cve.bz

OWASP A04:2025 Cryptographic Failures vulnerabilities, newest first, page 33

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A04:2025 at MITRE.

Its weaknesses: 32

CWE-261, CWE-296, CWE-319, CWE-320, CWE-321, CWE-322, CWE-323, CWE-324, CWE-325, CWE-326, CWE-327, CWE-328, CWE-329, CWE-330, CWE-331, CWE-332, CWE-334, CWE-335, CWE-336, CWE-337, CWE-338, CWE-340, CWE-342, CWE-347, CWE-523, CWE-757, CWE-759, CWE-760, CWE-780, CWE-916, CWE-1240, CWE-1241

  1. 9.8CVE-2025-57174ExploitEPSS 2.2%

    An issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and possibly other previous versions. The rfpiped service listening on TCP port 555 which uses static AES encryption keys ha…

  2. 8.8CVE-2025-50110EPSS 0.3%

    An issue was discovered in the method push.lite.avtech.com.AvtechLib.GetHttpsResponse in AVTECH EagleEyes Lite 2.0.0, the GetHttpsResponse method transmits sensitive information - including internal server URLs, account IDs, passwords, and…

  3. 4.3CVE-2025-9078EPSS 0.2%

    Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to properly validate cache keys for link metadata which allows authenticated users to access unauthorized posts and poison…

  4. 5.3CVE-2025-10148EPSS 0.5%

    curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allo…

  5. 1.3CVE-2025-10250EPSS 0.2%

    A weakness has been identified in DJI Mavic Spark, Mavic Air and Mavic Mini 01.00.0500. Affected is an unknown function of the component Telemetry Channel. Executing manipulation can lead to use of hard-coded cryptographic key . The attac…

  6. 7.5CVE-2024-45671EPSS 0.2%

    IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7, and 10.0.8 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

  7. 8.4CVE-2025-55976EPSS 3.5%

    Intelbras IWR 3000N 1.9.8 exposes the Wi-Fi password in plaintext via the /api/wireless endpoint. Any unauthenticated user on the local network can directly obtain the Wi-Fi network password by querying this endpoint.

  8. 6.0CVE-2025-20248EPSS 0.10%

    A vulnerability in the installation process of Cisco IOS XR Software could allow an authenticated, local attacker to bypass Cisco IOS XR Software image signature verification and load unsigned software on an affected device. To exploit thi…

  9. 6.5CVE-2025-55053EPSS 0.2%

    CWE-328: Use of Weak Hash

  10. 6.3CVE-2025-59015EPSS 0.2%

    A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly.

  11. 7.4CVE-2025-41708EPSS 0.2%

    Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same network could exploit this to learn sensitive data during transmission.

  12. 1.3CVE-2025-10080EPSS 0.3%

    A vulnerability has been found in running-elephant Datart up to 1.0.0-rc3. Affected by this issue is the function getTokensecret of the file datart/security/src/main/java/datart/security/util/AESUtil.java of the component API. The manipula…

  13. 2.3CVE-2025-30200EPSS 0.1%

    ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived.

  14. 2.3CVE-2025-30198EPSS 0.2%

    ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived.

  15. 6.0CVE-2025-58359EPSS 0.3%

    ZF FROST is a Rust implementation of FROST (Flexible Round-Optimised Schnorr Threshold signatures). In versions 2.0.0 through 2.1.0, refresh shares with smaller min_signers will reduce security of group. The inability to change min_signers…

  16. 2.9CVE-2025-9828EPSS 0.4%

    A vulnerability was determined in Tenda CP6 11.10.00.243. The affected element is the function sub_2B7D04 of the component uhttp. Executing manipulation can lead to risky cryptographic algorithm. The attack may be launched remotely. This a…

  17. 8.6CVE-2025-52550EPSS 0.2%

    E3 Site Supervisor Control (firmware version < 2.31F01) firmware upgrade packages are unsigned. An attacker can forge malicious firmware upgrade packages. An attacker with admin access to the application services can install a malicious fi…

  18. 7.5CVE-2025-33102EPSS 0.2%

    IBM Concert Software 1.0.0 through 1.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

  19. 5.9CVE-2025-33084EPSS 0.2%

    IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensiti…

  20. 7.5CVE-2025-7731EPSS 0.3%

    Cleartext Transmission of Sensitive Information vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attacker to obtain credential information by intercepting SLMP communication mes…

  21. 8.4CVE-2025-56577EPSS 0.1%

    An issue in Evope Core v.1.1.3.20 allows a local attacker to obtain sensitive information via the use of hard coded cryptographic keys.

  22. 2.3CVE-2025-9071EPSS 0.2%

    Erroneously using an all-zero seed for RSA-OEAP padding instead of the generated random bytes, in Oberon microsystems AG’s Oberon PSA Crypto library in all versions up to 1.5.1, results in deterministic RSA and thus in a loss of confidenti…

  23. 5.9CVE-2025-7383EPSS 0.09%

    Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 1.5.1 allows an attacker to recover plaintexts via timing measurements of AES-CBC PKCS#7 decrypt operations.

  24. 5.9CVE-2025-7071EPSS 0.09%

    Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.1.0 and prior to 3.9.2 allows an attacker to recover plaintexts via timing measurements of AES-CBC PKCS#7 decrypt operations.

  25. 6.3CVE-2025-9604EPSS 0.3%

    A vulnerability was identified in coze-studio up to 0.2.4. The impacted element is an unknown function of the file backend/domain/plugin/encrypt/aes.go. The manipulation of the argument AuthSecretKey/StateSecretKey/OAuthTokenSecretKey lead…

  26. 6.5CVE-2025-31972EPSS 0.09%

    HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker unauthorized access to sensitive data transmitted between internal components.

  27. 8.7CVE-2025-46409EPSS 0.2%

    Inadequate encryption strength issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier). If this vulnerability is exploited, a function that requires authentication may be accessed by a remote unauthenticated attac…

  28. 8.8CVE-2025-30064EPSS 0.08%

    An insufficiently secured internal function allows session generation for arbitrary users. The decodeParam function checks the JWT but does not verify which signing algorithm was used. As a result, an attacker can use the "ex:action" param…

  29. 6.3CVE-2025-9513EPSS 0.2%

    A flaw has been found in editso fuso up to 1.0.4-beta.7. This affects the function PenetrateRsaAndAesHandshake of the file src/net/penetrate/handshake/mod.rs. This manipulation of the argument priv_key causes inadequate encryption strength…

  30. 9.8CVE-2025-41702EPSS 0.5%

    The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptogr…

  31. 1.1CVE-2025-9383EPSS 0.1%

    A security vulnerability has been detected in FNKvision Y215 CCTV Camera 10.194.120.40. This issue affects the function crypt of the file /etc/passwd. The manipulation leads to use of weak hash. The attack can only be performed from a loca…

  32. 8.6CVE-2025-57801EPSS 0.2%

    gnark is a zero-knowledge proof system framework. In versions prior to 0.14.0, the Verify function in eddsa.go and ecdsa.go used the S value from a signature without asserting that 0 ≤ S < order, leading to a signature malleability vulnera…

  33. 8.8CVE-2025-57800EPSS 0.5%

    Audiobookshelf is an open-source self-hosted audiobook server. In versions 2.6.0 through 2.26.3, the application does not properly restrict redirect callback URLs during OIDC authentication. An attacker can craft a login link that causes A…

  34. 9.8CVE-2025-55619EPSS 0.4%

    Reolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector. An attacker can leverage this vulnerability to decrypt access tokens and web session tokens stored inside the app via reverse engine…

  35. 5.3CVE-2025-55229EPSS 0.5%

    Improper verification of cryptographic signature in Windows Certificates allows an unauthorized attacker to perform spoofing over a network.

  36. 8.8CVE-2025-52351EPSS 0.2%

    Aikaan IoT management platform v3.25.0325-5-g2e9c59796 sends a newly generated password to users in plaintext via email and also includes the same password as a query parameter in the account activation URL (e.g., https://domain.com/activa…

  37. 6.3CVE-2025-9239EPSS 0.2%

    A vulnerability was identified in elunez eladmin up to 2.7. Affected by this vulnerability is the function EncryptUtils of the file eladmin-common/src/main/java/me/zhengjie/utils/EncryptUtils.java of the component DES Key Handler. The mani…

  38. 8.5CVE-2025-6180EPSS 0.1%

    The StrongDM Client insufficiently protected a pre-authentication token. Attackers could exploit this to intercept and reuse the token, potentially redeeming valid authentication credentials through a race condition.

  39. 7.5CVE-2025-57727EPSS 0.2%

    In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference

  40. 7.5CVE-2025-9146EPSS 0.6%

    A flaw has been found in Linksys E5600 1.1.0.26. The affected element is the function verify_gemtek_header of the file checkFw.sh of the component Firmware Handler. Executing manipulation can lead to risky cryptographic algorithm. The atta…

  41. 9.1CVE-2025-54156EPSS 0.2%

    The Sante PACS Server Web Portal sends credential information without encryption.

  42. 7.0CVE-2025-4371EPSS 0.2%

    A potential vulnerability was reported in the Lenovo 510 FHD and Performance FHD web cameras that could allow an attacker with physical access to write arbitrary firmware updates to the device over a USB connection.

  43. 8.7CVE-2025-40758EPSS 0.3%

    A vulnerability has been identified in Mendix SAML (Mendix 10.12 compatible) (All versions < V4.0.3), Mendix SAML (Mendix 10.21 compatible) (All versions < V4.1.2), Mendix SAML (Mendix 9.24 compatible) (All versions < V3.6.21). Affected ve…

  44. 4.1CVE-2023-5342EPSS 0.09%

    The Fedora Secure Boot CA certificate shipped with shim in Fedora was expired which could lead to old or invalid signed boot components being loaded.

  45. 2.0CVE-2025-20613EPSS 0.2%

    Predictable Seed in Pseudo-Random Number Generator (PRNG) in the firmware for some Intel(R) TDX may allow an authenticated user to potentially enable information disclosure via local access.

  46. 6.1CVE-2024-41986EPSS 0.1%

    A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SOA Cockpit (All versions >= V13.2 < V2506). The affected application support inse…

  47. 8.6CVE-2025-40920EPSS 0.5%

    Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library. * Data::UUID does not use a strong cryptographic source for generating UUIDs. * Data::UUID returns v3 U…

  48. 7.0CVE-2025-8863EPSS 0.3%

    YugabyteDB diagnostic information was transmitted over HTTP, which could expose sensitive data during transmission

  49. 2.9CVE-2025-8759EPSS 0.5%

    A vulnerability was found in TRENDnet TN-200 1.02b02. It has been declared as problematic. This vulnerability affects unknown code of the component Lighttpd. The manipulation of the argument secdownload.secret with the input neV3rUseMe lea…

  50. 2.9CVE-2025-8741EPSS 0.4%

    A vulnerability was found in macrozheng mall up to 1.0.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/login. The manipulation leads to cleartext transmission of sensiti…