cve.bz

OWASP A04:2025 Cryptographic Failures vulnerabilities, newest first, page 82

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A04:2025 at MITRE.

Its weaknesses: 32

CWE-261, CWE-296, CWE-319, CWE-320, CWE-321, CWE-322, CWE-323, CWE-324, CWE-325, CWE-326, CWE-327, CWE-328, CWE-329, CWE-330, CWE-331, CWE-332, CWE-334, CWE-335, CWE-336, CWE-337, CWE-338, CWE-340, CWE-342, CWE-347, CWE-523, CWE-757, CWE-759, CWE-760, CWE-780, CWE-916, CWE-1240, CWE-1241

  1. 7.5CVE-2019-4427EPSS 0.5%

    IBM Cloud CLI 0.6.0 through 0.16.1 windows installers are signed using SHA1 certificate. An attacker might be able to exploit the weak algorithm to generate a installer with malicious software inside. IBM X-Force ID: 162773.

  2. 7.5CVE-2014-2560ExploitEPSS 1.7%

    The PhonerLite phone before 2.15 provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for remote attackers to obtain access via a brute-force attack, related to a "SIP Digest Leak" issue.

  3. 7.5CVE-2009-5139EPSS 0.4%

    The SIP implementation on the Gizmo5 software phone provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for remote attackers to obtain access via a brute-force attack, related to a "SIP D…

  4. 5.5CVE-2013-2213EPSS 0.3%

    The KRandom::random function in KDE Paste Applet after 4.10.5 in kdeplasma-addons uses the GNU C Library rand function's linear congruential generator, which makes it easier for context-dependent attackers to defeat cryptographic protectio…

  5. 7.5CVE-2019-20061EPSS 0.9%

    The user-introduction email in MFScripts YetiShare v3.5.2 through v4.5.4 may leak the (system-picked) password if this email is sent in cleartext. In other words, the user is not allowed to choose their own initial password.

  6. 5.9CVE-2019-13163EPSS 0.6%

    The Fujitsu TLS library allows a man-in-the-middle attack. This affects Interstage Application Development Cycle Manager V10 and other versions, Interstage Application Server V12 and other versions, Interstage Business Application Manager …

  7. 7.5CVE-2020-8507EPSS 1.4%

    The Citytv Video application 4.08.0 for Android and 3.35 for iOS sends Unencrypted Analytics.

  8. 5.3CVE-2020-8506EPSS 1.1%

    The Global TV application 2.3.2 for Android and 4.7.5 for iOS sends Unencrypted Analytics.

  9. 9.8CVE-2020-6174EPSS 1.0%

    TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.

  10. 5.5CVE-2020-8631EPSS 0.4%

    cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.

  11. 7.5CVE-2019-4540EPSS 0.8%

    IBM Security Directory Server 6.4.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 165813.

  12. 7.5CVE-2011-3629EPSS 1.1%

    Joomla! core 1.7.1 allows information disclosure due to weak encryption

  13. 7.5CVE-2015-8851EPSS 2.3%

    node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing.

  14. 8.1CVE-2020-5229EPSS 0.6%

    Opencast before 8.1 stores passwords using the rather outdated and cryptographically insecure MD5 hash algorithm. Furthermore, the hashes are salted using the username instead of a random salt, causing hashes for users with the same userna…

  15. 7.5CVE-2020-7906EPSS 0.7%

    In JetBrains Rider versions 2019.3 EAP2 through 2019.3 EAP7, there were unsigned binaries provided by the Windows installer. This issue was fixed in release version 2019.3.

  16. 8.6CVE-2020-2099EPSS 1.0%

    Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those ag…

  17. 7.5CVE-2019-4639EPSS 0.8%

    IBM Security Secret Server 10.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 170045.

  18. 5.9CVE-2013-0294EPSS 2.9%

    packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force attack.

  19. 4.7CVE-2018-19441EPSS 0.3%

    An issue was discovered in Neato Botvac Connected 2.2.0. The GenerateRobotPassword function of the NeatoCrypto library generates insufficiently random numbers for robot secret_key values used for local and cloud authentication/authorizatio…

  20. 7.5CVE-2020-7984EPSS 2.5%

    SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext domain admin credentials from the Agent & Probe settings, and obtain other sensitive information. The attacker can use a custome…

  21. 8.8CVE-2020-5224EPSS 0.5%

    In Django User Sessions (django-user-sessions) before 1.7.1, the views provided allow users to terminate specific sessions. The session key is used to identify sessions, and thus included in the rendered HTML. In itself this is not a probl…

  22. 10.0CVE-2020-6966EPSS 2.2%

    In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, the affected products utilize a weak encryp…

  23. 3.3CVE-2019-3700EPSS 0.1%

    yast2-security didn't use secure defaults to protect passwords. This became a problem on 2019-10-07 when configuration files that set secure settings were moved to a different location. As of the 20191022 snapshot the insecure default sett…

  24. 7.5CVE-2019-19898EPSS 0.7%

    In IXP EasyInstall 6.2.13723, there are cleartext credentials in network communication on TCP port 20050 when using the Administrator console remotely.

  25. 5.9CVE-2019-16791EPSS 0.9%

    In postfix-mta-sts-resolver before 0.5.1, All users can receive incorrect response from daemon under rare conditions, rendering downgrade of effective STS policy.

  26. 5.5CVE-2020-6857ExploitEPSS 1.0%

    CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local FTP server passwords is hard-coded in the binary.

  27. 7.5CVE-2020-7241EPSS 2.4%

    The WP Database Backup plugin through 5.5 for WordPress stores downloads by default locally in the directory wp-content/uploads/db-backup/. This might allow attackers to read ZIP archives by guessing random ID numbers, guessing date string…

  28. 5.3CVE-2019-18282EPSS 2.9%

    The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f. This occurs because the auto flowlabel of a UDP IPv6 packet relies on a 32-bit hashrnd value as a secre…

  29. 7.5CVE-2012-1562EPSS 0.9%

    Joomla! core before 2.5.3 allows unauthorized password change.

  30. 7.8CVE-2020-0644EPSS 0.9%

    An elevation of privilege vulnerability exists when Microsoft Windows implements predictable memory section names, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0635.

  31. 7.5CVE-2019-12399EPSS 3.9%

    When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in …

  32. 7.5CVE-2020-5390EPSS 1.2%

    PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping (XSW). The signature information and the node/object that is si…

  33. 5.9CVE-2019-19891EPSS 0.3%

    An encryption key vulnerability on Mitel SIP-DECT wireless devices 8.0 and 8.1 could allow an attacker to launch a man-in-the-middle attack. A successful exploit may allow the attacker to intercept sensitive information.

  34. 7.5CVE-2014-5380ExploitEPSS 4.3%

    Grand MA 300 allows retrieval of the access PIN from sniffed data.

  35. 5.3CVE-2020-1810EPSS 0.5%

    There is a weak algorithm vulnerability in some Huawei products. The affected products use the RSA algorithm in the SSL key exchange algorithm which have been considered as a weak algorithm. Attackers may exploit this vulnerability to leak…

  36. 4.4CVE-2020-1826EPSS 0.1%

    Huawei Honor Magic2 mobile phones with versions earlier than 10.0.0.175(C00E59R2P11) have an information leak vulnerability. Due to a module using weak encryption tool, an attacker with the root permission may exploit the vulnerability to …

  37. 7.5CVE-2019-16274EPSS 0.7%

    DTEN D5 before 1.3 and D7 before 1.3 devices transfer customer data files via unencrypted HTTP.

  38. 9.1CVE-2019-14859EPSS 1.5%

    A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Withou…

  39. 9.1CVE-2019-19735EPSS 0.8%

    class.userpeer.php in MFScripts YetiShare 3.5.2 through 4.5.3 uses an insecure method of creating password reset hashes (based only on microtime), which allows an attacker to guess the hash and set the password within a few hours by brutef…

  40. 7.5CVE-2019-20138EPSS 0.8%

    The HTTP Authentication library before 2019-12-27 for Nim has weak password hashing because the default algorithm for libsodium's crypto_pwhash_str is not used.

  41. 7.5CVE-2019-19967EPSS 1.0%

    The Administration page on Connect Box EuroDOCSIS 3.0 Voice Gateway CH7465LG-NCIP-6.12.18.25-2p6-NOSH devices accepts a cleartext password in a POST request on port 80, as demonstrated by the Password field to the xml/setter.xml URI.

  42. 7.5CVE-2019-19962EPSS 0.9%

    wolfSSL before 4.3.0 mishandles calls to wc_SignatureGenerateHash, leading to fault injection in RSA cryptography.

  43. 4.3CVE-2019-4743EPSS 0.6%

    IBM Financial Transaction Manager 3.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the u…

  44. 9.8CVE-2019-15911EPSS 0.8%

    An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Because of insecure key transport in ZigBee communication, attackers can obtain sensitive information, cause the multiple denial…

  45. 6.5CVE-2019-18263EPSS 0.2%

    An issue was found in Philips Veradius Unity, Pulsera, and Endura Dual WAN Router, Veradius Unity (718132) with wireless option (shipped between 2016-August 2018), Veradius Unity (718132) with ViewForum option (shipped between 2016-August …

  46. 7.5CVE-2019-19890EPSS 1.0%

    An issue was discovered on Humax Wireless Voice Gateway HGB10R-2 20160817_1855 devices. Admin credentials are sent over cleartext HTTP.

  47. 7.5CVE-2019-19889EPSS 1.1%

    An issue was discovered on Humax Wireless Voice Gateway HGB10R-2 20160817_1855 devices. The attacker can discover admin credentials in the backup file, aka backupsettings.conf.

  48. 6.5CVE-2019-8632EPSS 1.3%

    Some analytics data was sent using HTTP rather than HTTPS. This was addressed by no longer sending this analytics data. This issue is fixed in Texture 5.11.10 for iOS, Texture 4.22.0.4 for Android. An attacker in a privileged network posit…

  49. 7.5CVE-2019-4609EPSS 0.8%

    IBM API Connect 2018.4.1.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 168510.

  50. 7.5CVE-2019-3993EPSS 46%

    ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can recover a user's password hash by sending a crafted HTTP POST request.