CWE-322 Key Exchange without Entity Authentication
baseThe product performs a key exchange with an actor without verifying the identity of that actor.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (57)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-1709US | critical9.8OT erhöht | — | ||
A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vul… | ||||
| CVE-2014-2881US | high10.0 | — | ||
Unspecified vulnerability in the Diffie-Hellman key agreement implementation in the management GUI Java applet in Citrix NetScaler Application Delivery Controller (ADC) and NetScal… | ||||
| CVE-2026-33697US | medium6.3 | Exploit | ||
Cocos AI is a confidential computing system for AI. The current implementation of attested TLS (aTLS) in CoCoS is vulnerable to a relay attack affecting all versions from v0.4.0 th… | ||||
| CVE-2017-13082US | high8.1OT erhöht | — | ||
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT) h… | ||||
| CVE-2026-58065US | high8.1 | — | ||
The Apache Airflow Git provider runs its git-over-SSH operations with `StrictHostKeyChecking=no` by default, disabling SSH host-key verification. An attacker who can intercept the… | ||||
| CVE-2025-13914US | high8.1 | — | ||
A Key Exchange without Entity Authentication vulnerability in the SSH implementation of Juniper Networks Apstra allows a unauthenticated, MITM
attacker to impersonate managed dev… | ||||
| CVE-2025-62501US | high8.1 | — | ||
SSH Hostkey misconfiguration vulnerability in Archer AX53 and Archer BE3600 (tmpserver modules) allows attackers to obtain device credentials through a specially crafted man‑in‑the… | ||||
| CVE-2022-36881US | high8.1 | — | ||
Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks. | ||||
| CVE-2022-39252US | high7.5 | — | ||
matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prior to version 0.6, when a user requests a… | ||||
| CVE-2022-39250US | high7.5 | — | ||
Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could… | ||||
| CVE-2022-39257US | high7.5 | — | ||
Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages appe… | ||||
| CVE-2022-39255US | high7.5 | — | ||
Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages that… | ||||
| CVE-2022-39251US | high7.5 | — | ||
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legit… | ||||
| CVE-2022-39249US | high7.5 | — | ||
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages appearing… | ||||
| CVE-2022-39248US | high7.5 | — | ||
matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to ha… | ||||
| CVE-2021-34433US | high7.5 | — | ||
In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally succeeds without verifying the server side… | ||||
| CVE-2024-47519US | high7.1 | — | ||
Backup uploads to ETM subject to man-in-the-middle interception | ||||
| CVE-2024-7516US | high7.1OT erhöht | — | ||
A vulnerability in Brocade Fabric OS versions before 9.2.2 could allow man-in-the-middle attackers to conduct remote Service Session Hijacking that may arise from the attacker's ab… | ||||
| CVE-2017-13086US | medium6.8OT erhöht | — | ||
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshake, allowing an attacker within radio ran… | ||||
| CVE-2017-13084US | medium6.8OT erhöht | — | ||
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Station-To-Station-Link (STSL) Transient Key (STK) during the PeerKey handshake, allowing an attacker within radi… | ||||
03
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan