Skip to content
Noroxi

CWE-320 · 90 records

Key Management Errors

CVEs in this class

90 records

  • CVE-2015-0936
    62This week

    Ceragon FibeAir IP-10 have a default SSH public key in the authorized_keys file for the mateidu user, which allows remote attackers to obtai

    CriticalCVSS 9.8WeaponizedEPSS 78%

    ceragon · fibeair ip-10 firmwareJun 1, 2017

  • CVE-2018-0732
    45Plan

    Client DoS due to large DH parameter

    HighCVSS 7.5No exploitEPSS 48%

    openssl · opensslJun 12, 2018

  • CVE-2018-0124
    41Plan

    A vulnerability in Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to bypass security protection

    CriticalCVSS 9.8No exploitEPSS 5%

    cisco · unified communications domain managerFeb 21, 2018

  • CVE-2016-10421
    39Monitor

    In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MD

    CriticalCVSS 9.8No exploitEPSS 1%

    qualcomm · mdm9206 firmwareApr 18, 2018

  • CVE-2016-10467
    39Monitor

    In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 210/SD 212/SD 205, S

    CriticalCVSS 9.8No exploitEPSS 1%

    qualcomm · sd 210 firmwareApr 18, 2018

  • CVE-2015-4166
    39Monitor

    Cloudera Key Trustee Server before 5.4.3 does not store keys synchronously, which might allow attackers to have unspecified impact via vecto

    CriticalCVSS 9.8No exploitEPSS 0%

    cloudera · key trustee serverMar 23, 2017

  • CVE-2015-8542
    36Monitor

    An issue was discovered in Open-Xchange Guard before 2.2.0-rev8.

    HighCVSS 8.8No exploitEPSS 2%

    open-xchange · ox guardDec 15, 2016

  • CVE-2019-5672
    36Monitor

    NVIDIA Jetson TX1 and TX2 contain a vulnerability in the Linux for Tegra (L4T) operating system (on all versions prior to R28.3) where the S

    CriticalCVSS 9.1No exploitEPSS 1%

    nvidia · jetson tx1Apr 11, 2019

  • CVE-2015-0839
    34Monitor

    The hp-plugin utility in HP Linux Imaging and Printing (HPLIP) makes it easier for man-in-the-middle attackers to execute arbitrary code by

    HighCVSS 8.1No exploitEPSS 6%

    hp · linux imaging and printingAug 2, 2017

  • CVE-2026-56254
    33Monitor

    capacitor-updater - End-to-End Encryption Bypass via Private Key Distribution

    HighCVSS 8.3No exploitEPSS 0%

    capacitor-updater · capacitor-updaterJul 10, 2026

  • CVE-2019-9894
    31Monitor

    A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification.

    HighCVSS 7.5No exploitEPSS 2%

    putty · puttyMar 21, 2019

  • CVE-2018-9234
    31Monitor

    GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in a

    HighCVSS 7.5No exploitEPSS 1%

    gnupg · gnupgApr 3, 2018

  • CVE-2015-0153
    31Monitor

    D-Link DIR-815 devices with firmware before 2.07.B01 allow remote attackers to obtain sensitive information by leveraging cleartext storage

    HighCVSS 7.5No exploitEPSS 1%

    dlink · dir-815 firmwareApr 12, 2018

  • CVE-2016-6886
    31Monitor

    The pstm_reverse function in MatrixSSL before 3.8.4 allows remote attackers to cause a denial of service (invalid memory read and crash) via

    HighCVSS 7.5No exploitEPSS 1%

    matrixssl · matrixsslJan 13, 2017

  • CVE-2016-2880
    31Monitor

    IBM QRadar 7.2 stores the encryption key used to encrypt the service account password which can be obtained by a local user.

    HighCVSS 7.8No exploitEPSS 0%

    ibm · qradar security information and event managerMar 1, 2017

  • CVE-2013-2233
    30Monitor

    Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys.

    HighCVSS 7.4No exploitEPSS 1%

    redhat · ansibleMay 4, 2018

  • CVE-2015-7503
    30Monitor

    Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA

    HighCVSS 7.5No exploitEPSS 1%

    zend · zend frameworkOct 10, 2017

  • CVE-2015-1316
    30Monitor

    Juju Joyent provider uploads user's private ssh key by default

    HighCVSS 7.5No exploitEPSS 1%

    canonical · jujuApr 22, 2019

  • CVE-2021-26322
    30Monitor

    Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”.

    HighCVSS 7.5No exploitEPSS 1%

    amd · epyc 7601 firmwareNov 16, 2021

  • CVE-2017-13887
    30Monitor

    In macOS High Sierra before 10.13.2, a logic issue existed in APFS when deleting keys during hibernation.

    HighCVSS 7.5No exploitEPSS 0%

    apple · mac os xJan 11, 2019

  • CVE-2016-6879
    30Monitor

    The X509_Certificate::allowed_usage function in botan 1.11.x before 1.11.31 might allow attackers to have unspecified impact by leveraging a

    HighCVSS 7.5No exploitEPSS 0%

    botan project · botanApr 10, 2017

  • CVE-2019-12621
    29Monitor

    Cisco HyperFlex Static SSL Key Vulnerability

    HighCVSS 7.4No exploitEPSS 0%

    cisco · hyperflex hx220c m5 firmwareAug 21, 2019

  • CVE-2024-36391
    29Monitor

    MileSight DeviceHub - CWE-320: Key Management Errors

    HighCVSS 7.4No exploitEPSS 0%

    milesight · devicehubJun 2, 2024

  • CVE-2014-2361
    28Monitor

    OleumTech WIO Family Key Management Errors

    HighCVSS 7.2No exploitEPSS 0%

    oleumtech · sensor wireless i\/o moduleJul 24, 2014

  • CVE-2023-21626
    28Monitor

    Improper Authentication in HLOS.

    HighCVSS 7.1No exploitEPSS 0%

    qualcomm · apq8009 firmwareAug 8, 2023

All vulnerability classes