cve.bz

OWASP A04:2025 Cryptographic Failures vulnerabilities, newest first, page 83

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A04:2025 at MITRE.

Its weaknesses: 32

CWE-261, CWE-296, CWE-319, CWE-320, CWE-321, CWE-322, CWE-323, CWE-324, CWE-325, CWE-326, CWE-327, CWE-328, CWE-329, CWE-330, CWE-331, CWE-332, CWE-334, CWE-335, CWE-336, CWE-337, CWE-338, CWE-340, CWE-342, CWE-347, CWE-523, CWE-757, CWE-759, CWE-760, CWE-780, CWE-916, CWE-1240, CWE-1241

  1. 7.5CVE-2019-3992EPSS 1.3%

    ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can access the server's configuration file by sending an HTTP GET request. Amongst the configuration data, the attacker …

  2. 5.3CVE-2019-16568EPSS 0.6%

    Jenkins SCTMExecutor Plugin 2.2 and earlier transmits previously configured service credentials in plain text as part of the global configuration, as well as individual jobs' configurations.

  3. 8.1CVE-2019-18832EPSS 0.4%

    Barco ClickShare Button R9861500D01 devices before 1.9.0 have incorrect Credentials Management. The ClickShare Button implements encryption at rest which uses a one-time programmable (OTP) AES encryption key. This key is shared across all …

  4. 5.9CVE-2019-19794EPSS 2.1%

    The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.

  5. 8.1CVE-2019-16732EPSS 0.9%

    Unencrypted HTTP communications for firmware upgrades in Petalk AI and PF-103 allow man-in-the-middle attackers to run arbitrary code as the root user.

  6. 7.5CVE-2019-19766EPSS 1.3%

    The Bitwarden server through 1.32.0 has a potentially unwanted KDF.

  7. 5.5CVE-2019-18340EPSS 0.2%

    A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0), Control Center Server (CCS) (All versions >= V1.5.0), SiNVR/SiVMS Video Server (All versions < V5.0.0), SiNVR/SiVMS Video Server (All versions >= V…

  8. 5.9CVE-2019-18285EPSS 1.0%

    A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). The RMI communication between the client and the Application Server is unencrypted. An attacker with access to the communication c…

  9. 9.8CVE-2019-19750EPSS 1.1%

    minerstat msOS before 2019-10-23 does not have a unique SSH key for each instance of the product.

  10. 5.9CVE-2019-17428EPSS 0.7%

    An issue was discovered in Intesync Solismed 3.3sp1. An flaw in the encryption implementation exists, allowing for all encrypted data stored within the database to be decrypted.

  11. 5.3CVE-2019-14317EPSS 1.8%

    wolfSSL and wolfCrypt 4.1.0 and earlier (formerly known as CyaSSL) generate biased DSA nonces. This allows a remote attacker to compute the long term private key from several hundred DSA signatures via a lattice attack. The issue occurs be…

  12. 9.8CVE-2012-1577EPSS 1.6%

    lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0.

  13. 5.3CVE-2019-19251EPSS 0.7%

    The Last.fm desktop app (Last.fm Scrobbler) through 2.1.39 on macOS makes HTTP requests that include an API key without the use of SSL/TLS. Although there is an Enable SSL option, it is disabled by default, and cleartext requests are made …

  14. 9.8CVE-2013-2166EPSS 2.1%

    python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass

  15. 9.8CVE-2019-16674EPSS 1.9%

    An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Authentication Information used in a cookie is predictable and can lead to admin pas…

  16. 9.8CVE-2019-16672EPSS 1.3%

    An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Sensitive Credentials data is transmitted in cleartext.

  17. 7.4CVE-2012-2130EPSS 2.2%

    A Security Bypass vulnerability exists in PolarSSL 0.99pre4 through 1.1.1 due to a weak encryption error when generating Diffie-Hellman values and RSA keys.

  18. 5.9CVE-2012-2092EPSS 3.7%

    A Security Bypass vulnerability exists in Ubuntu Cobbler before 2,2,2 in the cobbler-ubuntu-import script due to an error when verifying the GPG signature.

  19. 7.5CVE-2019-16753EPSS 0.7%

    An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. The content to be signed is composed of a representation of strings, rather than being composed of their binary representations. This is a weak si…

  20. 7.5CVE-2019-18850EPSS 1.2%

    TrevorC2 v1.1/v1.2 fails to prevent fingerprinting primarily via a discrepancy between response headers when responding to different HTTP methods, also via predictible responses when accessing and interacting with the "SITE_PATH_QUERY".

  21. 5.3CVE-2015-7542EPSS 0.4%

    A vulnerability exists in libgwenhywfar through 4.12.0 due to the usage of outdated bundled CA certificates.

  22. 7.5CVE-2019-19316EPSS 0.9%

    When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP.

  23. 8.6CVE-2012-5562EPSS 1.0%

    A flaw was found in rhn-proxy. This vulnerability may allow the rhn-proxy to transmit user credentials in clear-text when it accesses RHN Satellite. This could lead to information disclosure, where sensitive authentication details are expo…

  24. 9.8CVE-2019-12503EPSS 2.0%

    Due to unencrypted and unauthenticated data communication, the wireless barcode scanner Inateck BCST-60 is prone to keystroke injection attacks. Thus, an attacker is able to send arbitrary keystrokes to a victim's computer system, e.g., to…

  25. 7.5CVE-2019-12388EPSS 0.8%

    Anviz access control devices perform cleartext transmission of sensitive information (passwords/pins and names) when replying to query on port tcp/5010.

  26. 5.3CVE-2019-19463EPSS 0.5%

    The Anhui Huami Mi Fit application before 4.0.11 for Android has an Unencrypted Update Check.

  27. 7.5CVE-2013-7484EPSS 1.1%

    Zabbix before 5.0 represents passwords in the users table with unsalted MD5.

  28. 7.5CVE-2019-5232EPSS 1.0%

    There is a use of insufficiently random values vulnerability in Huawei ViewPoint products. An unauthenticated, remote attacker can guess information by a large number of attempts. Successful exploitation may cause information leak.

  29. 2.5CVE-2016-4980EPSS 0.3%

    A password generation weakness exists in xquest through 2016-06-13.

  30. 9.8CVE-2011-4121EPSS 2.5%

    The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used for private RSA key generation. A remote attacker could use this flaw to bypass or corrupt integrity …

  31. 6.5CVE-2019-18241EPSS 0.3%

    In Philips IntelliBridge EC40 and EC80, IntelliBridge EC40 Hub all versions, and IntelliBridge EC80 Hub all versions, the SSH server running on the affected products is configured to allow weak ciphers. This could enable an unauthorized at…

  32. 3.7CVE-2011-3374EPSS 1.2%

    It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.

  33. 9.8CVE-2014-6311EPSS 1.7%

    generate_doygen.pl in ace before 6.2.7+dfsg-2 creates predictable file names in the /tmp directory which allows attackers to gain elevated privileges.

  34. 9.8CVE-2014-3585EPSS 1.1%

    redhat-upgrade-tool: Does not check GPG signatures when upgrading versions

  35. 6.5CVE-2019-16545EPSS 0.5%

    Jenkins QMetry for JIRA - Test Management Plugin transmits credentials in its configuration in plain text as part of job configuration forms, potentially resulting in their exposure.

  36. 5.5CVE-2014-0083EPSS 0.3%

    The Ruby net-ldap gem before 0.11 uses a weak salt when generating SSHA passwords.

  37. 5.5CVE-2012-1257ExploitEPSS 0.7%

    Pidgin 2.10.0 uses DBUS for certain cleartext communication, which allows local users to obtain sensitive information via a dbus session monitor.

  38. 5.9CVE-2019-16863EPSS 3.4%

    STMicroelectronics ST33TPHF2ESPI TPM devices before 2019-09-12 allow attackers to extract the ECDSA private key via a side-channel timing attack because ECDSA scalar multiplication is mishandled, aka TPM-FAIL.

  39. 6.5CVE-2019-3640EPSS 0.5%

    Unprotected Transport of Credentials in ePO extension in McAfee Data Loss Prevention 11.x prior to 11.4.0 allows remote attackers with access to the network to collect login details to the LDAP server via the ePO extension not using a secu…

  40. 5.5CVE-2010-4177EPSS 0.3%

    mysql-gui-tools (mysql-query-browser and mysql-admin) before 5.0r14+openSUSE-2.3 exposes the password of a user connected to the MySQL server in clear text form via the list of running processes.

  41. 9.8CVE-2019-18852EPSS 1.6%

    Certain D-Link devices have a hardcoded Alphanetworks user account with TELNET access because of /etc/config/image_sign or /etc/alpha_config/image_sign. This affects DIR-600 B1 V2.01 for WW, DIR-890L A1 v1.03, DIR-615 J1 v100 (for DCN), DI…

  42. 4.3CVE-2019-4411EPSS 0.8%

    IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 could allow an authenticated user to obtain sensitive information due to easy to guess session identifier names. IBM X-Force ID: 162658.

  43. 7.8CVE-2019-13539EPSS 0.3%

    Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energy Platform (VLFX8GEN) software version 1.1.0 and below use the descrypt algorith…

  44. 7.5CVE-2019-16208EPSS 0.4%

    Password-based encryption (PBE) algorithm, of Brocade SANnav versions before v2.0, has a weakness in generating cryptographic keys that may allow an attacker to decrypt passwords used with several services (Radius, TACAS, etc.).

  45. 8.8CVE-2019-16205EPSS 1.3%

    A vulnerability, in Brocade SANnav versions before v2.0, could allow remote attackers to brute-force a valid session ID. The vulnerability is due to an insufficiently random session ID for several post-authentication actions in the SANnav …

  46. 7.5CVE-2010-2450EPSS 1.2%

    The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask (default 22) instead of chmoding the resulting f…

  47. 8.8CVE-2019-3465EPSS 3.0%

    Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate pr…

  48. 8.8CVE-2019-18800EPSS 1.7%

    Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet traffic to steal their Viber account, because not all Viber protocol traffic is encrypted. TCP data packet 9 on port 4244 from the victim's device contains…

  49. 5.3CVE-2019-8113EPSS 0.9%

    Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 uses cryptographically weak random number generator to brute-force the confirmation code for customer registration.

  50. 7.5CVE-2019-10084EPSS 1.0%

    In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries via a specially-constructed request and thereby potentially bypass authorization…