CWE-327: Use of a Broken or Risky Cryptographic Algorithm, page 7
Filter
The product uses a broken or risky cryptographic algorithm or protocol.
What the weakness is: CWE-327 at MITRE. OWASP Top 10: A04:2025 Cryptographic Failures
Related attack patterns (CAPEC): 7
- CAPEC-20 Encryption Brute Forcing Likelihood: Low · Severity: Low
- CAPEC-97 Cryptanalysis Likelihood: Low · Severity: Very High
- CAPEC-459 Creating a Rogue Certification Authority Certificate Likelihood: Medium · Severity: Very High
- CAPEC-473 Signature Spoof
- CAPEC-475 Signature Spoofing by Improper Validation Likelihood: Low · Severity: High
- CAPEC-608 Cryptanalysis of Cellular Encryption Severity: High
- CAPEC-614 Rooting SIM Cards Severity: High
The attack patterns MITRE's CAPEC relates to CWE-327, as MITRE names them. Credits.
Ask an AI about CWE-327
Show the prompt
Explain CWE-327: Use of a Broken or Risky Cryptographic Algorithm and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/327.html and https://cve.bz/cve/cwe/327?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 9.1CVE-2023-50351EPSS 0.2%
HCL DRYiCE MyXalytics is impacted by the use of an insecure key rotation mechanism which can allow an attacker to compromise the confidentiality or integrity of data.
- 7.5CVE-2023-50350EPSS 0.2%
HCL DRYiCE MyXalytics is impacted by the use of a broken cryptographic algorithm for encryption, potentially giving an attacker ability to decrypt sensitive information.
- 7.5CVE-2021-46900EPSS 0.4%
Sympa before 6.2.62 relies on a cookie parameter for certain security objectives, but does not ensure that this parameter exists and has an unpredictable value. Specifically, the cookie parameter is both a salt for stored passwords and an …
- 6.5CVE-2023-5962EPSS 0.3%
A weak cryptographic algorithm vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. This vulnerability can help an attacker compromise the confidentiality of sensitive data. This vulnerability may lea…
- 7.5CVE-2023-41097EPSS 0.3%
An Observable Timing Discrepancy, Covert Timing Channel vulnerability in Silabs GSDK on ARM potentially allows Padding Oracle Crypto Attack on CBC PKCS7.This issue affects GSDK: through 4.4.0.
- 7.5CVE-2023-50481EPSS 0.3%
An issue was discovered in blinksocks version 3.3.8, allows remote attackers to obtain sensitive information via weak encryption algorithms in the component /presets/ssr-auth-chain.js.
- 9.1CVE-2023-50475EPSS 0.5%
An issue was discovered in bcoin-org bcoin version 2.2.0, allows remote attackers to obtain sensitive information via weak hashing algorithms in the component \vendor\faye-websocket.js.
- 5.3CVE-2023-28053EPSS 0.4%
Dell NetWorker Virtual Edition versions 19.8 and below contain the use of deprecated cryptographic algorithms in the SSH component. A remote unauthenticated attacker could potentially exploit this vulnerability leading to some information …
- 7.5CVE-2022-43843EPSS 0.4%
IBM Spectrum Scale 5.1.5.0 through 5.1.5.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 239080.
- 8.1CVE-2021-27795EPSS 0.2%
Brocade Fabric OS (FOS) hardware platforms running any version of Brocade Fabric OS software, which supports the license string format; contain cryptographic issues that could allow for the installation of forged or fraudulent license …
- 4.3CVE-2022-24403EPSS 0.1%
The TETRA TA61 identity encryption function internally uses a 64-bit value derived exclusively from the SCK (Class 2 networks) or CCK (Class 3 networks). The structure of TA61 allows for efficient recovery of this 64-bit value, allowing an…
- 6.5CVE-2023-26024EPSS 0.2%
IBM Planning Analytics on Cloud Pak for Data 4.0 could allow an attacker on a shared network to obtain sensitive information caused by insecure network communication. IBM X-Force ID: 247898.
- 7.5CVE-2023-38361EPSS 0.5%
IBM CICS TX Advanced 10.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 260770.
- 8.8CVE-2023-47640EPSS 0.4%
DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources (i.e. st…
- 7.5CVE-2023-5627EPSS 0.4%
A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable. This vulnerability arises from the incorrect implementation of sensitive information protection, potentially allowing malicious users…
- 9.1CVE-2023-46233EPSS 0.6%
crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it…
- 9.1CVE-2023-46133EPSS 0.5%
CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript. Prior to version 2.1.0, CryptoES PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry st…
- 7.5CVE-2023-30994EPSS 0.3%
IBM QRadar SIEM 7.5.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 254138
- 7.5CVE-2022-33160EPSS 0.3%
IBM Security Directory Suite 8.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 228568.
- 7.5CVE-2023-3350EPSS 0.3%
A Cryptographic Issue vulnerability has been found on IBERMATICA RPS, affecting version 2019. By firstly downloading the log file, an attacker could retrieve the SQL query sent to the application in plaint text. This log file contains the …
- 5.9CVE-2023-39252EPSS 0.4%
Dell SCG Policy Manager 5.16.00.14 contains a broken cryptographic algorithm vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by performing MitM attacks and let attackers obtain sensitive informa…
- 8.8CVE-2023-43635EPSS 0.1%
Vault Key Sealed With SHA1 PCRs The measured boot solution implemented in EVE OS leans on a PCR locking mechanism. Different parts of the system update different PCR values in the TPM, resulting in a unique value for each PCR entry.…
- 9.8CVE-2023-34039ExploitEPSS 67%
Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. A malicious actor with network access to Aria Operations for Networks could bypass SSH authentication to gai…
- 8.1CVE-2023-34758EPSS 0.6%
Sliver from v1.5.x to v1.5.39 has an improper cryptographic implementation, which allows attackers to execute a man-in-the-middle attack via intercepted and crafted responses.
- 7.5CVE-2023-38730EPSS 0.4%
IBM Storage Copy Data Management 2.2.0.0 through 2.2.19.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 262268.
- 5.5CVE-2023-40371EPSS 0.1%
IBM AIX 7.2, 7.3, VIOS 3.1's OpenSSH implementation could allow a non-privileged local user to access files outside of those allowed due to improper access controls. IBM X-Force ID: 263476.
- 7.5CVE-2023-4331EPSS 0.4%
Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that support obsolete and vulnerable TLS protocols
- 7.5CVE-2023-4326EPSS 0.4%
Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that supports obsolete SHA1-based ciphersuites
- 7.1CVE-2023-23347EPSS 0.1%
HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information.
- 7.1CVE-2023-23346EPSS 0.1%
HCL DRYiCE MyCloud is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information.
- 5.3CVE-2023-37484EPSS 2.0%
SAP PowerDesigner - version 16.7, queries all password hashes in the backend database and compares it with the user provided one during login attempt, which might allow an attacker to access password hashes from the client's memory.
- 7.5CVE-2021-38933EPSS 0.4%
IBM Sterling Connect:Direct for UNIX 1.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 210574.
- 7.5CVE-2023-37464EPSS 0.7%
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fix…
- 9.8CVE-2023-34130EPSS 0.3%
SonicWall GMS and Analytics use outdated Tiny Encryption Algorithm (TEA) with a hardcoded key to encrypt sensitive data. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- 7.8CVE-2023-21399EPSS 0.07%
there is a possible way to bypass cryptographic assurances due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- 6.8CVE-2023-32043EPSS 0.5%
Windows Remote Desktop Security Feature Bypass Vulnerability
- 7.4CVE-2023-36749EPSS 0.3%
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM …
- 5.5CVE-2023-35890EPSS 0.1%
IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security, caused by the improper encoding in a local configuration file. IBM X-Force ID: 258637.
- 6.5CVE-2023-36608EPSS 0.2%
The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm.
- 7.5CVE-2023-26276EPSS 0.4%
IBM QRadar SIEM 7.5.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 248147.
- 7.8CVE-2023-28006EPSS 0.1%
The OSD Bare Metal Server uses a cryptographic algorithm that is no longer considered sufficiently secure.
- 8.8CVE-2023-21115EPSS 0.1%
In btm_sec_encrypt_change of btm_sec.cc, there is a possible way to downgrade the link key type due to improperly used crypto. This could lead to paired device escalation of privilege with no additional execution privileges needed. User in…
- 7.5CVE-2022-43949EPSS 0.4%
A use of a broken or risky cryptographic algorithm [CWE-327] in Fortinet FortiSIEM before 6.7.1 allows a remote unauthenticated attacker to perform brute force attacks on GUI endpoints via taking advantage of outdated hashing methods.
- 6.5CVE-2023-28043EPSS 0.3%
Dell SCG 5.14 contains an information disclosure vulnerability during the SRS to SCG upgrade path. A remote low privileged malicious user could potentially exploit this vulnerability to retrieve the plain text.
- 7.5CVE-2023-2900EPSS 0.7%
A vulnerability was found in NFine Rapid Development Platform 20230511. It has been classified as problematic. Affected is an unknown function of the file /Login/CheckLogin. The manipulation leads to use of weak hash. It is possible to lau…
- 7.5CVE-2023-28076EPSS 0.4%
CloudLink 7.1.2 and all prior versions contain a broken or risky cryptographic algorithm vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability leading to some information disclosure.
- 9.8CVE-2022-36937EPSS 0.5%
HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS1.0 has numerous published vulnerabilities and is deprecated. HHVM 4.153.4, 4.168.2, 4.169.2, 4.170.2, 4.171.1, 4.…
- 7.5CVE-2022-22313EPSS 0.4%
IBM QRadar Data Synchronization App 1.0 through 3.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 217370.
- 7.4CVE-2022-45858EPSS 0.2%
A use of a weak cryptographic algorithm vulnerability [CWE-327] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.0 all versions, 8.8.0 all versions, 8.7.0 all versions may increase the chances of an attacker to have access to sensitive in…
- 7.5CVE-2023-30441EPSS 0.6%
IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination of flaws and configurations. IBM X-Force ID: 253188.