cve.bz

OWASP A04:2025 Cryptographic Failures vulnerabilities, newest first, page 47

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A04:2025 at MITRE.

Its weaknesses: 32

CWE-261, CWE-296, CWE-319, CWE-320, CWE-321, CWE-322, CWE-323, CWE-324, CWE-325, CWE-326, CWE-327, CWE-328, CWE-329, CWE-330, CWE-331, CWE-332, CWE-334, CWE-335, CWE-336, CWE-337, CWE-338, CWE-340, CWE-342, CWE-347, CWE-523, CWE-757, CWE-759, CWE-760, CWE-780, CWE-916, CWE-1240, CWE-1241

  1. 9.8CVE-2023-32169EPSS 56%

    D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of D-Link D-View. Authentication is not required to exploi…

  2. 10.0CVE-2024-32962EPSS 0.8%

    xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default configuration does not check authorization of the signer, it only checks the validity of the signature per section 3.2.2 of the w3 …

  3. 9.8CVE-2024-23480EPSS 0.3%

    A fallback mechanism in code sign checking on macOS may allow arbitrary code execution. This issue affects Zscaler Client Connector on MacOS prior to 4.2.

  4. 9.1CVE-2024-3411EPSS 0.7%

    Implementations of IPMI Authenticated sessions does not provide enough randomness to protect from session hijacking, allowing an attacker to use either predictable IPMI Session ID or weak BMC Random Number to bypass security controls using…

  5. 5.3CVE-2023-50059EPSS 0.5%

    An issue ingalxe.com Galxe platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Galxe, the signed message lacks a nonce (random number)

  6. 5.7CVE-2019-19754EPSS 0.2%

    HiveOS through 0.6-102@191212 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: as of 2019-09-26, the vendor i…

  7. 9.1CVE-2019-19753EPSS 0.4%

    SimpleMiningOS through v1259 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: the vendor indicated that they …

  8. 9.8CVE-2019-19752EPSS 0.5%

    nvOC through 3.2 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: as of 2019-12-01, the vendor indicated plan…

  9. 8.1CVE-2024-4185EPSS 0.9%

    The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Email Verification and Authentication Bypass in all versions up to, and including, 2.7.4 via the use of insufficiently random activation code. This makes…

  10. 8.1CVE-2024-1579EPSS 0.5%

    Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Secomea GateManager (Webserver modules) allows Session Hijacking.This issue affects GateManager: before 11.2.624071020.

  11. 8.8CVE-2024-33891EPSS 1.0%

    Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx. This is related to a hardcoded key, the use of the integer 2 for the Admin user, and removal…

  12. 6.5CVE-2024-33663EPSS 0.3%

    python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.

  13. 8.1CVE-2024-1657EPSS 0.4%

    A flaw was found in the ansible automation platform. An insecure WebSocket connection was being used in installation from the Ansible rulebook EDA server. An attacker that has access to any machine in the CIDR block could download all rule…

  14. 6.5CVE-2024-1102EPSS 0.8%

    A vulnerability was found in jberet-core logging. An exception in 'dbProperties' might display user credentials such as the username and password for the database-connection.

  15. 7.5CVE-2024-4161EPSS 0.5%

    In Brocade SANnav, before Brocade SANnav v2.3.0, syslog traffic received clear text. This could allow an unauthenticated, remote attacker to capture sensitive information.

  16. 4.4CVE-2023-37397EPSS 0.08%

    IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain or modify sensitive information due to improper encryption of certain data. IBM X-Force ID: 259672.

  17. 5.5CVE-2022-40745EPSS 0.1%

    IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain sensitive information due to weaker than expected security. IBM X-Force ID: 236452.

  18. 5.5CVE-2023-37396EPSS 0.08%

    IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain sensitive information due to improper encryption of certain data. IBM X-Force ID: 259671.

  19. 7.5CVE-2024-29969EPSS 0.3%

    When a Brocade SANnav installation is upgraded from Brocade SANnav v2.2.2 to Brocade SANnav 2.3.0, TLS/SSL weak message authentication code ciphers are added by default for port 18082.

  20. 4.3CVE-2023-4509EPSS 0.2%

    It is possible for an API key to be logged in clear text in the audit log file after an invalid login attempt.

  21. 5.7CVE-2024-29951EPSS 0.2%

    Brocade SANnav before v2.3.1 and v2.3.0a uses the SHA-1 hash in internal SSH ports that are not open to remote connection.

  22. 5.9CVE-2024-29950EPSS 0.3%

    The class FileTransfer implemented in Brocade SANnav before v2.3.1, v2.3.0a, uses the ssh-rsa signature scheme, which has a SHA-1 hash. The vulnerability could allow a remote, unauthenticated attacker to perform a man-in-the-middle attack.

  23. 5.9CVE-2024-31497EPSS 5.7%

    In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60 signatures. This is especially important in a scenario where an adver…

  24. 5.3CVE-2024-28957EPSS 0.8%

    Generation of predictable identifiers issue exists in Cente middleware TCP/IP Network Series. If this vulnerability is exploited, a remote unauthenticated attacker may interfere communications by predicting some packet header IDs of the de…

  25. 9.2CVE-2024-30407EPSS 0.7%

    The Use of a Hard-coded Cryptographic Key vulnerability in Juniper Networks Juniper Cloud Native Router (JCNR) and containerized routing Protocol Deamon (cRPD) products allows an attacker to perform Person-in-the-Middle (PitM) attacks whic…

  26. 4.9CVE-2024-31464EPSS 0.4%

    XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10.19, 15.5.4, and 15.9-rc-1, it is possible to access the hash of a password by using the diff feature of the history whenever the object sto…

  27. 5.9CVE-2024-3387EPSS 0.2%

    A weak (low bit strength) device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle (MitM) attack to capture encrypted traffic between the Panorama management server and the firewalls…

  28. 5.9CVE-2023-6799EPSS 0.7%

    The WP Reset – Most Advanced WordPress Reset Tool plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0 via the use of insufficiently random snapshot names. This makes it possible fo…

  29. 6.7CVE-2024-27247EPSS 0.1%

    Improper privilege management in the installer for Zoom Desktop Client for macOS before version 5.17.10 may allow a privileged user to conduct an escalation of privilege via local access.

  30. 7.8CVE-2024-24694EPSS 0.2%

    Improper privilege management in the installer for Zoom Desktop Client for Windows before version 5.17.10 may allow an authenticated user to conduct an escalation of privilege via local access.

  31. 4.3CVE-2024-29056EPSS 1.0%

    Windows Authentication Elevation of Privilege Vulnerability

  32. 7.8CVE-2024-26228EPSS 0.4%

    Windows Cryptographic Services Security Feature Bypass Vulnerability

  33. 7.4CVE-2024-26194EPSS 0.4%

    Secure Boot Security Feature Bypass Vulnerability

  34. 8.8CVE-2024-27632EPSS 1.3%

    An issue in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via the form_id in the form_header() function.

  35. 8.8CVE-2024-24279EPSS 0.1%

    An issue in secdiskapp 1.5.1 (management program for NewQ Fingerprint Encryption Super Speed Flash Disk) allows attackers to gain escalated privileges via vsVerifyPassword and vsSetFingerPrintPower functions.

  36. 8.1CVE-2024-28270EPSS 0.4%

    An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resetPassword.

  37. 9.1CVE-2023-52538EPSS 0.3%

    Vulnerability of package name verification being bypassed in the HwIms module. Impact: Successful exploitation of this vulnerability will affect availability.

  38. 6.2CVE-2024-26329EPSS 0.3%

    Chilkat before v9.5.0.98, allows attackers to obtain sensitive information via predictable PRNG in ChilkatRand::randomBytes function.

  39. 8.2CVE-2024-31206EPSS 0.3%

    dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `dectalk-tts@1.0.0`, network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified …

  40. 8.1CVE-2023-52043EPSS 0.3%

    An issue in D-Link COVR 1100, 1102, 1103 AC1200 Dual-Band Whole-Home Mesh Wi-Fi System (Hardware Rev B1) truncates Wireless Access Point Passwords (WPA-PSK) allowing an attacker to gain unauthorized network access via weak authentication c…

  41. 6.5CVE-2024-28275EPSS 0.3%

    Puwell Cloud Tech Co, Ltd 360Eyes Pro v3.9.5.16(3090516) was discovered to transmit sensitive information in cleartext. This vulnerability allows attackers to intercept and access sensitive information, including users' credentials and pas…

  42. 6.5CVE-2024-28755EPSS 0.4%

    An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum TLS version to be negotiated was not restored to the configured one. An attacker was able to preven…

  43. 6.5CVE-2023-50313EPSS 0.2%

    IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configuration. IBM X-Force ID: 274812.

  44. 6.6CVE-2023-6951EPSS 0.3%

    A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remote attacker to derive the WPA2 PSK key and authenticate without permission to the drone’s Wi- Fi network. This, in turn,…

  45. 7.5CVE-2024-25963EPSS 0.3%

    Dell PowerScale OneFS, versions 8.2.2.x through 9.5.0.x contains a use of a broken cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure.

  46. 7.8CVE-2024-25960EPSS 0.1%

    Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains a cleartext transmission of sensitive information vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to escalation of privile…

  47. 5.3CVE-2024-28013EPSS 0.4%

    Use of Insufficiently Random Values vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200HS, WG1200HP, WF300HP2, W300P, WF800HP, WR8165N, WG2200HP…

  48. 5.3CVE-2024-29886EPSS 0.3%

    Serverpod is an app and web server, built for the Flutter and Dart ecosystem. An issue was identified with the old password hash algorithm that made it susceptible to rainbow attacks if the database was compromised. This vulnerability is f…

  49. 6.8CVE-2024-28860EPSS 0.2%

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Users of IPsec transparent encryption in Cilium may be vulnerable to cryptographic attacks that render the transparent encryption ineffective. In pa…

  50. 9.1CVE-2024-25735ExploitEPSS 51%

    An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can discover cleartext passwords via a SoftAP /device/config GET request.