cve.bz

OWASP A04:2025 Cryptographic Failures vulnerabilities, newest first, page 84

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A04:2025 at MITRE.

Its weaknesses: 32

CWE-261, CWE-296, CWE-319, CWE-320, CWE-321, CWE-322, CWE-323, CWE-324, CWE-325, CWE-326, CWE-327, CWE-328, CWE-329, CWE-330, CWE-331, CWE-332, CWE-334, CWE-335, CWE-336, CWE-337, CWE-338, CWE-340, CWE-342, CWE-347, CWE-523, CWE-757, CWE-759, CWE-760, CWE-780, CWE-916, CWE-1240, CWE-1241

  1. 4.8CVE-2010-3670EPSS 0.5%

    TYPO3 before 4.3.4 and 4.4.x before 4.4.1 contains insecure randomness during generation of a hash with the "forgot password" function.

  2. 7.5CVE-2019-17598EPSS 0.7%

    An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may sometimes, typically under high load, when connecting to a target host using https, e…

  3. 5.3CVE-2010-3666EPSS 1.2%

    TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains insecure randomness in the uniqid function.

  4. 9.8CVE-2013-2260EPSS 2.2%

    Cryptocat before 2.0.22: Cryptocat.random() Function Array Key has Entropy Weakness

  5. 7.5CVE-2013-4104EPSS 0.8%

    Cryptocat before 2.0.22 has weak encryption in the Socialist Millionnaire Protocol

  6. 9.1CVE-2013-4102EPSS 2.0%

    Cryptocat before 2.0.22 strophe.js Math.random() Random Number Generator Weakness

  7. 5.3CVE-2012-6124EPSS 1.3%

    A casting error in Chicken before 4.8.0 on 64-bit platform caused the random number generator to return a constant value. NOTE: the vendor states "This function wasn't used for security purposes (and is advertised as being unsuitable)."

  8. 6.5CVE-2019-6846EPSS 1.0%

    A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause information disclosure when using the FTP protocol.

  9. 7.5CVE-2019-6845EPSS 1.1%

    A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (all firmware versions), which could cause the disclosure of information when transferring app…

  10. 7.5CVE-2019-4339EPSS 1.0%

    IBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 161418.

  11. 7.5CVE-2019-4399EPSS 0.8%

    IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 162260.

  12. 7.5CVE-2019-18201EPSS 1.2%

    An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption of 2.4 GHz communication, an attacker is able to eavesdrop on sensitive data such as passwords.

  13. 6.6CVE-2019-18199EPSS 0.4%

    An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption of 2.4 GHz communication, and because of password-based authentication, they are vulnerable to replay attacks.

  14. 7.5CVE-2019-15703EPSS 1.0%

    An Insufficient Entropy in PRNG vulnerability in Fortinet FortiOS 6.2.1, 6.2.0, 6.0.8 and below for device not enable hardware TRNG token and models not support builtin TRNG seed allows attacker to theoretically recover the long term ECDSA…

  15. 9.8CVE-2019-8237EPSS 2.8%

    Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an insufficiently robust encr…

  16. 6.5CVE-2019-12967EPSS 1.0%

    Stephan Mooltipass Moolticute through 0.42.1 (and possibly earlier versions) has Incorrect Access Control.

  17. 9.8CVE-2019-17393EPSS 1.8%

    The Customer's Tomedo Server in Version 1.7.3 communicates to the Vendor Tomedo Server via HTTP (in cleartext) that can be sniffed by unauthorized actors. Basic authentication is used for the authentication, making it possible to base64 de…

  18. 7.5CVE-2019-15626EPSS 1.8%

    The Deep Security Manager application (Versions 10.0, 11.0 and 12.0), when configured in a certain way, may transmit initial LDAP communication in clear text. This may result in confidentiality impact but does not impact integrity or avail…

  19. 6.5CVE-2019-17356EPSS 0.4%

    The Infinite Design application 3.4.12 for Android sends a username and password via TCP without any encryption during login, as demonstrated by sniffing of a public Wi-Fi network.

  20. 7.8CVE-2019-9532EPSS 0.2%

    The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext. This could allow an unauthenticated, local attacker to intercept the password and gain access to the portal.

  21. 6.5CVE-2019-13929EPSS 1.3%

    A vulnerability has been identified in SIMATIC IT UADM (All versions < V1.3). An authenticated remote attacker with network access to port 1434/tcp of SIMATIC IT UADM could potentially recover a password that can be used to gain read and w…

  22. 7.8CVE-2019-0071EPSS 0.2%

    Veriexec is a kernel-based file integrity subsystem in Junos OS that ensures only authorized binaries are able to be executed. Due to a flaw in specific versions of Junos OS, affecting specific EX Series platforms, the Veriexec subsystem w…

  23. 5.5CVE-2019-0069EPSS 0.2%

    On EX4600, QFX5100 Series, NFX Series, QFX10K Series, QFX5110, QFX5200 Series, QFX5110, QFX5200, QFX10K Series, vSRX, SRX1500, SRX4000 Series, vSRX, SRX1500, SRX4000, QFX5110, QFX5200, QFX10K Series, when the user uses console management p…

  24. 6.8CVE-2019-14808EPSS 1.3%

    An issue was discovered in the RENPHO application 3.0.0 for iOS. It transmits JSON data unencrypted to a server without an integrity check, if a user changes personal data in his profile tab (e.g., exposure of his birthday) or logs into hi…

  25. 4.6CVE-2019-11341EPSS 0.2%

    On certain Samsung P(9.0) phones, an attacker with physical access can start a TCP Dump capture without the user's knowledge. This feature of the Service Mode application is available after entering the *#9900# check code, but is protected…

  26. 4.9CVE-2018-5745EPSS 2.3%

    "managed-keys" is a feature which allows a BIND resolver to automatically maintain the keys used by trust anchors which operators configure for use in DNSSEC validation. Due to an error in the managed-keys feature it is possible for a BIND…

  27. 4.3CVE-2019-10963ExploitEPSS 6.5%

    Moxa EDR 810, all versions 5.1 and prior, allows an unauthenticated attacker to be able to retrieve some log files from the device, which may allow sensitive information disclosure. Log files must have previously been exported by a legitim…

  28. 5.3CVE-2019-17105EPSS 1.6%

    The token generator in index.php in Centreon Web before 2.8.27 is predictable.

  29. 9.1CVE-2019-17218EPSS 0.7%

    An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. By default, the communication to the web service is unencrypted via http. An attacker is able to intercept and sniff communication to the we…

  30. 9.8CVE-2019-17216EPSS 0.7%

    An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. Password authentication uses MD5 to hash passwords. Cracking is possible with minimal effort.

  31. 5.9CVE-2019-13629EPSS 1.2%

    MatrixSSL 4.2.1 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or a remote attacker, able to measure the duration of hundreds to thousands of signing operations, to compute the private key use…

  32. 5.9CVE-2019-14959EPSS 0.7%

    JetBrains Toolbox before 1.15.5605 was resolving an internal URL via a cleartext http connection.

  33. 5.3CVE-2019-12737EPSS 0.7%

    UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing user credentials.

  34. 4.3CVE-2019-16116ExploitEPSS 3.7%

    EnterpriseDT CompleteFTP Server prior to version 12.1.3 is vulnerable to information exposure in the Bootstrap.log file. This allows an attacker to obtain the administrator password hash.

  35. 7.5CVE-2019-0231EPSS 2.1%

    Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should mi…

  36. 5.9CVE-2019-14954EPSS 0.7%

    JetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link via a cleartext http connection.

  37. 7.5CVE-2019-10435EPSS 0.9%

    Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.

  38. 7.5CVE-2019-10434EPSS 0.9%

    Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.

  39. 5.3CVE-2019-4280EPSS 0.8%

    IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 displays sensitive information in HTTP requests which could be used in further attacks against the system. IBM X-Force ID: 160503.

  40. 9.8CVE-2019-2294EPSS 0.9%

    Usage of hard-coded magic number for calculating heap guard bytes can allow users to corrupt heap blocks without heap algorithm knowledge in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Conn…

  41. 7.5CVE-2019-16992EPSS 0.9%

    The Keybase app 2.13.2 for iOS provides potentially insufficient notice that it is employing a user's private key to sign a certain cryptocurrency attestation (that an address at keybase.io can be used for Stellar payments to the user), wh…

  42. 7.2CVE-2019-3736EPSS 0.7%

    Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a password storage vulnerability in the ACM component. A remote authenticated malicious user with root privileges may potentially use a support tool to decrypt enc…

  43. 5.9CVE-2019-9399EPSS 0.4%

    The Print Service is susceptible to man in the middle attacks due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. …

  44. 8.8CVE-2019-16924EPSS 0.7%

    The Nulock application 1.5.0 for mobile devices sends a cleartext password over Bluetooth, which allows remote attackers (after sniffing the network) to take control of the lock.

  45. 7.5CVE-2019-11755EPSS 1.3%

    A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer was shown as having a valid digital signature, although the signer might have had no access to the contents of the encrypted message, and might …

  46. 6.5CVE-2019-11739EPSS 0.9%

    Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunderbird < 68.1 and Thunderbird < 60.9.

  47. 9.8CVE-2015-9435EPSS 2.1%

    The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers.

  48. 6.7CVE-2019-12662EPSS 0.3%

    A vulnerability in Cisco NX-OS Software and Cisco IOS XE Software could allow an authenticated, local attacker with valid administrator or privilege level 15 credentials to load a virtual service image and bypass signature verification on …

  49. 6.7CVE-2019-12649EPSS 0.2%

    A vulnerability in the Image Verification feature of Cisco IOS XE Software could allow an authenticated, local attacker to install and boot a malicious software image or execute unsigned binaries on an affected device. The vulnerability ex…

  50. 6.5CVE-2019-6652EPSS 0.6%

    In BIG-IQ 6.0.0-6.1.0, services for stats do not require authentication nor do they implement any form of Transport Layer Security (TLS).