Skip to content
Noroxi

CWE-327 · 642 records

Use of a Broken or Risky Cryptographic Algorithm

CVEs in this class

642 records

  • CVE-2023-34039
    59Plan

    Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation.

    CriticalCVSS 9.8WeaponizedEPSS 67%

    vmware · aria operations for networksAug 29, 2023

  • CVE-2016-6602
    56Plan

    ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtai

    CriticalCVSS 9.8WeaponizedEPSS 55%

    zohocorp · webnms frameworkJan 23, 2017

  • CVE-2014-8687
    52Plan

    Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root privileges by levera

    CriticalCVSS 9.8WeaponizedEPSS 43%

    seagate · business nas firmwareJun 8, 2017

  • CVE-2007-6013
    40Plan

    Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication

    CriticalCVSS 9.8No exploitEPSS 3%

    wordpress · wordpressNov 19, 2007

  • CVE-2019-8237
    40Plan

    Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear

    CriticalCVSS 9.8No exploitEPSS 2%

    adobe · acrobat dcOct 23, 2019

  • CVE-2019-0187
    40Plan

    Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options).

    CriticalCVSS 9.8No exploitEPSS 2%

    apache · jmeterMar 6, 2019

  • CVE-2022-3365
    40Plan

    Emote Interactive Remote Mouse Server command injection due to weak encoding

    CriticalCVSS 9.8WeaponizedEPSS 2%

    emote interactive · remote mouse serverJan 27, 2025

  • CVE-2017-17878
    39Monitor

    An issue was discovered in Valve Steam Link build 643.

    CriticalCVSS 9.8No exploitEPSS 1%

    valvesoftware · steam link firmwareDec 27, 2017

  • CVE-2019-13022
    39Monitor

    Bond JetSelect (all versions) has an issue in the Java class (ENCtool.jar) and corresponding password generation algorithm (used to set init

    CriticalCVSS 9.8No exploitEPSS 1%

    jetstream · jetselectMay 14, 2020

  • CVE-2012-4449
    39Monitor

    Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security fe

    CriticalCVSS 9.8No exploitEPSS 1%

    apache · hadoopOct 30, 2017

  • CVE-2017-9859
    39Monitor

    An issue was discovered in SMA Solar Technology products.

    CriticalCVSS 9.8No exploitEPSS 1%

    sma · sunny boy 3600 firmwareAug 5, 2017

  • CVE-2019-5723
    39Monitor

    An issue was discovered in portier vision 4.4.4.2 and 4.4.4.6.

    CriticalCVSS 9.8No exploitEPSS 1%

    portier · portierMar 21, 2019

  • CVE-2019-16143
    39Monitor

    An issue was discovered in the blake2 crate before 0.8.1 for Rust.

    CriticalCVSS 9.8No exploitEPSS 0%

    blake2 · blake2-rustSep 9, 2019

  • CVE-2017-4917
    39Monitor

    VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x locally stores vCenter Server credentials using reversible encryption.

    CriticalCVSS 9.8No exploitEPSS 0%

    vmware · vsphere data protectionJun 7, 2017

  • CVE-2021-36298
    39Monitor

    Dell EMC InsightIQ, versions prior to 4.1.4, contain risky cryptographic algorithms in the SSH component.

    CriticalCVSS 9.8No exploitEPSS 0%

    dell · isilon insightiq firmwareOct 1, 2021

  • CVE-2021-45696
    39Monitor

    An issue was discovered in the sha2 crate 0.9.7 before 0.9.8 for Rust.

    CriticalCVSS 9.8No exploitEPSS 0%

    sha2 project · sha2Dec 26, 2021

  • CVE-2020-3681
    39Monitor

    Authenticated and encrypted payload MMEs can be forged and remotely sent to any HPAV2 system using a jailbreak key recoverable from code.

    CriticalCVSS 9.8No exploitEPSS 0%

    qualcomm · -Jul 31, 2020

  • CVE-2022-26854
    39Monitor

    Dell PowerScale OneFS, versions 8.2.x-9.2.x, contain risky cryptographic algorithms.

    CriticalCVSS 9.8No exploitEPSS 0%

    dell · emc powerscale onefsApr 8, 2022

  • CVE-2019-9095
    39Monitor

    An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3,

    CriticalCVSS 9.8No exploitEPSS 0%

    moxa · mb3170 firmwareMar 11, 2020

  • CVE-2017-17717
    39Monitor

    Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature

    CriticalCVSS 9.8No exploitEPSS 0%

    sonatype · nexus repository managerDec 17, 2017

  • CVE-2020-36363
    39Monitor

    Amazon AWS CloudFront TLSv1.2_2019 allows TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 and TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, which some entiti

    CriticalCVSS 9.8No exploitEPSS 0%

    amazon · amazon cloudfrontAug 12, 2021

  • CVE-2022-31230
    39Monitor

    Dell PowerScale OneFS, versions 8.2.x-9.2.x, contain broken or risky cryptographic algorithm.

    CriticalCVSS 9.8No exploitEPSS 0%

    dell · powerscale onefsJun 28, 2022

  • CVE-2021-22738
    39Monitor

    Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior that could c

    CriticalCVSS 9.8No exploitEPSS 0%

    schneider-electric · spacelynk firmwareMay 26, 2021

  • CVE-2024-31510
    39Monitor

    An issue in Open Quantum Safe liboqs v.10.0 allows a remote attacker to escalate privileges via the crypto_sign_signature parameter in the /

    CriticalCVSS 9.8No exploitEPSS 0%

    openquantumsafe · liboqsMay 24, 2024

  • CVE-2020-10377
    39Monitor

    A weak encryption vulnerability in Mitel MiVoice Connect Client before 214.100.1214.0 could allow an unauthenticated attacker to gain access

    CriticalCVSS 9.8No exploitEPSS 0%

    mitel · mivoice connect clientApr 17, 2020

All vulnerability classes