cve.bz

CWE-327: Use of a Broken or Risky Cryptographic Algorithm, page 6

Filter

The product uses a broken or risky cryptographic algorithm or protocol.

What the weakness is: CWE-327 at MITRE. OWASP Top 10: A04:2025 Cryptographic Failures

Related attack patterns (CAPEC): 7
  • CAPEC-20 Encryption Brute Forcing Likelihood: Low · Severity: Low
  • CAPEC-97 Cryptanalysis Likelihood: Low · Severity: Very High
  • CAPEC-459 Creating a Rogue Certification Authority Certificate Likelihood: Medium · Severity: Very High
  • CAPEC-473 Signature Spoof
  • CAPEC-475 Signature Spoofing by Improper Validation Likelihood: Low · Severity: High
  • CAPEC-608 Cryptanalysis of Cellular Encryption Severity: High
  • CAPEC-614 Rooting SIM Cards Severity: High

The attack patterns MITRE's CAPEC relates to CWE-327, as MITRE names them. Credits.

Ask an AI about CWE-327

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-327: Use of a Broken or Risky Cryptographic Algorithm and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/327.html and https://cve.bz/cve/cwe/327?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2024-39745EPSS 0.3%

    IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

  2. 9.1CVE-2024-41270EPSS 0.3%

    An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecated TLS version.

  3. 7.5CVE-2024-28972EPSS 0.3%

    Dell InsightIQ, Verion 5.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure.

  4. 8.8CVE-2024-40465EPSS 0.4%

    An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go file

  5. 7.5CVE-2024-39731EPSS 0.3%

    IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 295970.

  6. 7.5CVE-2024-30098EPSS 1.2%

    Windows Cryptographic Services Security Feature Bypass Vulnerability

  7. 5.3CVE-2023-41928EPSS 0.1%

    The device is observed to accept deprecated TLS protocols, increasing the risk of cryptographic weaknesses.

  8. 5.3CVE-2023-41927EPSS 0.1%

    The server supports at least one cipher suite which is on the NCSC-NL list of cipher suites to be phased out, increasing the risk of cryptographic weaknesses.

  9. 7.5CVE-2024-32852EPSS 0.2%

    Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.0 contain use of a broken or risky cryptographic algorithm vulnerability. An unprivileged network malicious attacker could potentially exploit this vulnerability, leading to data leaks.

  10. 5.5CVE-2024-37137EPSS 0.1%

    Dell Key Trust Platform, v3.0.6 and prior, contains Use of a Cryptographic Primitive with a Risky Implementation vulnerability. A local privileged attacker could potentially exploit this vulnerability, leading to privileged information dis…

  11. 7.5CVE-2023-38371EPSS 0.5%

    IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 261198.

  12. 5.9CVE-2024-29175EPSS 0.3%

    Dell PowerProtect Data Domain, versions prior to 7.13.0.0, LTS 7.7.5.40, LTS 7.10.1.30 contain an weak cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to man-in…

  13. 5.3CVE-2024-3264EPSS 0.2%

    Use of a Broken or Risky Cryptographic Algorithm vulnerability in Mia Technology Inc. Mia-Med Health Aplication allows Signature Spoofing by Improper Validation. This issue affects Mia-Med Health Aplication: before 1.0.14.

  14. 7.5CVE-2024-35537EPSS 0.3%

    TVS Motor Company Limited TVS Connect Android v4.6.0 and IOS v5.0.0 was discovered to insecurely handle the RSA key pair, allowing attackers to possibly access sensitive information via decryption.

  15. 9.8CVE-2024-32911EPSS 0.2%

    There is a possible escalation of privilege due to improperly used crypto. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

  16. 6.8CVE-2024-5559EPSS 0.2%

    CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists that could cause denial of service, device reboot, or an attacker gaining full control of the relay when a specially crafted reset token is entered into the fro…

  17. 7.5CVE-2024-36823EPSS 0.8%

    The encrypt() function of Ninja Core v7.0.0 was discovered to use a weak cryptographic algorithm, leading to a possible leakage of sensitive information.

  18. 5.1CVE-2024-20070EPSS 0.1%

    In modem, there is a possible information disclosure due to using risky cryptographic algorithm during connection establishment negotiation. This could lead to remote information disclosure, when weak encryption algorithm is used, with no …

  19. 9.8CVE-2024-31510EPSS 0.6%

    An issue in Open Quantum Safe liboqs v.10.0 allows a remote attacker to escalate privileges via the crypto_sign_signature parameter in the /pqcrystals-dilithium-standard_ml-dsa-44-ipd_avx2/sign.c component.

  20. 7.5CVE-2024-4563EPSS 0.2%

    The Progress MOVEit Automation configuration export function prior to 2024.0.0 uses a cryptographic method with insufficient bit length.

  21. 9.0CVE-2024-31989EPSS 1.5%

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It has been discovered that an unprivileged pod in a different namespace on the same cluster could connect to the Redis server on port 6379. Despite having installed…

  22. 8.1CVE-2024-4765EPSS 0.3%

    Web application manifests were stored by using an insecure MD5 hash which allowed for a hash collision to overwrite another application's manifest. This could have been exploited to run arbitrary code in another application's context. *Th…

  23. 7.5CVE-2024-25968EPSS 0.4%

    Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosu…

  24. 7.5CVE-2023-40696EPSS 0.3%

    IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 264939.

  25. 7.5CVE-2020-4874EPSS 0.3%

    IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 190837.

  26. 6.5CVE-2024-33663EPSS 0.3%

    python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.

  27. 5.5CVE-2023-37396EPSS 0.08%

    IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain sensitive information due to improper encryption of certain data. IBM X-Force ID: 259671.

  28. 4.3CVE-2024-29056EPSS 1.0%

    Windows Authentication Elevation of Privilege Vulnerability

  29. 6.5CVE-2023-50313EPSS 0.2%

    IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configuration. IBM X-Force ID: 274812.

  30. 7.5CVE-2024-25963EPSS 0.3%

    Dell PowerScale OneFS, versions 8.2.2.x through 9.5.0.x contains a use of a broken cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure.

  31. 5.3CVE-2024-28834EPSS 0.7%

    A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_R…

  32. 9.1CVE-2024-22463EPSS 0.3%

    Dell PowerScale OneFS 8.2.x through 9.6.0.x contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unprivileged attacker could potentially exploit this vulnerability, leading to compromise of confidentiality an…

  33. 7.5CVE-2024-27255EPSS 0.3%

    IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt hi…

  34. 5.3CVE-2024-22458EPSS 0.1%

    Dell Secure Connect Gateway, 5.18, contains an Inadequate Encryption Strength Vulnerability. An unauthenticated network attacker could potentially exploit this vulnerability, allowing an attacker to recover plaintext from a block of cipher…

  35. 6.5CVE-2023-50312EPSS 0.6%

    IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.2 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configuration. IBM X-Force ID: 274711.

  36. 9.8CVE-2023-51392EPSS 0.2%

    Ember ZNet between v7.2.0 and v7.4.0 used software AES-CCM instead of integrated hardware cryptographic accelerators, potentially increasing risk of electromagnetic and differential power analysis sidechannel attacks.

  37. 7.5CVE-2022-34309EPSS 0.5%

    IBM CICS TX Standard and Advanced 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 229440.

  38. 7.5CVE-2022-34310EPSS 0.5%

    IBM CICS TX Standard and Advanced 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 229441.

  39. 7.5CVE-2024-22361EPSS 0.3%

    IBM Semeru Runtime 8.0.302.0 through 8.0.392.0, 11.0.12.0 through 11.0.21.0, 17.0.1.0 - 17.0.9.0, and 21.0.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-…

  40. 5.5CVE-2024-22318ExploitEPSS 0.6%

    IBM i Access Client Solutions (ACS) 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.4 is vulnerable to NT LAN Manager (NTLM) hash disclosure by an attacker modifying UNC capable paths within ACS configuration files to point to a hostile serv…

  41. 5.3CVE-2024-24559EPSS 0.3%

    Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management when compiling the `IR` for `sha3_64`. Concretely, the `height` variable is miscalculated. The vulnerability can't be triggered without writ…

  42. 7.5CVE-2023-51838EPSS 0.5%

    Ylianst MeshCentral 1.1.16 suffers from Use of a Broken or Risky Cryptographic Algorithm.

  43. 7.5CVE-2023-50937EPSS 0.3%

    IBM PowerSC 1.3, 2.0, and 2.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 275117.

  44. 7.5CVE-2023-50939EPSS 0.3%

    IBM PowerSC 1.3, 2.0, and 2.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 275129.

  45. 4.4CVE-2024-1040EPSS 0.1%

    Gessler GmbH WEB-MASTER user account is stored using a weak hashing algorithm. The attacker can restore the passwords by breaking the hashes stored on the device.

  46. 9.1CVE-2023-51839EPSS 0.4%

    DeviceFarmer stf v3.6.6 suffers from Use of a Broken or Risky Cryptographic Algorithm.

  47. 6.5CVE-2024-22192EPSS 0.3%

    Ursa is a cryptographic library for use with blockchains. The revocation scheme that is part of the Ursa CL-Signatures implementations has a flaw that could impact the privacy guarantees defined by the AnonCreds verifiable credential model…

  48. 8.1CVE-2024-21670EPSS 0.3%

    Ursa is a cryptographic library for use with blockchains. The revocation schema that is part of the Ursa CL-Signatures implementations has a flaw that could impact the privacy guarantees defined by the AnonCreds verifiable credential model…

  49. 7.5CVE-2023-49259EPSS 0.3%

    The authentication cookies are generated using an algorithm based on the username, hardcoded secret and the up-time, and can be guessed in a reasonable time.

  50. 9.1CVE-2023-5347EPSS 1.3%

    An Improper Verification of Cryptographic Signature vulnerability in the update process of Korenix JetNet Series allows replacing the whole operating system including Trusted Executables. This issue affects JetNet devices older than firmwa…