ESR 17.x...9.3 High
- python keyringPython Keyring does not securely initialize encryption cipher2.1 Low
- python beakerBeaker Sensitive Information Disclosure vulnerability4.3 Medium
- openssl, fedoraproject fedora, filezilla-project filezilla server +13 more +15 moreOpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict...7.4 High
- google chrome, microsoft internet explorer, windows +12 more +14 moreThe SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet...4.3 Medium
- typo3TYPO3 is vulnerable to insecure randomness during hash generation in forgot password function4.8 Medium
- webdav neon, apple mac os x, canonical ubuntu linux +1 more +3 moreneon before 0.28.6, when OpenSSL or GnuTLS is used, does not properly handle a '\0' character in...5.8 Medium
- opensuselibxcrypt in SUSE openSUSE 11.0 uses the DES algorithm when the configuration specifies the MD5...7.5 High
- juvare webeocWebEOC before 6.0.2 uses a weak encryption scheme for passwords, which makes it easier for...7.5 High
- gnupgThe integrity check feature in OpenPGP, when handling a message that was encrypted using cipher...5.0 Medium
- netsourcecommerce productcartEarlyImpact ProductCart uses a weak encryption scheme to encrypt passwords, which allows remote...7.5 High
- sharp zaurus sl-5000d firmware, zaurus sl-5500 firmware +1 moreSharp Zaurus PDA SL-5000D and SL-5500 uses a salt of "A0" to encrypt the screen-locking password...5.5 Medium
- tata integrated dialerVidesh Sanchar Nigam Limited (VSNL) Integrated Dialer Software 1.2.000, when the "Save Password"...5.5 Medium
- click-2 ingenium learning management systemClick2Learn Ingenium Learning Management System 5.1 and 6.1 uses weak encryption for passwords ...7.5 High
- microsoft sql serverMicrosoft SQL Server 6.0 through 2000, with SQL Authentication enabled, uses weak password...7.5 High
- mdaemonAlt-N Technologies Mdaemon 5.0 through 5.0.6 uses a weak encryption algorithm to store user...5.5 Medium
- vtun project vtunElectronic Code Book (ECB) mode in VTun 2.0 through 2.5 uses a weak encryption algorithm that...7.5 High
- daansystems newsreactorNewsReactor 1.0 uses a weak encryption scheme, which could allow local users to decrypt the...5.5 Medium
- mckesson pathways homecarePathways Homecare 6.5 uses weak encryption for user names and passwords, which allows local users...7.8 High