OWASP A04:2025 Cryptographic Failures vulnerabilities, newest first, page 58

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A04:2025 at MITRE.

1. 7.8CVE-2022-45099EPSS 0.2%2023-02-01

   Dell PowerScale OneFS, versions 8.2.x-9.4.x, contain a weak encoding for a NDMP password. A malicious and privileged local attacker could potentially exploit this vulnerability, leading to a full system compromise

2. 7.8CVE-2022-34459EPSS 0.1%2023-02-01

   Dell Command | Update, Dell Update, and Alienware Update versions prior to 4.7 contain a improper verification of cryptographic signature in get applicable driver component. A local malicious user could potentially exploit this vulnerabili…

3. 9.8CVE-2023-23928EPSS 0.5%2023-02-01

   reason-jose is a JOSE implementation in ReasonML and OCaml.`Jose.Jws.validate` does not check HS256 signatures. This allows tampering of JWS header and payload data if the service does not perform additional checks. Such tampering could ex…

4. 5.3CVE-2022-40258EPSS 0.4%2023-01-31

   AMI Megarac Weak password hashes for Redfish & API

5. 9.8CVE-2022-23334EPSS 0.4%2023-01-30

   The Robot application in Ip-label Newtest before v8.5R0 was discovered to use weak signature checks on executed binaries, allowing attackers to have write access and escalate privileges via replacing NEWTESTREMOTEMANAGER.EXE.

6. 5.5CVE-2023-24440EPSS 0.2%2023-01-26

   Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.

7. 5.3CVE-2023-0452EPSS 0.5%2023-01-26

   Econolite EOS versions prior to 3.2.23 use a weak hash algorithm for encrypting privileged user credentials. A configuration file that is accessible without authentication uses MD5 hashes for encrypting credentials, including those of admi…

8. 7.5CVE-2023-0356EPSS 0.5%2023-01-26

   SOCOMEC MODULYS GP Netvision versions 7.20 and prior lack strong encryption for credentials on HTTP connections, which could result in threat actors obtaining sensitive information.

9. 7.5CVE-2022-43917EPSS 0.5%2023-01-26

   IBM WebSphere Application Server 8.5 and 9.0 traditional container uses weaker than expected cryptographic keys that could allow an attacker to decrypt sensitive information. This affects only the containerized version of WebSphere Applica…

10. 7.5CVE-2022-22462EPSS 0.5%2023-01-26

    IBM Security Verify Governance, Identity Manager virtual appliance component 10.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 225078.

11. 5.9CVE-2023-22742EPSS 0.6%2023-01-20

    libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set …

12. 7.5CVE-2023-24025EPSS 0.6%2023-01-20

    CRYSTALS-DILITHIUM (in Post-Quantum Cryptography Selected Algorithms 2022) in PQClean d03da30 may allow universal forgeries of digital signatures via a template side-channel attack because of intermediate data leakage of one vector.

13. 7.5CVE-2020-22659EPSS 0.3%2023-01-20

    In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before 3.6.2.0.795, SmartZone 100 (SZ-100) befo…

14. 9.8CVE-2020-22653EPSS 0.6%2023-01-20

    In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before 3.6.2.0.795, SmartZone 100 (SZ-100) befo…

15. 5.3CVE-2023-22912EPSS 0.4%2023-01-20

    An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. CheckUser TokenManager insecurely uses AES-CTR encryption with a repeated (aka re-used) nonce, allowing an adversary to decr…

16. 7.5CVE-2022-47732EPSS 0.5%2023-01-20

    In Yeastar N412 and N824 Configuration Panel 42.x and 45.x, an unauthenticated attacker can create backup file and download it, revealing admin hash, allowing, once cracked, to login inside the Configuration Panel, otherwise, replacing the…

17. 9.1CVE-2022-40267EPSS 1.2%2023-01-20

    Predictable Seed in Pseudo-Random Number Generator (PRNG) vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 17X**** or later, and versions 1.280 and prior…

18. 8.8CVE-2023-20038EPSS 0.2%2023-01-20

    A vulnerability in the monitoring application of Cisco Industrial Network Director could allow an authenticated, local attacker to access a static secret key used to store both local data and credentials for accessing remote systems. Th…

19. 5.9CVE-2023-22863EPSS 0.4%2023-01-18

    IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could allow an attacker to obtain sensitive information using man in the middle techn…

20. 7.8CVE-2022-34462EPSS 0.2%2023-01-18

    Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a Hard-coded Password Vulnerability. An attacker, with the knowledge of the hard-coded credentials, could potentially exploit this vulnerability to login to the system to …

21. 9.8CVE-2022-34442EPSS 0.4%2023-01-18

    Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability.  An attacker with the knowledge of the hard-coded sensitive information, could potentially exploit this vulnerabili…

22. 7.5CVE-2022-38469EPSS 0.6%2023-01-18

    An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords.

23. 5.3CVE-2023-0296EPSS 0.3%2023-01-17

    The Birthday attack against 64-bit block ciphers flaw (CVE-2016-2183) was reported for the health checks port (9979) on etcd grpc-proxy component. Even though the CVE-2016-2183 has been fixed in the etcd components, to enable periodic heal…

24. 4.7CVE-2021-36647EPSS 0.2%2023-01-17

    Use of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp_mod() in lignum.c in Mbed TLS Mbed TLS all versions before 3.0.0, 2.27.0 or 2.16.11 allows attackers with access to precise enough timing and memory access in…

25. 8.6CVE-2023-22601EPSS 0.6%2023-01-12

    InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-330: Use of Insufficiently Random Values. They do not properly randomize MQTT ClientID p…

26. 9.1CVE-2023-22599EPSS 0.3%2023-01-12

    InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-760: Use of a One-way Hash with a Predictable Salt. They  send MQTT credentials in resp…

27. 5.9CVE-2023-22597EPSS 0.5%2023-01-12

    InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-319: Cleartext Transmission of Sensitive Information. They use an unsecured channel to c…

28. 7.7CVE-2017-5242EPSS 0.4%2023-01-12

    Nexpose and InsightVM virtual appliances downloaded between April 5th, 2017 and May 3rd, 2017 contain identical SSH host keys. Normally, a unique SSH host key should be generated the first time a virtual appliance boots.

29. 5.9CVE-2022-46176EPSS 0.7%2023-01-11

    Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle (MI…

30. 9.8CVE-2022-34441EPSS 0.5%2023-01-11

    Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker with the knowledge of the hard-coded sensitive information, could potentially exploit this vulnerabilit…

31. 9.8CVE-2022-34440EPSS 0.5%2023-01-11

    Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker with the knowledge of the hard-coded sensitive information, could potentially exploit this vulnerabilit…

32. 5.5CVE-2021-26407EPSS 0.2%2023-01-11

    A randomly generated Initialization Vector (IV) may lead to a collision of IVs with the same key potentially resulting in information disclosure.

33. 4.6CVE-2022-0553EPSS 0.3%2023-01-11

    There is no check to see if slot 0 is being uploaded from the device to the host. When using encrypted images this means the unencrypted firmware can be retrieved easily.

34. 8.1CVE-2022-35401EPSS 21%2023-01-10

    An authentication bypass vulnerability exists in the get_IFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.386_49674-ge182230. A specially-crafted HTTP request can lead to full administrative access to the device. An attacker would ne…

35. 7.8CVE-2022-36925EPSS 0.1%2023-01-09

    Zoom Rooms for macOS clients before version 5.11.4 contain an insecure key generation mechanism. The encryption key used for IPC between the Zoom Rooms daemon service and the Zoom Rooms client was generated using parameters that could be o…

36. 6.0CVE-2022-23509EPSS 0.2%2023-01-09

    Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. GitOps run has a local S3 bucket which it uses for synchronizing files that are later applied agai…

37. 9.8CVE-2022-3929EPSS 0.4%2023-01-05

    Communication between the client and the server application of the affected products is partially done using CORBA (Common Object Request Broker Architecture) over TCP/IP. This protocol is not encrypted and allows tracing of internal messa…

38. 5.5CVE-2021-40341EPSS 0.09%2023-01-05

    DES cipher, which has inadequate encryption strength, is used Hitachi Energy FOXMAN-UN to encrypt user credentials used to access the Network Elements. Successful exploitation allows sensitive information to be decrypted easily. This issue…

39. 5.3CVE-2023-0055EPSS 0.5%2023-01-04

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32.

40. 5.3CVE-2016-15006EPSS 0.8%2023-01-02

    A vulnerability, which was classified as problematic, has been found in enigmaX up to 2.2. This issue affects the function getSeed of the file main.c of the component Scrambling Table Handler. The manipulation leads to predictable seed in …

41. 5.3CVE-2020-36563EPSS 0.3%2022-12-28

    XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input.

42. 4.3CVE-2022-2582EPSS 0.5%2022-12-27

    The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field,…

43. 9.1CVE-2021-4238EPSS 1.4%2022-12-27

    Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least one digit from 0 to 9. This significantly red…

44. 7.5CVE-2019-25089EPSS 0.7%2022-12-27

    A vulnerability has been found in Morgawr Muon 0.1.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file src/muon/handler.clj. The manipulation leads to insufficiently random values. The at…

45. 7.8CVE-2020-12069EPSS 0.2%2022-12-26

    In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low pr…

46. 9.8CVE-2022-24116EPSS 0.3%2022-12-26

    Certain General Electric Renewable Energy products have inadequate encryption strength. This affects iNET and iNET II before 8.3.0.

47. 5.3CVE-2021-4277EPSS 0.5%2022-12-25

    A vulnerability, which was classified as problematic, has been found in fredsmith utils. This issue affects some unknown processing of the file screenshot_sync of the component Filename Handler. The manipulation leads to predictable from o…

48. 7.5CVE-2022-43551EPSS 17%2022-12-23

    A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provid…

49. 9.1CVE-2022-47931EPSS 0.5%2022-12-23

    IO FinNet tss-lib before 2.0.0 allows a collision of hash values.

50. 8.1CVE-2022-23539EPSS 0.5%2022-12-23

    Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an …