OWASP A04:2025 Cryptographic Failures vulnerabilities, newest first, page 54
Filter
The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A04:2025 at MITRE.
Its weaknesses: 32
CWE-261, CWE-296, CWE-319, CWE-320, CWE-321, CWE-322, CWE-323, CWE-324, CWE-325, CWE-326, CWE-327, CWE-328, CWE-329, CWE-330, CWE-331, CWE-332, CWE-334, CWE-335, CWE-336, CWE-337, CWE-338, CWE-340, CWE-342, CWE-347, CWE-523, CWE-757, CWE-759, CWE-760, CWE-780, CWE-916, CWE-1240, CWE-1241
- 9.8CVE-2023-37291EPSS 0.5%
Galaxy Software Services Vitals ESP is vulnerable to using a hard-coded encryption key. An unauthenticated remote attacker can generate a valid token parameter and exploit this vulnerability to access system to operate processes and access…
- 3.7CVE-2023-3803EPSS 0.7%
A vulnerability classified as problematic has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This affects an unknown part of the file /Service/ImageStationDataService.asmx of the component File Name Handler. …
- 5.9CVE-2023-3347EPSS 0.4%
A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is manda…
- 7.5CVE-2023-3763EPSS 0.6%
A vulnerability was found in Intergard SGS 8.7.0. It has been declared as problematic. This vulnerability affects unknown code of the component SQL Query Handler. The manipulation leads to cleartext transmission of sensitive information. T…
- 7.5CVE-2023-3761EPSS 0.5%
A vulnerability was found in Intergard SGS 8.7.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Password Change Handler. The manipulation leads to cleartext transmission of sensitive in…
- 7.5CVE-2021-38933EPSS 0.4%
IBM Sterling Connect:Direct for UNIX 1.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 210574.
- 7.5CVE-2023-28021EPSS 0.3%
The BigFix WebUI uses weak cipher suites.
- 7.5CVE-2023-34142EPSS 0.3%
Cleartext Transmission of Sensitive Information vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Server, Device Manager Agent, Host Data Collector components) allows Interception.This issue affects Hitachi Device M…
- 7.5CVE-2023-37464EPSS 0.7%
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fix…
- 3.5CVE-2023-30565EPSS 0.1%
An insecure connection between Systems Manager and CQI Reporter application could expose infusion data to an attacker.
- 6.5CVE-2023-35833EPSS 0.3%
An issue was discovered in YSoft SAFEQ 6 Server before 6.0.82. When modifying the URL of the LDAP server configuration from LDAPS to LDAP, the system does not require the password to be (re)entered. This results in exposing cleartext crede…
- 6.5CVE-2023-33768EPSS 1.1%
Incorrect signature verification of the firmware during the Device Firmware Update process of Belkin Wemo Smart Plug WSP080 v1.2 allows attackers to cause a Denial of Service (DoS) via a crafted firmware file.
- 7.5CVE-2023-31823EPSS 0.6%
An issue found in Marui Co Marui Official app v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Marui Official Store function.
- 9.8CVE-2023-34130EPSS 0.3%
SonicWall GMS and Analytics use outdated Tiny Encryption Algorithm (TEA) with a hardcoded key to encrypt sensitive data. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- 7.5CVE-2023-34123EPSS 0.8%
Use of Hard-coded Cryptographic Key vulnerability in SonicWall GMS, SonicWall Analytics. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- 7.8CVE-2023-21399EPSS 0.07%
there is a possible way to bypass cryptographic assurances due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- 7.8CVE-2023-21145EPSS 0.09%
In updatePictureInPictureMode of ActivityRecord.java, there is a possible bypass of background launch restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges n…
- 5.5CVE-2023-20942EPSS 0.07%
In openMmapStream of AudioFlinger.cpp, there is a possible way to record audio without displaying the microphone privacy indicator due to a logic error in the code. This could lead to local escalation of privilege with no additional execut…
- 7.4CVE-2023-20185EPSS 0.3%
A vulnerability in the Cisco ACI Multi-Site CloudSec encryption feature of Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow an unauthenticated, remote attacker to read or modify intersite encrypted traffic. This vulnerabi…
- 5.3CVE-2023-35373EPSS 0.8%
Mono Authenticode Validation Spoofing Vulnerability
- 6.8CVE-2023-35332EPSS 0.5%
Windows Remote Desktop Protocol Security Feature Bypass
- 6.8CVE-2023-32043EPSS 0.5%
Windows Remote Desktop Security Feature Bypass Vulnerability
- 7.4CVE-2023-36749EPSS 0.3%
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM …
- 6.8CVE-2023-36748EPSS 0.2%
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM …
- 7.5CVE-2023-3272EPSS 0.6%
Cleartext Transmission of Sensitive Information in the SICK ICR890-4 could allow a remote attacker to gather sensitive information by intercepting network traffic that is not encrypted.
- 9.8CVE-2023-36993EPSS 1.0%
The cryptographically insecure random number generator being used in TravianZ 8.3.4 and 8.3.3 in the password reset function allows an attacker to guess the password reset.parameters and to take over accounts.
- 5.5CVE-2023-35890EPSS 0.1%
IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security, caused by the improper encoding in a local configuration file. IBM X-Force ID: 258637.
- 9.8CVE-2023-34433EPSS 0.4%
PiiGAB M-Bus stores passwords using a weak hash algorithm.
- 7.5CVE-2023-31277EPSS 0.6%
PiiGAB M-Bus transmits credentials in plaintext format.
- 9.8CVE-2023-22844EPSS 0.8%
An authentication bypass vulnerability exists in the requestHandlers.js verifyToken functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to authentication bypass. An attacker can send a network request to tri…
- 8.1CVE-2023-34471EPSS 0.3%
AMI SPx contains a vulnerability in the BMC where a user may cause a missing cryptographic step by generating a hash-based message authentication code (HMAC). A successful exploit of this vulnerability may lead to the loss confidentiality,…
- 9.8CVE-2023-34338EPSS 0.3%
AMI SPx contains a vulnerability in the BMC where an Attacker may cause a use of hard-coded cryptographic key by a hard-coded certificate. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and ava…
- 8.8CVE-2023-34337EPSS 0.2%
AMI SPx contains a vulnerability in the BMC where a user may cause an inadequate encryption strength by hash-based message authentication code (HMAC). A successful exploit of this vulnerability may lead to a loss of confidentiality, integr…
- 8.1CVE-2023-2974EPSS 0.9%
A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol.
- 5.9CVE-2023-36610EPSS 0.5%
The affected TBox RTUs generate software security tokens using insufficient entropy. The random seed used to generate the software tokens is not initialized correctly, and other parts of the token are generated using predictable time-base…
- 6.5CVE-2023-36608EPSS 0.2%
The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm.
- 5.3CVE-2023-37301EPSS 0.3%
An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3. Because it doesn't use EditEntity for undo and restore, the intended interaction with AbuseFilter does not occur.
- 7.5CVE-2023-36539EPSS 0.5%
Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information.
- 9.8CVE-2023-3243EPSS 0.6%Unsupported when assigned
[An attacker can capture an authenticating hash and utilize it to create new sessions. The hash is also a poorly salted MD5 hash, which could result in a successful brute force password attack. Impacted product is BCM-WEB version 3.3.X. Re…
- 7.5CVE-2023-21220EPSS 0.3%
there is a possible use of unencrypted transport over cellular networks due to an insecure default value. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for e…
- 7.5CVE-2023-21219EPSS 0.3%
there is a possible use of unencrypted transport over cellular networks due to an insecure default value. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for e…
- 7.5CVE-2023-26276EPSS 0.4%
IBM QRadar SIEM 7.5.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 248147.
- 7.5CVE-2023-3371EPSS 0.5%
The EmbedPress plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'lock_content_form_handler' and 'display_password_form' function in versions up to, and including, 3.7.3. This makes…
- 8.6CVE-2023-32414EPSS 0.2%
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.4. An app may be able to break out of its sandbox.
- 7.8CVE-2023-28006EPSS 0.1%
The OSD Bare Metal Server uses a cryptographic algorithm that is no longer considered sufficiently secure.
- 7.8CVE-2023-32449EPSS 0.1%
Dell PowerStore versions prior to 3.5 contain an improper verification of cryptographic signature vulnerability. An attacker can trick a high privileged user to install a malicious binary by bypassing the existing cryptographic signature c…
- 9.8CVE-2023-3325EPSS 0.5%
The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the use of an insufficiently unique cryptographic signature on the 'cmsc_add_site' function in versions up to, and including, 2.287. This makes it possible…
- 2.4CVE-2022-48506EPSS 0.4%
A flawed pseudorandom number generator in Dominion Voting Systems ImageCast Precinct (ICP and ICP2) and ImageCast Evolution (ICE) scanners allows anyone to determine the order in which ballots were cast from public ballot-level data, allow…
- 7.4CVE-2023-31410EPSS 0.3%
A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security (TLS) in the SICK EventCam App. This lack of encryption in the communication channel can lead to the …
- 7.5CVE-2023-23841EPSS 0.5%
SolarWinds Serv-U is submitting an HTTP request when changing or updating the attributes for File Share or File request. Part of the URL of the request discloses sensitive data.