cve.bz

CWE-326: Inadequate Encryption Strength, page 3

Filter

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

What the weakness is: CWE-326 at MITRE. OWASP Top 10: A04:2025 Cryptographic Failures

Related attack patterns (CAPEC): 3
  • CAPEC-20 Encryption Brute Forcing Likelihood: Low · Severity: Low
  • CAPEC-112 Brute Force Severity: High
  • CAPEC-192 Protocol Analysis Likelihood: Low · Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-326, as MITRE names them. Credits.

Ask an AI about CWE-326

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-326: Inadequate Encryption Strength and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/326.html and https://cve.bz/cve/cwe/326?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2024-22892EPSS 0.2%

    OpenSlides 4.0.15 was discovered to be using a weak hashing algorithm to store passwords.

  2. 5.3CVE-2024-40761EPSS 0.7%

    Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. Using the MD5 value of a user's email to access Gravatar is insecure and can lead to the leakage of user email. The official …

  3. 7.5CVE-2024-39928EPSS 0.6%

    In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn, random string generated by the Token when starting Py4j uses the Commons Lang's RandomStringUtils. Users are recommended to upgrade to version 1.6.0, wh…

  4. 7.8CVE-2024-45394EPSS 0.09%

    Authenticator is a browser extension that generates two-step verification codes. In versions 7.0.0 and below, encryption keys for user data were stored encrypted at-rest using only AES-256 and the EVP_BytesToKey KDF. Therefore, attackers w…

  5. 8.8CVE-2021-38121EPSS 0.2%

    Insufficient or weak TLS protocol version identified in Advance authentication client server communication when specific service is accessed between devices.  This issue affects NetIQ Advance Authentication versions before 6.3.5.1

  6. 7.1CVE-2024-21787EPSS 0.07%

    Inadequate encryption strength for some BMRA software before version 22.08 may allow an authenticated user to potentially enable escalation of privilege via local access.

  7. 6.0CVE-2024-41681EPSS 0.2%

    A vulnerability has been identified in Location Intelligence family (All versions < V4.4). The web server of affected products is configured to support weak ciphers by default. This could allow an unauthenticated attacker in an on-path po…

  8. 8.3CVE-2024-5800EPSS 0.3%

    Diffie-Hellman groups with insufficient strength are used in the SSL/TLS stack of B&R Automation Runtime versions before 6.0.2, allowing a network attacker to decrypt the SSL/TLS communication.

  9. 8.1CVE-2024-42163EPSS 0.3%

    Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to take over the account of any user by predicting the token for the password reset link.

  10. 8.6CVE-2024-21881EPSS 0.3%

    Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.This issue affects Envoy: 4.x and 5.x

  11. 6.5CVE-2024-40719EPSS 0.2%

    The encryption strength of the authorization keys in CHANGING Information Technology TCBServiSign Windows Version is insufficient. When a remote attacker tricks a victim into visiting a malicious website, TCBServiSign will treat that websi…

  12. 9.0CVE-2024-32758EPSS 0.4%

    Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchange

  13. 5.9CVE-2024-37034EPSS 0.2%

    An issue was discovered in Couchbase Server before 7.2.5 and 7.6.0 before 7.6.1. It does not ensure that credentials are negotiated with the Key-Value (KV) service using SCRAM-SHA when remote link encryption is configured for Half-Secure.

  14. 8.2CVE-2024-38867EPSS 0.2%

    A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.64), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CP300) (All versions < V9.64), SIPROTEC 5 6MD86 (CP200) (All versions), SIPROTEC 5 6MD86 (CP…

  15. 5.4CVE-2024-38277EPSS 0.2%

    A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two.

  16. 3.7CVE-2024-30119EPSS 0.2%

    HCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security Header.  This could allow an attacker to intercept or manipulate data during redirection.

  17. 5.5CVE-2024-34113EPSS 0.3%

    ColdFusion versions 2023u7, 2021u13 and earlier are affected by a Weak Cryptography for Passwords vulnerability that could result in a security feature bypass. This vulnerability arises due to the use of insufficiently strong cryptographic…

  18. 7.5CVE-2024-36823EPSS 0.8%

    The encrypt() function of Ninja Core v7.0.0 was discovered to use a weak cryptographic algorithm, leading to a possible leakage of sensitive information.

  19. 6.5CVE-2024-28974EPSS 0.1%

    Dell Data Protection Advisor, version(s) 19.9, contain(s) an Inadequate Encryption Strength vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.

  20. 6.5CVE-2024-23580EPSS 0.1%

    HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of One-Time Passwords (OTPs). This could allow an attacker with access to the database to recover some or all encrypted values.

  21. 6.5CVE-2024-23579EPSS 0.1%

    HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questions. This could allow an attacker with access to the database to recover some or all encrypted values.

  22. 4.4CVE-2023-37397EPSS 0.08%

    IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain or modify sensitive information due to improper encryption of certain data. IBM X-Force ID: 259672.

  23. 5.5CVE-2022-40745EPSS 0.1%

    IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain sensitive information due to weaker than expected security. IBM X-Force ID: 236452.

  24. 7.5CVE-2024-29969EPSS 0.3%

    When a Brocade SANnav installation is upgraded from Brocade SANnav v2.2.2 to Brocade SANnav 2.3.0, TLS/SSL weak message authentication code ciphers are added by default for port 18082.

  25. 5.7CVE-2024-29951EPSS 0.2%

    Brocade SANnav before v2.3.1 and v2.3.0a uses the SHA-1 hash in internal SSH ports that are not open to remote connection.

  26. 5.9CVE-2024-29950EPSS 0.3%

    The class FileTransfer implemented in Brocade SANnav before v2.3.1, v2.3.0a, uses the ssh-rsa signature scheme, which has a SHA-1 hash. The vulnerability could allow a remote, unauthenticated attacker to perform a man-in-the-middle attack.

  27. 5.9CVE-2024-3387EPSS 0.2%

    A weak (low bit strength) device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle (MitM) attack to capture encrypted traffic between the Panorama management server and the firewalls…

  28. 6.5CVE-2024-28755EPSS 0.4%

    An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum TLS version to be negotiated was not restored to the configured one. An attacker was able to preven…

  29. 6.8CVE-2024-28860EPSS 0.2%

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Users of IPsec transparent encryption in Cilium may be vulnerable to cryptographic attacks that render the transparent encryption ineffective. In pa…

  30. 6.5CVE-2022-32753EPSS 0.2%

    IBM Security Verify Directory 10.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 228444.

  31. 7.8CVE-2024-25102EPSS 0.1%

    This vulnerability exists in AppSamvid software due to the usage of a weaker cryptographic algorithm (hash) SHA1 in user login component. An attacker with local administrative privileges could exploit this to obtain the password of AppSamv…

  32. 7.1CVE-2024-1224EPSS 0.1%

    This vulnerability exists in USB Pratirodh due to the usage of a weaker cryptographic algorithm (hash) SHA1 in user login component. A local attacker with administrative privileges could exploit this vulnerability to obtain the password of…

  33. 6.8CVE-2024-22894EPSS 0.7%

    An issue fixed in AIT-Deutschland Alpha Innotec Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later and Novelan Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later, allows remote attackers to execute arbitrary code vi…

  34. 7.5CVE-2024-23656EPSS 0.4%

    Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. `cmd/dex/serve.go` line 425 seemingly sets TLS 1.2 as minimum version, but the whole `tl…

  35. 7.5CVE-2023-7237EPSS 0.3%

    Lantronix XPort sends weakly encoded credentials within web request headers.

  36. 5.7CVE-2024-20692EPSS 1.2%

    Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability

  37. 6.5CVE-2023-26943EPSS 0.2%

    Weak encryption mechanisms in RFID Tags in Yale Keyless Lock v1.0 allows attackers to create a cloned tag via physical proximity to the original.

  38. 6.5CVE-2023-26942EPSS 0.2%

    Weak encryption mechanisms in RFID Tags in Yale IA-210 Alarm v1.0 allows attackers to create a cloned tag via physical proximity to the original.

  39. 6.5CVE-2023-26941EPSS 0.2%

    Weak encryption mechanisms in RFID Tags in Yale Conexis L1 v1.1.0 allows attackers to create a cloned tag via physical proximity to the original.

  40. 2.4CVE-2023-28896EPSS 0.1%

    Access to critical Unified Diagnostics Services (UDS) of the Modular Infotainment Platform 3 (MIB3) infotainment is transmitted via Controller Area Network (CAN) bus in a form that can be easily decoded by attackers with physical access to…

  41. 6.1CVE-2023-48034EPSS 0.2%

    An issue discovered in Acer Wireless Keyboard SK-9662 allows attacker in physical proximity to both decrypt wireless keystrokes and inject arbitrary keystrokes via use of weak encryption.

  42. 7.5CVE-2023-48051EPSS 0.2%

    An issue in /upydev/keygen.py in upydev v0.4.3 allows attackers to decrypt sensitive information via weak encryption padding.

  43. 6.5CVE-2023-43757EPSS 0.5%

    Inadequate encryption strength vulnerability in multiple routers provided by ELECOM CO.,LTD. and LOGITEC CORPORATION allows a network-adjacent unauthenticated attacker to guess the encryption key used for wireless LAN communication and int…

  44. 7.5CVE-2023-46894EPSS 0.5%

    An issue discovered in esptool 4.6.2 allows attackers to view sensitive information via weak cryptographic algorithm.

  45. 6.5CVE-2023-47373EPSS 0.4%

    The leakage of channel access token in DRAGON FAMILY Line 13.6.1 allows remote attackers to send malicious notifications to victims.

  46. 6.5CVE-2023-47372EPSS 0.4%

    The leakage of channel access token in UPDATESALON C-LOUNGE Line 13.6.1 allows remote attackers to send malicious notifications to victims.

  47. 6.5CVE-2023-47370EPSS 0.4%

    The leakage of channel access token in bluetrick Line 13.6.1 allows remote attackers to send malicious notifications to victims.

  48. 6.5CVE-2023-47368EPSS 0.4%

    The leakage of channel access token in taketorinoyu Line 13.6.1 allows remote attackers to send malicious notifications to victims.

  49. 6.5CVE-2023-47369EPSS 0.4%

    The leakage of channel access token in best_training_member Line 13.6.1 allows remote attackers to send malicious notifications.

  50. 6.5CVE-2023-47367EPSS 0.4%

    The leakage of channel access token in platinum clinic Line 13.6.1 allows remote attackers to send malicious notifications to victims.