CWE-326: Inadequate Encryption Strength
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- jetbrains youtrackIn JetBrains YouTrack before 2021.2.16363, system user passwords were hashed with SHA-256.5.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2021.1, an insecure key generation mechanism for encrypted...5.3 Medium
- jetbrains hubIn JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment...6.5 Medium
- showdoc, star7th star7th/showdoc +1 moreMissing Cryptographic Step in star7th/showdoc5.3 Medium
- meow hash project hashMeow hash 0.5/calico does not sufficiently thwart key recovery by an attacker who can query...5.3 Medium
- jhu charmIn Charm 0.43, any single user can decrypt DAC-MACS or MA-ABE-YJ14 data.6.5 Medium
- jhu charmIn Charm 0.43, any two users can collude to achieve the ability to decrypt YCT14 data.5.9 Medium
- open-xchange documentsOX Documents before 7.10.5-rev5 has Incorrect Access Control for documents that contain XML...4.8 Medium
- open-xchange documentsOX Documents before 7.10.5-rev5 has Incorrect Access Control of converted images because hash...6.5 Medium
- open-xchange documentsOX Documents before 7.10.5-rev7 has Incorrect Access Control for converted documents because hash...6.5 Medium
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar SIEM 7.3.0 to 7.3.3 Patch 8 and 7.4.0 to 7.4.3 GA uses weaker than expected...5.9 Medium
- telegram, telegram desktop +1 moreA reordering issue exists in Telegram before 7.8.1 for Android, Telegram before 7.8.3 for iOS,...5.3 Medium
- ruby-lang ruby, oracle jd edwards enterpriseone tools +1 moreAn issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net:...7.4 High
- ibm cloud pak for applicationsIBM Cloud Pak for Applications 4.3 uses weaker than expected cryptographic algorithms that could...5.9 Medium
- ibm cloud pak for applicationsIBM Cloud Pak for Applications 4.3 uses weaker than expected cryptographic algorithms that could...5.9 Medium
- ibm tivoli netcool impact, tivoli netcool\/impact +1 moreIBM Tivoli Netcool/Impact 7.1.0.20 and 7.1.0.21 uses an insecure SSH server configuration which...5.9 Medium
- fortinet fortimailA missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4...7.5 High
- eclipse tinydtls, the eclipse foundation eclipse tinydtls +1 moreEclipse TinyDTLS through 0.9-rc1 relies on the rand function in the C library, which makes it...7.5 High
- sick visionary-s cx firmwareSICK Visionary-S CX up version 5.21.2.29154R are vulnerable to an Inadequate Encryption Strength...5.3 Medium
- bluetooth core specificationUnencrypted Bluetooth Low Energy baseband links in Bluetooth Core Specifications 4.0 through 5.2...5.3 Medium
- wowonderIn WoWonder 3.0.4, remote attackers can take over any account due to the weak cryptographic...9.8 Critical
- tianocore edk2, edk ii +1 moreExample EDK2 encrypted private key in the IpSecDxe.efi present potential security risks.7.5 High
- google android, samsung mobile devices +1 moreImproper protection of backup path configuration in Samsung Dex prior to SMR MAY-2021 Release 1...4.0 Medium
- broadcom brocade sannav, fabric operating system +1 moreThe host SSH servers of Brocade Fabric OS before Brocade Fabric OS v7.4.2h, v8.2.1c, v8.2.2, v9.0...7.4 High
- versa-networks versa operating systemIn VOS compromised, an attacker at network endpoints can possibly view communications between an...5.9 Medium
- nitrokey fido2 firmware, solokeys solo firmware, somu firmware +2 moreThe flash read-out protection (RDP) level is not enforced during the device initialization phase...6.8 Medium
- html-js doracmsWeak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive...7.5 High
- emerson x-stream enhanced xefd firmware, x-stream enhanced xegk firmware, x-stream enhanced xegp firmware +1 more +3 moreA vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer....7.5 High
- moxa nport ia5150a firmware, nport ia5250a firmware, nport ia5450a firmware +2 moreThe NPort IA5000A Series devices use Telnet as one of the network device management services....5.9 Medium
- kaspersky password managerPassword generator feature in Kaspersky Password Manager was not completely cryptographically...7.5 High
- jetbrains webstormIn JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS.7.5 High
- ieee 802.11, arista c-100 firmware, c-110 firmware +165 more +167 moreThe 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired...2.6 Low
- dell r1-2210 firmware, r1-2401 firmware, vrtx switch modules +9 more +11 moreDell EMC Networking X-Series firmware versions prior to 3.0.1.8 and Dell EMC PowerEdge VRTX...8.8 High
- ibm spectrum protect plusIBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses weaker than expected cryptographic...5.9 Medium
- dell powerscale onefs, emc powerscale onefs +1 moreDell PowerScale OneFS 8.1.0 - 9.1.0 contains an LDAP Provider inability to connect over TLSv1.2...7.5 High
- ibm collaborative lifecycle management, doors next, engineering lifecycle optimization +13 more +15 moreIBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow...5.9 Medium
- ge mu320e firmwareSSH server configuration file does not implement some best practices. This could lead to a...7.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreUsing techniques that built on the slipstream research, a malicious webpage could have scanned...6.5 Medium
- birb-digital wrongthinkPartial secret key disclosure, improper safety number calculation, & inadequate encryption strength8.1 High
- netgear gs116e firmware, jgs516pe firmware +1 moreThe hashing algorithm implemented for NSDP password authentication on NETGEAR JGS516PE/GS116Ev2...8.8 High
- zohocorp manageengine applications control plusZoho ManageEngine Application Control Plus before 100523 has an insecure SSL configuration...9.8 Critical
- xerox altalink b8045 firmware, altalink b8055 firmware, altalink b8065 firmware +7 more +9 moreOn Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction...7.5 High
- joomla joomla\!, joomla! project cms +1 more[20210301] - Core - Insecure randomness within 2FA secret generation5.3 Medium
- e107usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism.8.8 High
- coolkit ewelinkWeak encryption in the Quick Pairing mode in the eWeLink mobile application (Android application...4.6 Medium
- owncloud clientIn the ownCloud application before 2.15 for Android, the lock protection mechanism can be...6.1 Medium
- openssl, oracle business intelligence, enterprise manager for storage management +5 more +7 moreIncorrect SSLv2 rollback protection3.7 Low
- ibm security verify information queueIBM Security Verify Information Queue information disclosure2.2 Low
- sap hana databaseSAP HANA Database, versions - 1.0, 2.0, accepts SAML tokens with MD5 digest, an attacker who...6.5 Medium
- newmediacompany smartyAn issue was discovered in New Media Smarty before 9.10. Passwords are stored in the database in...5.5 Medium
- Show moreLoading…