CWE-326 Inadequate Encryption Strength
classThe product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (696)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-18325US | high7.5OT critical | KEV | ||
DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811. | ||||
| CVE-2018-15811US | high7.5OT critical | KEV | ||
DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters. | ||||
| CVE-2017-1000486US | critical9.8OT critical | KEV | ||
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution | ||||
| CVE-2017-11317US | critical9.8OT critical | KEV | ||
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitr… | ||||
| CVE-2016-2183US | high7.5OT high | Exploit | ||
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which mak… | ||||
| CVE-2014-0224US | high7.4 | Exploit | ||
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to… | ||||
| CVE-2013-2566US | medium5.9OT high | Exploit | ||
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via s… | ||||
| CVE-2016-0800US | medium5.9 | Exploit | ||
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client… | ||||
| CVE-2020-9315US | high7.5OT high | — | ||
** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web Server 7.0.x has Incorrect Access Control for admingui/version URIs in the Administration console, as demonstrated by u… | ||||
| CVE-2011-3389US | medium4.3OT high | Exploit | ||
The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data b… | ||||
| CVE-2000-0300US | high10.0 | Exploit | ||
The default encryption method of PcAnywhere 9.x uses weak encryption, which allows remote attackers to sniff and decrypt PcAnywhere or NT domain accounts. | ||||
| CVE-2000-0449US | high10.0OT high | Exploit | ||
Omnis Studio 2.4 uses weak encryption (trivial encoding) for encrypting database fields. | ||||
| CVE-2000-0244US | high10.0 | Exploit | ||
The Citrix ICA (Independent Computing Architecture) protocol uses weak encryption (XOR) for user authentication. | ||||
| CVE-1999-0944US | high10.0 | Exploit | ||
IBM WebSphere ikeyman tool uses weak encryption to store a password for a key database that is used for SSL connections. | ||||
| CVE-2017-14262US | high8.1 | Exploit | ||
On Samsung NVR devices, remote attackers can read the MD5 password hash of the 'admin' account via certain szUserName JSON data to cgi-bin/main-cgi, and login to the device with th… | ||||
| CVE-2003-0270US | high7.6 | Exploit | ||
The administration capability for Apple AirPort 802.11 wireless access point devices uses weak encryption (XOR with a fixed key) for protecting authentication credentials, which co… | ||||
| CVE-2002-1656US | high7.5 | Exploit | ||
X-News (x_news) 1.1 and earlier allows attackers to authenticate as other users by obtaining the MD5 checksum of the password, e.g. via sniffing or the users.txt data file, and pro… | ||||
| CVE-2022-4304US | medium5.9 | Exploit | ||
A timing based side channel exists in the OpenSSL RSA Decryption implementation
which could be sufficient to recover a plaintext across a network in a
Bleichenbacher style attack.… | ||||
| CVE-2022-35513US | high7.5OT elevated | Exploit | ||
The Blink1Control2 application <= 2.2.7 uses weak password encryption and an insecure method of storage. | ||||
| CVE-2006-4950US | high10.0OT elevated | — | ||
Cisco IOS 12.2 through 12.4 before 20060920, as used by Cisco IAD2430, IAD2431, and IAD2432 Integrated Access Devices, the VG224 Analog Phone Gateway, and the MWR 1900 and 1941 Mob… | ||||
04
attack patterns (3)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan