cve.bz

OWASP A04:2025 Cryptographic Failures vulnerabilities, newest first, page 51

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A04:2025 at MITRE.

Its weaknesses: 32

CWE-261, CWE-296, CWE-319, CWE-320, CWE-321, CWE-322, CWE-323, CWE-324, CWE-325, CWE-326, CWE-327, CWE-328, CWE-329, CWE-330, CWE-331, CWE-332, CWE-334, CWE-335, CWE-336, CWE-337, CWE-338, CWE-340, CWE-342, CWE-347, CWE-523, CWE-757, CWE-759, CWE-760, CWE-780, CWE-916, CWE-1240, CWE-1241

  1. 6.7CVE-2023-20568EPSS 0.2%

    Improper signature verification of RadeonTM RX Vega M Graphics driver for Windows may allow an attacker with admin privileges to launch RadeonInstaller.exe without validating the file signature potentially leading to arbitrary code executi…

  2. 6.7CVE-2023-20567EPSS 0.2%

    Improper signature verification of RadeonTM RX Vega M Graphics driver for Windows may allow an attacker with admin privileges to launch AMDSoftwareInstaller.exe without validating the file signature potentially leading to arbitrary code ex…

  3. 6.9CVE-2023-44319EPSS 0.4%

    A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.0), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8…

  4. 6.9CVE-2023-44318EPSS 0.7%

    Affected devices use a hardcoded key to obfuscate the configuration backup that an administrator can export from the device. This could allow an authenticated attacker with administrative privileges or an attacker that obtains a configurat…

  5. 7.5CVE-2023-43503EPSS 0.3%

    A vulnerability has been identified in COMOS (All versions < V10.4.4). Caching system in the affected application leaks sensitive information such as user and project information in cleartext via UDP.

  6. 8.8CVE-2023-5747EPSS 0.6%

    Bashis, a Security Researcher at IPVM has found a flaw that allows for a remote code execution during the installation of Wave on the camera device. The Wave server application in camera device was vulnerable to command injection allowing …

  7. 5.3CVE-2023-47122EPSS 0.4%

    Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor ser…

  8. 7.5CVE-2023-46894EPSS 0.5%

    An issue discovered in esptool 4.6.2 allows attackers to view sensitive information via weak cryptographic algorithm.

  9. 6.5CVE-2023-47373EPSS 0.4%

    The leakage of channel access token in DRAGON FAMILY Line 13.6.1 allows remote attackers to send malicious notifications to victims.

  10. 6.5CVE-2023-47372EPSS 0.4%

    The leakage of channel access token in UPDATESALON C-LOUNGE Line 13.6.1 allows remote attackers to send malicious notifications to victims.

  11. 6.5CVE-2023-47370EPSS 0.4%

    The leakage of channel access token in bluetrick Line 13.6.1 allows remote attackers to send malicious notifications to victims.

  12. 6.5CVE-2023-47368EPSS 0.4%

    The leakage of channel access token in taketorinoyu Line 13.6.1 allows remote attackers to send malicious notifications to victims.

  13. 9.8CVE-2023-41137EPSS 0.3%

    Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client and used to impersonate the AppsAnywhere server.

  14. 6.5CVE-2023-47369EPSS 0.4%

    The leakage of channel access token in best_training_member Line 13.6.1 allows remote attackers to send malicious notifications.

  15. 6.5CVE-2023-47367EPSS 0.4%

    The leakage of channel access token in platinum clinic Line 13.6.1 allows remote attackers to send malicious notifications to victims.

  16. 6.5CVE-2023-47366EPSS 0.4%

    The leakage of channel access token in craft_members Line 13.6.1 allows remote attackers to send malicious notifications to victims.

  17. 6.5CVE-2023-47365EPSS 0.4%

    The leakage of channel access token in Lil.OFF-PRICE STORE Line 13.6.1 allows remote attackers to send malicious notifications to victims.

  18. 6.5CVE-2023-47364EPSS 0.4%

    The leakage of channel access token in nagaoka taxi Line 13.6.1 allows remote attackers to send malicious notifications to victims

  19. 6.5CVE-2023-47363EPSS 0.4%

    The leakage of channel access token in F.B.P members Line 13.6.1 allows remote attackers to send malicious notifications to victims.

  20. 7.5CVE-2022-48193EPSS 0.3%

    Weak ciphers in Softing smartLink SW-HT before 1.30 are enabled during secure communication (SSL).

  21. 7.5CVE-2023-46382EPSS 3.1%

    LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) use cleartext HTTP for login.

  22. 7.5CVE-2023-46380EPSS 3.1%

    LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) send password-change requests via cleartext HTTP.

  23. 7.5CVE-2017-7252EPSS 0.4%

    bcrypt password hashing in Botan before 2.1.0 does not correctly handle passwords with a length between 57 and 72 characters, which makes it easier for attackers to determine the cleartext password.

  24. 9.8CVE-2023-5846EPSS 0.3%

    Franklin Fueling System TS-550 versions prior to 1.9.23.8960 are vulnerable to attackers decoding admin credentials, resulting in unauthenticated access to the device.

  25. 5.3CVE-2023-5035EPSS 0.2%

    A vulnerability has been identified in PT-G503 Series firmware versions prior to v5.2, where the Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the cookie to be transmitted in plaintext over an HTTP …

  26. 7.5CVE-2023-5627EPSS 0.4%

    A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable. This vulnerability arises from the incorrect implementation of sensitive information protection, potentially allowing malicious users…

  27. 7.5CVE-2023-46129EPSS 0.4%

    NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not ju…

  28. 7.5CVE-2023-34058EPSS 0.8%

    VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC…

  29. 7.5CVE-2023-46234EPSS 0.6%

    browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to co…

  30. 9.1CVE-2023-46233EPSS 0.6%

    crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it…

  31. 9.1CVE-2023-46133EPSS 0.5%

    CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript. Prior to version 2.1.0, CryptoES PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry st…

  32. 8.8CVE-2023-45321EPSS 0.1%

    The Android Client application, when enrolled with the define method 1 (the user manually inserts the server ip address), use HTTP protocol to retrieve sensitive information (ip address and credentials to connect to a remote MQTT broker e…

  33. 9.8CVE-2023-42492EPSS 0.5%

    EisBaer Scada - CWE-321: Use of Hard-coded Cryptographic Key

  34. 7.5CVE-2023-31582EPSS 0.8%

    jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less.

  35. 7.5CVE-2023-33837EPSS 0.3%

    IBM Security Verify Governance 10.0 does not encrypt sensitive or critical information before storage or transmission. IBM X-Force ID: 256020.

  36. 5.3CVE-2023-28804EPSS 0.3%

    An Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows replacing binaries.This issue affects Linux Client Connector: before 1.4.0.105

  37. 7.8CVE-2023-28796EPSS 0.2%

    Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.

  38. 7.5CVE-2023-46324EPSS 0.5%

    pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompressed public key that has not been validated. An attacker can send arbitrary SUC…

  39. 7.5CVE-2023-38276EPSS 0.4%

    IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 exposes sensitive information in environment variables which could aid in further attacks against the system. IBM X-Force ID: 260736.

  40. 7.5CVE-2023-38275EPSS 0.4%

    IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 exposes sensitive information in container images which could lead to further attacks against the system. IBM X-Force ID: 260730.

  41. 7.5CVE-2023-44690EPSS 0.3%

    Inadequate encryption strength in mycli 1.27.0 allows attackers to view sensitive information via /mycli/config.py

  42. 7.8CVE-2023-30132EPSS 0.2%

    An issue discovered in IXP Data EasyInstall 6.6.14907.0 allows attackers to gain escalated privileges via static Cryptographic Key.

  43. 8.1CVE-2023-27791EPSS 0.9%

    An issue found in IXP Data Easy Install 6.6.148840 allows a remote attacker to escalate privileges via insecure PRNG.

  44. 6.5CVE-2023-41088EPSS 0.3%

    The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker with access to the network, where clients have access to the DexGate server, could capture traffic. The atta…

  45. 8.8CVE-2022-26943EPSS 0.4%

    The Motorola MTM5000 series firmwares generate TETRA authentication challenges using a PRNG using a tick count register as its sole entropy source. Low boottime entropy and limited re-seeding of the pool renders the authentication challeng…

  46. 8.8CVE-2022-25333EPSS 0.1%

    The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) performs an RSA check implemented in mask ROM when loading a module through the SK_LOAD routine. However, only the module header authenticity is validate…

  47. 7.5CVE-2022-24402EPSS 0.6%

    The TETRA TEA1 keystream generator implements a key register initialization function that compresses the 80-bit key to only 32 bits for usage during the keystream generation phase, which is insufficient to safeguard against exhaustive sear…

  48. 8.1CVE-2022-24401EPSS 0.3%

    Adversary-induced keystream re-use on TETRA air-interface encrypted traffic using any TEA keystream generator. IV generation is based upon several TDMA frame counters, which are frequently broadcast by the infrastructure in an unauthentica…

  49. 8.2CVE-2023-34441EPSS 0.3%

    Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a cleartext transmission vulnerability which could allow an attacker to steal the authentication secret from communication traffic to the device and reuse it f…

  50. 6.6CVE-2023-43776EPSS 0.1%

    Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the device password was stored with a weak encoding algorithm in the easyE4 program …