CWE-327: Use of a Broken or Risky Cryptographic Algorithm
The product uses a broken or risky cryptographic algorithm or protocol.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- nearform fast-jwtfast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key9.1 Critical
- ibm aspera sharesMultiple vulnerabilities have been addressed in IBM Aspera Shares5.9 Medium
- trustedfirmware mbed tlsMbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade.6.5 Medium
- ubiquiti unifi network controller, unifi uap firmware, unifi uap-ac firmware +2 more +4 moreUbiquiti UniFi Devices Use of AES-CBC Allows Key Recovery and Unauthorized Device Control9.0 Critical
- wwbn avideoAVideo has an unauthenticated decrypt oracle leaking any ciphertext7.5 High
- minioMinIO: JWT Algorithm Confusion in OIDC Authentication9.2 Critical
- authlibAuthlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle8.3 High
- samsung smart switchUse of a broken or risky cryptographic algorithm in Smart Switch prior to version 3.7.69.15...7.1 High
- trane tracer concierge, tracer sc, tracer sc+ +2 more +4 moreUse of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge9.2 Critical
- striaeStriae has a hash validation utility vulnerability8.2 High
- janitza umg 96rm-e 230v(5222062), umg 96rm-e 24v(5222063), weidmueller energy meter 750-230 (2540910000) +1 more +3 moreUse of a Broken or Risky Cryptographic Algorithm for firmware images of power analyzer5.3 Medium
- rakuten viber, rakuten viber cloak - android, cloak - windows +2 moreRakuten Viber uses broken or risky cryptographic Algorithm9.8 Critical
- rustdesk, rustdesk-client rustdesk client +1 moreRustDesk Client Accepts Pseudo-Encrypted Config Strings Without Cryptographic Validation8.7 High
- rustdesk server, rustdesk-server-pro rustdesk server pro +1 moreRustDesk Server Generates Config Strings Using Reversible Encoding (Base64 + Reverse) Instead of Encryption8.7 High
- arubanetworks arubaos, hewlett packard enterprise (hpe) hpe aruba networking wireless operating system (aos-10 & aos-8) +1 moreFrame Injection via Shared GTK Allows Traffic Spoofing and Client Compromise5.4 Medium
- ibm mq applianceIBM MQ Appliance uses weaker than expected cryptographic algorithms5.9 Medium
- ibm aspera faspio gatewayIBM Aspera faspio Gateway 1.3.7 has addressed a vulnerability affected by weak cryptographic algorithms5.1 Medium
- cohesity tranzmanCohesity TranZman Migration Appliance Release 4.0 Build 14614 was discovered to use a weak...7.5 High
- sick lms1000 firmware, mrs1000 firmware, sick ag lms1000 +1 more +3 moreAn attacker may exploit the use of outdated and weak MAC algorithms in the device’s SSH service...6.5 Medium
- sick lms1000 firmware, mrs1000 firmware, sick ag lms1000 +1 more +3 moreAn attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to...6.5 Medium
- copeland xweb 300d pro, xweb 500b pro, xweb 500d pro +3 more +5 moreCopeland XWEB and XWEB Pro Use of a Broken or Risky Cryptographic Algorithm10.0 Critical
- parse-community parse-serverParse Server: Account takeover via JWT algorithm confusion in Google auth adapter9.3 Critical
- binardat ltd. 10g08-0800gsm network switch, binardat 10g08-0800gsm firmware +1 moreBinardat 10G08-0800GSM Network Switch Hard-coded RC4 Encryption Key8.7 High
- openclawOpenClaw < 2026.2.15 - Cache Poisoning via Deprecated SHA-1 Hash in Sandbox Configuration8.7 High
- ibm concertMultiple Vulnerabilities in IBM Concert Software.5.9 Medium
- beetel 777vr1, 777vr1 firmware +1 moreBeetel 777VR1 SSH Service risky encryption6.3 Medium
- newbee-ltd newbee-mallnewbee-mall Unsalted MD5 Password Hashing Enables Offline Credential Cracking9.3 Critical
- yokogawa electric corporation fast/tools, yokogawa fast\/tools +1 moreA vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This...8.8 High
- yokogawa electric corporation fast/tools, yokogawa fast\/tools +1 moreA vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This...7.1 High
- parsec.cloud parsec, scille parsec-cloud +1 more`libparsec_crypto` does not check for weak order point of curve 255198.3 High
- n3uron web user interfaceAn issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate...9.8 Critical
- jmlepisto clatterClatter has a PSK Validity Rule Violation issue8.0 High
- celabshq libcrux-ecdh, libcrux-ed25519, libcrux-psq +2 morelibcrux before 0.0.6 Cryptographic Implementation Bug Fixes8.7 High
- salesforce marketing cloud engagementUse of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud...9.8 Critical
- aptsys gemscms backendAn information disclosure vulnerability exists in the /srvs/membersrv/getCashiers endpoint of the...7.5 High
- milner imagedirector captureInsecure Encryption Algorithms Enable Brute-Force Database Credential Access in Milner ImageDirector Capture7.2 High
- juniper junos spaceJunos Space: TLS/SSL server supports use of static key ciphers (ssl-static-key-ciphers)8.2 High
- microsoft windows server 2008 r2 service pack 1, windows server 2008 r2 service pack 1 (server core installation), windows server 2008 service pack 2 +15 more +17 moreWindows Kerberos Information Disclosure Vulnerability5.5 Medium
- samrocketman jervisJervis has AES CBC Mode Without Authentication8.7 High
- samrocketman jervisJervis has a SHA-256 Hex String Padding Bug8.7 High
- samrocketman jervisJervis has Deterministic AES IV Derivation from Passphrase8.7 High
- samrocketman jervisJervis has an RSA PKCS#1 v1.5 Padding Vulnerability8.7 High
github.com/beatt83/jose-swiftSwiftURLjose-swift has JWT Signature Verification Bypass via None Algorithm8.8 High- libtpms project libtpmslibtpms returns wrong initialization vector when certain symmetric ciphers are used5.5 Medium
- tp-link systems inc. tl-wr820n v2.8, tp-link tl-wr820n firmware +1 moreWeak Algorithm Support in SSH Server on TL-WR820N6.0 Medium
- kentico xperienceKentico Xperience <= 12.0.102 URL Hashing Cryptography Vulnerability6.9 Medium
- aws s3 encryption client for goAmazon S3 Encryption Client has a Key Commitment Issue6.0 Medium
- aws s3 encryption client for javaAmazon S3 Encryption Client for Java has a Key Commitment Issue6.0 Medium
- aws sdk for rubyAWS SDK for Ruby's S3 Encryption Client has a Key Commitment Issue6.0 Medium
- aws sdk for phpAWS SDK for PHP's S3 Encryption Client has a Key Commitment Issue6.0 Medium
- Show moreLoading…