OWASP A04:2025 Cryptographic Failures vulnerabilities, newest first, page 73

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A04:2025 at MITRE.

1. 7.5CVE-2019-18231EPSS 0.8%2021-03-17

   Advantech Spectre RT ERT351 Versions 5.1.3 and prior logins and passwords are transmitted in clear text form, which may allow an attacker to intercept the request.

2. 5.5CVE-2020-35456EPSS 0.5%2021-03-17

   The Taidii Diibear Android application 2.4.0 and all its derivatives allow attackers to view private chat messages and media files via logcat because of excessive logging.

3. 7.5CVE-2020-28873EPSS 0.9%2021-03-17

   Fluxbb 1.5.11 is affected by a denial of service (DoS) vulnerability by sending an extremely long password via the user login form. When a long password is sent, the password hashing process will result in CPU and memory exhaustion on the …

4. 7.5CVE-2020-4831EPSS 0.9%2021-03-12

   IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 189965.

5. 8.8CVE-2020-35221EPSS 0.5%2021-03-10

   The hashing algorithm implemented for NSDP password authentication on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was found to be insecure, allowing attackers (with access to a network capture) to quickly generate multiple collisions to ge…

6. 5.5CVE-2021-0375EPSS 0.1%2021-03-10

   In onPackageModified of VoiceInteractionManagerService.java, there is a possible change of default applications due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges need…

7. 4.9CVE-2021-3417EPSS 0.6%2021-03-09

   An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Administrator (LXCA), if added as a Resource Manager, are encoded then written to an internal LXCO log file each time a ses…

8. 4.9CVE-2020-8356EPSS 0.6%2021-03-09

   An internal product security audit of LXCO, prior to version 1.2.2, discovered that optional passwords, if specified, for the Syslog and SMTP forwarders are written to an internal LXCO log file in clear text. Affected logs are captured in …

9. 7.5CVE-2020-4695EPSS 0.9%2021-03-08

   IBM API Connect V10 is impacted by insecure communications during database replication. As the data replication happens over insecure communication channels, an attacker can view unencrypted data leading to a loss of confidentiality.

10. 7.8CVE-2020-23967EPSS 0.3%2021-03-08

    Dr.Web Security Space versions 11 and 12 allow elevation of privilege for local users without administrative privileges to NT AUTHORITY\SYSTEM due to insufficient control during autoupdate.

11. 5.3CVE-2021-23126EPSS 1.1%2021-03-04

    An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of the insecure rand() function within the process of generating the 2FA secret.

12. 7.5CVE-2020-28597EPSS 1.1%2021-03-03

    A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21. By predicting the seed it is possible to generate the correct password reset 1-time token. An attacker can visit the password reset …

13. 5.9CVE-2021-20441EPSS 0.8%2021-03-03

    IBM Security Verify Bridge uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 196617.

14. 9.1CVE-2021-21352EPSS 1.5%2021-03-03

    Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In TimeTracker before version 1.19.24.5415 tokens used in password reset feature in Time Tracker are based on system time and, therefore, are predict…

15. 5.1CVE-2021-27884EPSS 0.3%2021-03-01

    Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used.

16. 5.9CVE-2021-26565EPSS 0.7%2021-02-26

    Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to obtain sensitive information via an HTTP session.

17. 8.7CVE-2021-26564EPSS 0.7%2021-02-26

    Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to spoof servers via an HTTP session.

18. 7.4CVE-2021-26560EPSS 0.8%2021-02-26

    Cleartext transmission of sensitive information vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to spoof servers via an HTTP session.

19. 9.8CVE-2021-3406EPSS 0.7%2021-02-25

    A flaw was found in keylime 5.8.1 and older. The issue in the Keylime agent and registrar code invalidates the cryptographic chain of trust from the Endorsement Key certificate to agent attestations.

20. 8.8CVE-2020-7846EPSS 1.1%2021-02-24

    Helpcom before v10.0 contains a file download and execution vulnerability caused by storing hardcoded cryptographic key. It finally leads to a file download and execution via access to crafted web page.

21. 4.6CVE-2020-12702EPSS 0.3%2021-02-24

    Weak encryption in the Quick Pairing mode in the eWeLink mobile application (Android application V4.9.2 and earlier, iOS application V4.9.1 and earlier) allows physically proximate attackers to eavesdrop on Wi-Fi credentials and other sens…

22. 7.5CVE-2021-22703EPSS 0.6%2021-02-19

    A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions), that could cause disclosu…

23. 7.5CVE-2021-22702EPSS 0.6%2021-02-19

    A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION7700/73xx, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions), that could …

24. 5.7CVE-2020-36252EPSS 0.5%2021-02-19

    ownCloud Server 10.x before 10.3.1 allows an attacker, who has one outgoing share from a victim, to access any version of any file by sending a request for a predictable ID number.

25. 5.9CVE-2020-25605EPSS 6.3%2021-02-17

    Cleartext transmission of sensitive information in Agora Video SDK prior to 3.1 allows a remote attacker to obtain access to audio and video of any ongoing Agora video call through observation of cleartext network traffic.

26. 7.8CVE-2021-1366EPSS 1.3%2021-02-17

    A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the VPN Posture …

27. 3.7CVE-2021-23839EPSS 3.0%2021-02-16

    OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both SSLv2 and more recent SSL and TLS versions then a check is made for a version rollback attack when unpadding an RSA sign…

28. 7.5CVE-2021-27211EPSS 3.3%2021-02-15

    steghide 0.5.1 relies on a certain 32-bit seed value, which makes it easier for attackers to detect hidden data.

29. 7.1CVE-2021-27209EPSS 0.2%2021-02-13

    In the management interface on TP-Link Archer C5v 1.7_181221 devices, credentials are sent in a base64 format over cleartext HTTP.

30. 7.5CVE-2021-20409EPSS 1.0%2021-02-12

    IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to o…

31. 4.9CVE-2021-20406EPSS 0.5%2021-02-12

    IBM Security Verify Information Queue 1.0.6 and 1.0.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 196184.

32. 7.5CVE-2020-25493EPSS 0.9%2021-02-11

    Oclean Mobile Application 2.1.2 communicates with an external website using HTTP so it is possible to eavesdrop the network traffic. The content of HTTP payload is encrypted using XOR with a hardcoded key, which allows for the possibility …

33. 4.6CVE-2021-20335EPSS 0.1%2021-02-11

    For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB processes, the upgrade to MongoDB Ops Manager versions prior to and including 4.4.12 triggers a …

34. 4.9CVE-2020-8355EPSS 0.5%2021-02-10

    An internal product security audit of Lenovo XClarity Administrator (LXCA) prior to version 3.1.0 discovered the Windows OS credentials provided by the LXCA user to perform driver updates of managed systems may be captured in the First Fai…

35. 9.8CVE-2021-3033EPSS 1.2%2021-02-10

    An improper verification of cryptographic signature vulnerability exists in the Palo Alto Networks Prisma Cloud Compute console. This vulnerability enables an attacker to bypass signature validation during SAML authentication by logging in…

36. 6.5CVE-2021-21474EPSS 0.7%2021-02-09

    SAP HANA Database, versions - 1.0, 2.0, accepts SAML tokens with MD5 digest, an attacker who manages to obtain an MD5-digest signed SAML Assertion issued for an SAP HANA instance might be able to tamper with it and alter it in a way that t…

37. 5.3CVE-2020-28388EPSS 1.4%2021-02-09

    A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (A…

38. 7.5CVE-2020-10554EPSS 0.8%2021-02-05

    An issue was discovered in Psyprax beforee 3.2.2. Passwords used to encrypt the data are stored in the database in an obfuscated format, which can be easily reverted. For example, the password AAAAAAAA is stored in the database as MMMMMMMM.

39. 5.5CVE-2020-10375EPSS 0.3%2021-02-05

    An issue was discovered in New Media Smarty before 9.10. Passwords are stored in the database in an obfuscated format that can be easily reversed. The file data.mdb contains these obfuscated passwords in the second column. NOTE: this is un…

40. 9.8CVE-2021-20623EPSS 2.9%2021-02-05

    Video Insight VMS versions prior to 7.8 allows a remote attacker to execute arbitrary code with the system user privilege by sending a specially crafted request.

41. 5.5CVE-2020-10538EPSS 0.3%2021-02-05

    An issue was discovered in Epikur before 20.1.1. It stores the secret passwords of the users as MD5 hashes in the database. MD5 can be brute-forced efficiently and should not be used for such purposes. Additionally, since no salt is used, …

42. 6.7CVE-2021-1244EPSS 0.2%2021-02-04

    Multiple vulnerabilities in Cisco Network Convergence System (NCS) 540 Series Routers, only when running Cisco IOS XR NCS540L software images, and Cisco IOS XR Software for the Cisco 8000 Series Routers could allow an authenticated, local …

43. 6.7CVE-2021-1136EPSS 0.2%2021-02-04

    Multiple vulnerabilities in Cisco Network Convergence System (NCS) 540 Series Routers, only when running Cisco IOS XR NCS540L software images, and Cisco IOS XR Software for the Cisco 8000 Series Routers could allow an authenticated, local …

44. 7.5CVE-2020-14246EPSS 0.7%2021-02-04

    HCL OneTest Performance V9.5, V10.0, V10.1 uses basic authentication which is relatively weak. An attacker could potentially decode the encoded credentials.

45. 5.3CVE-2021-25763EPSS 0.5%2021-02-03

    In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default.

46. 5.3CVE-2021-25761EPSS 0.5%2021-02-03

    In JetBrains Ktor before 1.5.0, a birthday attack on SessionStorage key was possible.

47. 5.3CVE-2020-29662EPSS 0.7%2021-02-02

    In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path.

48. 6.8CVE-2020-28498EPSS 1.2%2021-02-02

    The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the …

49. 7.5CVE-2020-13860EPSS 1.1%2021-02-01

    An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. The one-time password algorithm for the undocumented system account mofidev generates a predictable six-digit password.

50. 4.3CVE-2020-29536EPSS 0.5%2021-01-29

    Archer before 6.8 P2 (6.8.0.2) is affected by a path exposure vulnerability. A remote authenticated malicious attacker with access to service files may obtain sensitive information to use it in further attacks.