cve.bz

CWE-327: Use of a Broken or Risky Cryptographic Algorithm, page 8

Filter

The product uses a broken or risky cryptographic algorithm or protocol.

What the weakness is: CWE-327 at MITRE. OWASP Top 10: A04:2025 Cryptographic Failures

Related attack patterns (CAPEC): 7
  • CAPEC-20 Encryption Brute Forcing Likelihood: Low · Severity: Low
  • CAPEC-97 Cryptanalysis Likelihood: Low · Severity: Very High
  • CAPEC-459 Creating a Rogue Certification Authority Certificate Likelihood: Medium · Severity: Very High
  • CAPEC-473 Signature Spoof
  • CAPEC-475 Signature Spoofing by Improper Validation Likelihood: Low · Severity: High
  • CAPEC-608 Cryptanalysis of Cellular Encryption Severity: High
  • CAPEC-614 Rooting SIM Cards Severity: High

The attack patterns MITRE's CAPEC relates to CWE-327, as MITRE names them. Credits.

Ask an AI about CWE-327

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-327: Use of a Broken or Risky Cryptographic Algorithm and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/327.html and https://cve.bz/cve/cwe/327?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2023-27557EPSS 0.4%

    IBM Counter Fraud Management for Safer Payments 6.1.0.00 through 6.1.1.02, 6.2.0.00 through 6.2.2.02, 6.3.0.00 through 6.3.1.02, 6.4.0.00 through 6.4.2.01, and 6.5.0.00 uses weaker than expected cryptographic algorithms that could allow an…

  2. 5.8CVE-2022-40722EPSS 0.3%

    A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.

  3. 6.5CVE-2022-45170EPSS 0.4%

    An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Cryptographic Issue can occur under the /api/v1/vencrypt/decrypt/file endpoint. A malicious user, logged into a victim's account, is able to decipher a file without kno…

  4. 8.1CVE-2023-28244EPSS 2.9%

    Windows Kerberos Elevation of Privilege Vulnerability

  5. 7.5CVE-2023-28509EPSS 0.3%

    Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 use weak encryption for packet-level security and passwords transferred on the wire.

  6. 7.4CVE-2023-22812EPSS 0.3%

    SanDisk PrivateAccess versions prior to 6.4.9 support insecure TLS 1.0 and TLS 1.1 protocols which are susceptible to man-in-the-middle attacks thereby compromising confidentiality and integrity of data.

  7. 7.5CVE-2023-23040EPSS 0.4%

    TP-Link router TL-WR940N V6 3.19.1 Build 180119 uses a deprecated MD5 algorithm to hash the admin password used for basic authentication.

  8. 5.9CVE-2023-23695EPSS 0.4%

    Dell Secure Connect Gateway (SCG) version 5.14.00.12 contains a broken cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by performing MitM attacks and let attackers obtai…

  9. 5.9CVE-2022-22564EPSS 0.5%

    Dell EMC Unity versions before 5.2.0.0.5.173 , use(es) broken cryptographic algorithm. A remote unauthenticated attacker could potentially exploit this vulnerability by performing MitM attacks and let attackers obtain sensitive information.

  10. 7.5CVE-2022-34444EPSS 0.4%

    Dell PowerScale OneFS, versions 9.2.0.x through 9.4.0.x contain an information vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to cause data leak.

  11. 5.5CVE-2022-35720EPSS 0.1%

    IBM Sterling External Authentication Server 6.1.0 and IBM Sterling Secure Proxy 6.0.3 uses weaker than expected cryptographic algorithms during installation that could allow a local attacker to decrypt sensitive information. IBM X-Force I…

  12. 5.3CVE-2023-0452EPSS 0.5%

    Econolite EOS versions prior to 3.2.23 use a weak hash algorithm for encrypting privileged user credentials. A configuration file that is accessible without authentication uses MD5 hashes for encrypting credentials, including those of admi…

  13. 7.5CVE-2022-43917EPSS 0.5%

    IBM WebSphere Application Server 8.5 and 9.0 traditional container uses weaker than expected cryptographic keys that could allow an attacker to decrypt sensitive information. This affects only the containerized version of WebSphere Applica…

  14. 7.5CVE-2022-22462EPSS 0.5%

    IBM Security Verify Governance, Identity Manager virtual appliance component 10.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 225078.

  15. 5.3CVE-2023-0296EPSS 0.3%

    The Birthday attack against 64-bit block ciphers flaw (CVE-2016-2183) was reported for the health checks port (9979) on etcd grpc-proxy component. Even though the CVE-2016-2183 has been fixed in the etcd components, to enable periodic heal…

  16. 4.7CVE-2021-36647EPSS 0.2%

    Use of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp_mod() in lignum.c in Mbed TLS Mbed TLS all versions before 3.0.0, 2.27.0 or 2.16.11 allows attackers with access to precise enough timing and memory access in…

  17. 8.1CVE-2022-23539EPSS 0.5%

    Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an …

  18. 7.5CVE-2022-22461EPSS 0.4%

    IBM Security Verify Governance, Identity Manager 10.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 225007.

  19. 7.5CVE-2022-38391EPSS 0.3%

    IBM Spectrum Control 5.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 233982.

  20. 5.5CVE-2022-4610EPSS 0.2%

    A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected by this issue is some unknown functionality. The manipulation leads to risky cryptogra…

  21. 6.5CVE-2022-46834EPSS 0.3%

    Use of a Broken or Risky Cryptographic Algorithm in SICK RFU65x firmware version < v2.21 allows a low-privileged remote attacker to decrypt the encrypted data if the user requested weak cipher suites to be used for encryption via the SSH i…

  22. 6.5CVE-2022-46833EPSS 0.3%

    Use of a Broken or Risky Cryptographic Algorithm in SICK RFU63x firmware version < v2.21 allows a low-privileged remote attacker to decrypt the encrypted data if the user requested weak cipher suites to be used for encryption via the SSH i…

  23. 6.5CVE-2022-46832EPSS 0.3%

    Use of a Broken or Risky Cryptographic Algorithm in SICK RFU62x firmware version < 2.21 allows a low-privileged remote attacker to decrypt the encrypted data if the user requested weak cipher suites to be used for encryption via the SSH in…

  24. 7.1CVE-2022-46140EPSS 0.2%

    Affected devices use a weak encryption scheme to encrypt the debug zip file. This could allow an authenticated attacker to decrypt the contents of the file and retrieve debug information about the system.

  25. 6.5CVE-2022-27581EPSS 0.3%

    Use of a Broken or Risky Cryptographic Algorithm in SICK RFU61x firmware version <v2.25 allows a low-privileged remote attacker to decrypt the encrypted data if the user requested weak cipher suites to be used for encryption via the SSH in…

  26. 7.5CVE-2022-34361EPSS 0.4%

    IBM Sterling Secure Proxy 6.0.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 230522.

  27. 7.5CVE-2022-34320EPSS 0.5%

    IBM CICS TX 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 229464.

  28. 7.5CVE-2022-34319EPSS 0.5%

    IBM CICS TX 11.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 229463.

  29. 5.3CVE-2022-45195EPSS 0.6%

    SimpleXMQ before 3.4.0, as used in SimpleX Chat before 4.2, does not apply a key derivation function to intended data, which can interfere with forward secrecy and can have other impacts if there is a compromise of a single private key. Th…

  30. 7.5CVE-2021-27784EPSS 0.2%

    The provided HCL Launch Container images contain non-unique HTTPS certificates and a database encryption key. The fix provides directions and tools to replace the non-unique keys and certificates. This does not affect the standard installe…

  31. 9.8CVE-2022-39237EPSS 0.7%

    syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when ver…

  32. 5.3CVE-2022-2781EPSS 0.2%

    In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables.

  33. 7.5CVE-2022-35513ExploitEPSS 6.2%

    The Blink1Control2 application <= 2.2.7 uses weak password encryption and an insecure method of storage.

  34. 7.5CVE-2022-37177EPSS 0.5%

    HireVue Hiring Platform V1.0 suffers from Use of a Broken or Risky Cryptographic Algorithm. NOTE: this is disputed by the vendor for multiple reasons, e.g., it is inconsistent with CVE ID assignment rules for cloud services, and no product…

  35. 6.5CVE-2021-3979EPSS 0.6%

    A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectly passed in an encryption algorithm to create a non random key, which is weaker and can be exploited for loss of confide…

  36. 7.5CVE-2022-38493EPSS 0.3%

    Rhonabwy 0.9.99 through 1.1.x before 1.1.7 doesn't check the RSA private key length before RSA-OAEP decryption. This allows attackers to cause a Denial of Service via a crafted JWE (JSON Web Encryption) token.

  37. 4.3CVE-2022-30320EPSS 0.3%

    Saia Burgess Controls (SBC) PCD through 2022-05-06 uses a Broken or Risky Cryptographic Algorithm. According to FSCT-2022-0063, there is a Saia Burgess Controls (SBC) PCD S-Bus weak credential hashing scheme issue. The affected components …

  38. 9.8CVE-2022-30273EPSS 0.4%

    The Motorola MDLC protocol through 2022-05-02 mishandles message integrity. It supports three security modes: Plain, Legacy Encryption, and New Encryption. In Legacy Encryption mode, traffic is encrypted via the Tiny Encryption Algorithm (…

  39. 5.5CVE-2022-29965EPSS 0.2%

    The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. Access to privileged operations on the maintenance port TELNET interface (23/TCP) on M-series and SIS (CSLS/LSNB/LSNG) nodes …

  40. 9.1CVE-2022-34632EPSS 0.6%

    Rocket-Chip commit 4f8114374d8824dfdec03f576a8cd68bebce4e56 was discovered to contain insufficient cryptography via the component /rocket/RocketCore.scala.

  41. 7.5CVE-2022-31157EPSS 0.5%

    LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the function used to generate random nonces was not sufficiently cryptographically complex. Users should upgrade to vers…

  42. 5.3CVE-2022-34757EPSS 0.3%

    A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists where weak cipher suites can be used for the SSH connection between Easergy Pro software and the device, which may allow an attacker to observe protected comm…

  43. 4.7CVE-2022-30187EPSS 0.5%

    Azure Storage Library Information Disclosure Vulnerability

  44. 5.3CVE-2022-2097EPSS 4.9%

    AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wa…

  45. 9.8CVE-2022-31230EPSS 0.7%

    Dell PowerScale OneFS, versions 8.2.x-9.2.x, contain broken or risky cryptographic algorithm. A remote unprivileged malicious attacker could potentially exploit this vulnerability, leading to full system access.

  46. 7.5CVE-2022-28622EPSS 0.8%

    A potential security vulnerability has been identified in HPE StoreOnce Software. The SSH server supports weak key exchange algorithms which could lead to remote unauthorized access. HPE has made the following software update to resolve th…

  47. 7.5CVE-2022-28166EPSS 0.6%

    In Brocade SANnav version before SANN2.2.0.2 and Brocade SANNav before 2.1.1.8, the implementation of TLS/SSL Server Supports the Use of Static Key Ciphers (ssl-static-key-ciphers) on ports 443 & 18082.

  48. 7.5CVE-2022-28382EPSS 1.8%

    An issue was discovered in certain Verbatim drives through 2022-03-31. Due to the use of an insecure encryption AES mode (Electronic Codebook, aka ECB), an attacker may be able to extract information even from encrypted data, for example b…

  49. 7.5CVE-2022-24296EPSS 1.2%

    Use of a Broken or Risky Cryptographic Algorithm vulnerability in Air Conditioning System G-150AD Ver. 3.21 and prior, Air Conditioning System AG-150A-A Ver. 3.21 and prior, Air Conditioning System AG-150A-J Ver. 3.21 and prior, Air Condit…

  50. 7.5CVE-2022-29249EPSS 0.7%

    JavaEZ is a library that adds new functions to make Java easier. A weakness in JavaEZ 1.6 allows force decryption of locked text by unauthorized actors. The issue is NOT critical for non-secure applications, however may be critical in a si…