cve.bz

CWE-327: Use of a Broken or Risky Cryptographic Algorithm, page 11

Filter

The product uses a broken or risky cryptographic algorithm or protocol.

What the weakness is: CWE-327 at MITRE. OWASP Top 10: A04:2025 Cryptographic Failures

Related attack patterns (CAPEC): 7
  • CAPEC-20 Encryption Brute Forcing Likelihood: Low · Severity: Low
  • CAPEC-97 Cryptanalysis Likelihood: Low · Severity: Very High
  • CAPEC-459 Creating a Rogue Certification Authority Certificate Likelihood: Medium · Severity: Very High
  • CAPEC-473 Signature Spoof
  • CAPEC-475 Signature Spoofing by Improper Validation Likelihood: Low · Severity: High
  • CAPEC-608 Cryptanalysis of Cellular Encryption Severity: High
  • CAPEC-614 Rooting SIM Cards Severity: High

The attack patterns MITRE's CAPEC relates to CWE-327, as MITRE names them. Credits.

Ask an AI about CWE-327

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-327: Use of a Broken or Risky Cryptographic Algorithm and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/327.html and https://cve.bz/cve/cwe/327?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2020-23162EPSS 1.2%

    Sensitive information disclosure and weak encryption in Pyrescom Termod4 time management devices before 10.04k allows remote attackers to read a session-file and obtain plain-text user credentials.

  2. 6.5CVE-2020-4968EPSS 0.3%

    IBM Security Identity Governance and Intelligence 5.2.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 192427.

  3. 5.9CVE-2020-20949EPSS 0.9%

    Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in STM32 cryptographic firmware library software expansion for STM32Cube (UM1924). The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted cipher…

  4. 5.9CVE-2020-20950EPSS 0.9%

    Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in Microchip Libraries for Applications 2018-11-26 All up to 2018-11-26. The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by ma…

  5. 5.5CVE-2013-1053EPSS 0.2%

    In crypt.c of remote-login-service, the cryptographic algorithm used to cache usernames and passwords is insecure. An attacker could use this vulnerability to recover usernames and passwords from the file. This issue affects version 1.0.0-…

  6. 7.5CVE-2020-4596EPSS 0.8%

    IBM Security Guardium Insights 2.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 184812.

  7. 7.5CVE-2020-4595EPSS 0.8%

    IBM Security Guardium Insights 2.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 184819.

  8. 7.5CVE-2020-4594EPSS 0.8%

    IBM Security Guardium Insights 2.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 184800.

  9. 7.5CVE-2020-4898EPSS 0.8%

    IBM Emptoris Strategic Supply Management 10.1.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 190989.

  10. 2.3CVE-2020-23250EPSS 0.2%

    GigaVUE-OS (GVOS) 5.4 - 5.9 uses a weak algorithm for a hash stored in internal database.

  11. 7.5CVE-2019-25006EPSS 0.8%

    An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can produce the wrong answer.

  12. 7.5CVE-2020-14254EPSS 0.6%

    TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10.0.2. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record traffic and later decrypt it.

  13. 7.3CVE-2020-28396EPSS 0.6%

    A vulnerability has been identified in SICAM A8000 CP-8000 (All versions < V16), SICAM A8000 CP-8021 (All versions < V16), SICAM A8000 CP-8022 (All versions < V16). A web server misconfiguration of the affected device can cause insecure ci…

  14. 7.5CVE-2020-25232EPSS 0.8%

    A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Due to the usage of an insecure random number generation function and a deprecated cryptographic function, an attacker could extract the key t…

  15. 7.5CVE-2020-25230EPSS 0.5%

    A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Due to the usage of an outdated cipher mode on port 10005/tcp, an attacker could extract the encryption key from a captured communication with…

  16. 6.3CVE-2020-7339EPSS 0.2%

    Use of a Broken or Risky Cryptographic Algorithm vulnerability in McAfee Database Security Server and Sensor prior to 4.8.0 in the form of a SHA1 signed certificate that would allow an attacker on the same local network to potentially inte…

  17. 5.3CVE-2020-4624EPSS 0.7%

    IBM Cloud Pak for Security 1.3.0.1 (CP4S) uses weaker than expected cryptographic algorithms during negotiation could allow an attacker to decrypt sensitive information.

  18. 7.5CVE-2020-29063EPSS 0.5%

    An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD…

  19. 7.5CVE-2020-4937EPSS 0.8%

    IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 191814.

  20. 8.1CVE-2020-8897EPSS 0.4%

    A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript prior to versions 2.0.0. Due to the non-committing property of AES-GCM (and other AEAD ciphers such as AES-GCM-SIV or (X)ChaCha20Poly1305)…

  21. 8.1CVE-2020-25694EPSS 1.6%

    A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters…

  22. 5.9CVE-2020-25658EPSS 1.7%

    It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA.

  23. 6.5CVE-2020-5943EPSS 0.7%

    In versions 14.1.0-14.1.0.1 and 14.1.2.5-14.1.2.7, when a BIG-IP object is created or listed through the REST interface, the protected fields are obfuscated in the REST response, not protected via a SecureVault cryptogram as TMSH does. One…

  24. 8.3CVE-2020-27653EPSS 0.8%

    Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors.

  25. 8.3CVE-2020-27652EPSS 0.8%

    Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors.

  26. 7.3CVE-2020-27611EPSS 0.7%

    BigBlueButton through 2.2.28 uses STUN/TURN resources from a third party, which may represent an unintended endpoint.

  27. 7.5CVE-2020-4254EPSS 0.8%

    IBM Security Guardium Big Data Intelligence 1.0 (SonarG) uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 175560.

  28. 7.5CVE-2020-4778EPSS 0.8%

    IBM Curam Social Program Management 7.0.9 and 7.0.10 uses MD5 algorithm for hashing token in a single instance which less safe than default SHA-256 cryptographic algorithm used throughout the Cúram application. IBM X-Force ID: 189156.

  29. 5.3CVE-2019-4325EPSS 0.5%

    "HCL AppScan Enterprise makes use of broken or risky cryptographic algorithm to store REST API user details."

  30. 7.5CVE-2020-9491EPSS 2.9%

    In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP, HandleHttpRequest, etc. However intracluster communication such as cluste…

  31. 7.5CVE-2020-11031EPSS 0.3%

    In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data encrypted relies on the password used, if a user sets a weak/predictable password, an attacker could decrypt data. This is fixed in version 9…

  32. 7.5CVE-2020-4614EPSS 0.8%

    IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive information. IBM X-Force ID: 184927.

  33. 7.5CVE-2020-4613EPSS 0.9%

    IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 184925.

  34. 9.8CVE-2020-14517EPSS 0.7%

    Protocol encryption can be easily broken for CodeMeter (All versions prior to 6.90 are affected, including Version 6.90 or newer only if CodeMeter Runtime is running as server) and the server accepts external connections, which may allow a…

  35. 5.4CVE-2020-1596EPSS 0.9%

    <p>A information disclosure vulnerability exists when TLS components use weak hash algorithms. An attacker who successfully exploited this vulnerability could obtain information to further compromise a users's encrypted transmission channe…

  36. 7.8CVE-2019-14089EPSS 0.2%

    u'Keymaster attestation key and device IDs provisioning which is a one time process is incorrectly allowed to be re-provisioned after a user data erase or a factory reset' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Sn…

  37. 9.1CVE-2020-6874EPSS 0.4%

    A ZTE product is impacted by the cryptographic issues vulnerability. The encryption algorithm is not properly used, so remote attackers could use this vulnerability for account credential enumeration attack or brute-force attack for passwo…

  38. 7.5CVE-2020-4174EPSS 1.0%

    IBM Security Guardium Insights 2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 174683.

  39. 7.5CVE-2020-4169EPSS 1.0%

    IBM Security Guardium Insights 2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 174405.

  40. 2.5CVE-2020-8912EPSS 0.2%

    A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can …

  41. 5.6CVE-2020-8911EPSS 0.3%

    A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code (MAC), which then allows an attacker who has…

  42. 7.5CVE-2020-9528EPSS 0.8%

    Firmware developed by Shenzhen Hichip Vision Technology (V6 through V20), as used by many different vendors in millions of Internet of Things devices, suffers from cryptographic issues that allow remote attackers to access user session dat…

  43. 5.9CVE-2020-9526EPSS 0.6%

    CS2 Network P2P through 3.x, as used in millions of Internet of Things devices, suffers from an information exposure flaw that exposes user session data to supernodes in the network, as demonstrated by passively eavesdropping on user video…

  44. 6.3CVE-2020-15128EPSS 0.7%

    In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of attacks that took advantage of other theoretical vulnerabilities in user facing…

  45. 9.8CVE-2020-3681EPSS 0.7%

    Authenticated and encrypted payload MMEs can be forged and remotely sent to any HPAV2 system using a jailbreak key recoverable from code.

  46. 7.5CVE-2020-4185EPSS 0.8%

    IBM Security Guardium 10.5, 10.6, and 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 174803.

  47. 8.8CVE-2020-15098EPSS 2.2%

    In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This al…

  48. 8.8CVE-2020-10927EPSS 0.9%

    This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists wit…

  49. 7.8CVE-2020-7514EPSS 0.2%

    A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker access to the authorization credentials for a device and gain full access.

  50. 7.5CVE-2020-7689EPSS 0.8%

    Data is truncated wrong when its length is greater than 255 bytes.