Skip to content
Noroxi

CWE-326 · 406 records

Inadequate Encryption Strength

CVEs in this class

406 records

  • CVE-2017-1000486
    97Now

    Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

    CriticalCVSS 9.8KEVWeaponizedEPSS 94%

    primetek · primefacesJan 3, 2018

  • CVE-2017-11317
    94Now

    Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which a

    CriticalCVSS 9.8KEVWeaponizedEPSS 84%

    telerik · ui for asp.net ajaxAug 23, 2017

  • CVE-2018-15811
    83Now

    DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.

    HighCVSS 7.5KEVWeaponizedEPSS 76%

    dnnsoftware · dotnetnukeJul 3, 2019

  • CVE-2018-18325
    82Now

    DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters.

    HighCVSS 7.5KEVWeaponizedEPSS 74%

    dnnsoftware · dotnetnukeJul 3, 2019

  • CVE-2014-0224
    58Plan

    OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, whi

    HighCVSS 7.4WeaponizedEPSS 95%

    openssl · opensslJun 5, 2014

  • CVE-2013-2566
    48Plan

    The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to

    MediumCVSS 5.9WeaponizedEPSS 84%

    oracle · communications application session controllerMar 15, 2013

  • CVE-2020-6966
    41Plan

    In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X

    CriticalCVSS 10.0No exploitEPSS 2%

    gehealthcare · apexpro telemetry server firmwareJan 24, 2020

  • CVE-2011-4121
    40Plan

    The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used fo

    CriticalCVSS 9.8No exploitEPSS 3%

    ruby-lang · rubyNov 26, 2019

  • CVE-2013-2166
    40Plan

    python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass

    CriticalCVSS 9.8No exploitEPSS 2%

    openstack · python-keystoneclientDec 10, 2019

  • CVE-2018-0448
    40Plan

    Cisco Digital Network Architecture Center Authentication Bypass Vulnerability

    CriticalCVSS 9.8No exploitEPSS 2%

    cisco · digital network architecture centerOct 5, 2018

  • CVE-2018-7242
    40Plan

    Vulnerable hash algorithms exists in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all

    CriticalCVSS 9.8No exploitEPSS 2%

    schneider-electric · bmxnor0200 firmwareApr 18, 2018

  • CVE-2018-20810
    40Plan

    Session data between cluster nodes during cluster synchronization is not properly encrypted in Pulse Secure Pulse Connect Secure (PCS) 8.3RX

    CriticalCVSS 9.8No exploitEPSS 2%

    ivanti · connect secureJun 28, 2019

  • CVE-2025-12478
    40Plan

    Non-Compliant TLS Configuration

    CriticalCVSS 10.0No exploitEPSS 0%

    azure-access · blu-ic2 firmwareOct 29, 2025

  • CVE-2026-44523
    40Plan

    Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery

    CriticalCVSS 10.0No exploitEPSS 0%

    enchant97 · note-markMay 14, 2026

  • CVE-2011-3389
    39Monitor

    The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Op

    MediumCVSS 4.3WeaponizedEPSS 73%

    google · chromeSep 6, 2011

  • CVE-2013-7287
    39Monitor

    MobileIron VSP < 5.9.1 and Sentry < 5.0 has an insecure encryption scheme.

    CriticalCVSS 9.8No exploitEPSS 1%

    mobileiron · sentryFeb 13, 2020

  • CVE-2021-42216
    39Monitor

    A Broken or Risky Cryptographic Algorithm exists in AnonAddy 0.8.5 via VerificationController.php.

    CriticalCVSS 9.8No exploitEPSS 1%

    anonaddy · anonaddyDec 15, 2021

  • CVE-2019-15805
    39Monitor

    CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative inter

    CriticalCVSS 9.8No exploitEPSS 1%

    commscope · tr4400 firmwareAug 29, 2019

  • CVE-2019-15806
    39Monitor

    CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative inter

    CriticalCVSS 9.8No exploitEPSS 1%

    commscope · tr4400 firmwareAug 29, 2019

  • CVE-2016-5804
    39Monitor

    Moxa MGate MB3180 before 1.8, MGate MB3280 before 2.7, MGate MB3480 before 2.6, MGate MB3170 before 2.5, and MGate MB3270 before 2.7 use wea

    CriticalCVSS 9.8No exploitEPSS 1%

    moxa · mgate mb3180 firmwareJul 15, 2016

  • CVE-2017-7888
    39Monitor

    Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier.

    CriticalCVSS 9.8No exploitEPSS 1%

    dolibarr · dolibarr erp\/crmMay 10, 2017

  • CVE-2018-15124
    39Monitor

    Weak hashing algorithm in Zipato Zipabox Smart Home Controller BOARD REV - 1 with System Version -118 allows unauthenticated attacker extrac

    CriticalCVSS 9.8No exploitEPSS 1%

    zipato · zipabox firmwareAug 13, 2018

  • CVE-2019-10907
    39Monitor

    Airsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of airsonic in GlobalSecurityConfig.java.

    CriticalCVSS 9.8No exploitEPSS 1%

    airsonic project · airsonicApr 7, 2019

  • CVE-2017-8076
    39Monitor

    On the TP-Link TL-SG108E 1.0, admin network communications are RC4 encoded, even though RC4 is deprecated.

    CriticalCVSS 9.8No exploitEPSS 1%

    tp-link · tl-sg108e firmwareApr 23, 2017

  • CVE-2022-36555
    39Monitor

    Hytec Inter HWL-2511-SS v1.05 and below implements a SHA512crypt hash for the root account which can be easily cracked via a brute-force att

    CriticalCVSS 9.8No exploitEPSS 1%

    hytec · hwl-2511-ss firmwareAug 29, 2022

All vulnerability classes