WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-327✕
Overview 740 matches · 41 in Waratek scope · 4 protected · 2 exploited · 0 CISA KEV · 13 public PoC · 4 EPSS ≥ 0.5
740matches 41in Waratek scope5.5% 4protected0.5% 2exploited0.3% 0CISA KEV0.0% 13public PoC1.8% 4EPSS ≥ 0.50.5%
Protected by Waratek 4 0.5% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 37 5.0% Outside Waratek scope 10 1.4% Not applicable 689 93.1% Withdrawn CVE 0 0.0%
Critical 92 12.4% High 343 46.4% Medium 252 34.1% Low 53 7.2% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 4 0.5% partly blocked 0 0.0% not blocked 736 99.5% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 0.3% Working exploit published 9 1.2% Proof of concept only 58 7.8% Forecast only 2 0.3% No public exploit 669 90.4%
split by peak 144 / year
Not applicable: 689Outside Waratek scope: 10No exploit published: 37Protected by Waratek: 4 Low: 53Medium: 252High: 343Critical: 92 not blocked: 736blocked by ARMR today: 4 No public exploit: 669Forecast only: 2Proof of concept only: 58Working exploit published: 9Exploited: 2
19981 Not applicable1 Medium1 not blocked1 No public exploit1 19990 20000 20010 20021 Not applicable1 High1 not blocked1 No public exploit1 20030 20040 20052 Not applicable2 High2 not blocked2 No public exploit2 20060 20073 Not applicable3 Critical1 High1 Medium1 not blocked3 No public exploit3 20082 Not applicable2 High1 Medium1 not blocked2 No public exploit2 20091 Not applicable1 Medium1 not blocked1 No public exploit1 20100 20110 20120 20132 Outside Waratek scope1 Not applicable1 Medium2 not blocked2 Forecast only1 No public exploit1 20140 20153 Outside Waratek scope1 Not applicable2 High2 Low1 not blocked3 Forecast only1 No public exploit2 20162 Not applicable2 High1 Medium1 not blocked2 No public exploit2 201727 Protected by Waratek1 No exploit published1 Not applicable25 Critical9 High11 Medium7 blocked by ARMR today1 not blocked26 Working exploit published2 No public exploit25 201834 No exploit published2 Outside Waratek scope2 Not applicable30 Critical1 High11 Medium22 not blocked34 Exploited1 Proof of concept only1 No public exploit32 201954 Protected by Waratek1 No exploit published3 Not applicable50 Critical8 High21 Medium24 Low1 blocked by ARMR today1 not blocked53 Working exploit published1 Proof of concept only1 No public exploit52 202086 Protected by Waratek1 No exploit published4 Not applicable81 Critical9 High52 Medium23 Low2 blocked by ARMR today1 not blocked85 Working exploit published1 No public exploit85 202182 No exploit published1 Outside Waratek scope4 Not applicable77 Critical6 High41 Medium28 Low7 not blocked82 Proof of concept only1 No public exploit81 202263 Protected by Waratek1 No exploit published3 Outside Waratek scope1 Not applicable58 Critical8 High30 Medium25 blocked by ARMR today1 not blocked62 Working exploit published2 Proof of concept only3 No public exploit58 202365 No exploit published4 Not applicable61 Critical7 High41 Medium17 not blocked65 Working exploit published1 Proof of concept only1 No public exploit63 202479 No exploit published5 Not applicable74 Critical13 High36 Medium28 Low2 not blocked79 Working exploit published1 Proof of concept only9 No public exploit69 202589 No exploit published3 Not applicable86 Critical7 High40 Medium32 Low10 not blocked89 Exploited1 Working exploit published1 Proof of concept only14 No public exploit73 2026144 No exploit published11 Outside Waratek scope1 Not applicable132 Critical23 High52 Medium39 Low30 not blocked144 Proof of concept only28 No public exploit116
1999200220052008201120142017202020232026
740 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 3 of 8 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2025-48946 Low 2025-05-30 Not applicable No public exploit liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. liboqs prior to version 0.13.0 supports the HQC algorithm, an algorithm with a theoretical design flaw which leads to large numbers of malformed ciphertexts sharing the same implicit rejection value. Currently, no concrete attack on the algorithm is known. However, prospective users of HQC must take extra care when using the algorithm in protocols involving key derivation. In particular, HQC does not provide the same security guarantees as Kyber or ML-KEM. There is currently no patch for the HQC flaw available in liboqs, so HQC is disabled by default in liboqs starting from version 0.13.0. OQS will update its implementation after the HQC team releases an updated algorithm specification.
CVE-2025-3938 Critical 2025-05-22 Not applicable No public exploit Missing Cryptographic Step vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
CVE-2025-24007 High 2025-05-13 Not applicable No public exploit A vulnerability has been identified in SIRIUS 3RK3 Modular Safety System (MSS) (All versions), SIRIUS Safety Relays 3SK2 (All versions). Affected devices only provide weak password obfuscation. An attacker with network access could retrieve and de-obfuscate the safety password used for protection against inadvertent operating errors.
CVE-2025-2545 Low 2025-05-05 Not applicable No public exploit Vulnerability in Best Practical Solutions, LLC's Request Tracker prior to v5.0.8, where the Triple DES (3DES) cryptographic algorithm is used to protect emails sent with S/MIME encryption. Triple DES is considered obsolete and insecure due to its susceptibility to birthday attacks, which could compromise the confidentiality of encrypted messages.
CVE-2024-55912 Medium 2025-05-02 Not applicable No public exploit IBM Concert Software 1.0.0 through 1.0.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVE-2025-3200 Critical 2025-04-28 Not applicable No public exploit An unauthenticated remote attacker could exploit the used, insecure TLS 1.0 and TLS 1.1 protocols to intercept and manipulate encrypted communications between the Com-Server and connected systems.
CVE-2024-30152 Critical 2025-04-25 Not applicable No public exploit HCL SX v21 is affected by usage of a weak cryptographic algorithm. An attacker could exploit this weakness to gain access to sensitive information, modify data, or other impacts.
CVE-2025-3838 Medium 2025-04-21 Not applicable No public exploit An Improper Authorization vulnerability was identified in the EOL OVA based connect component which is deployed for installation purposes in the customer internal network. Under certain conditions, this could allow a bad actor to gain unauthorized access to the local db containing weakly hashed credentials of the installer. This EOL component was deprecated in September 2023 with end of support extended till January 2024.
CVE-2024-22314 High 2025-04-16 Not applicable No public exploit IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.12 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVE-2022-43851 High 2025-04-14 Not applicable No public exploit IBM Aspera Console 3.4.0 through 3.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVE-2025-2920 Low 2025-03-28 Not applicable Proof of concept only A vulnerability was found in Netis WF-2404 1.1.124EN. It has been rated as problematic. This issue affects some unknown processing of the file /еtc/passwd. The manipulation leads to use of weak hash. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-31896 High 2025-03-25 Not applicable No public exploit IBM SPSS Statistics 26.0, 27.0.1, 28.0.1, and 29.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVE-2025-2539 High 2025-03-20 Not applicable Exploited The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers, leveraging the use of a reversible weak algorithm, to read the contents of arbitrary files on the server, which can contain sensitive information.
CVE-2025-26486 Medium 2025-03-19 Not applicable No public exploit Broken or Risky Cryptographic Algorithm, Use of Password Hash With Insufficient Computational Effort, Use of Weak Hash, Use of a One-Way Hash with a Predictable Salt vulnerabilities in Beta80 "Life 1st Identity Manager" enable an attacker with access to password hashes to bruteforce user passwords or find a collision to ultimately while attempting to gain access to a target application that uses "Life 1st Identity Manager" as a service for authentication. This issue affects Life 1st: 1.5.2.14234.
CVE-2024-45643 High 2025-03-14 Not applicable No public exploit IBM Security QRadar 3.12 EDR uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive credential information.
CVE-2025-26708 Medium 2025-03-07 Not applicable No public exploit There is a configuration defect vulnerability in ZTELink 5.4.9 for iOS. This vulnerability is caused by a flaw in the WiFi parameter configuration of the ZTELink. An attacker can obtain unauthorized access to the WiFi service.
CVE-2025-27508 High 2025-03-05 No exploit published Proof of concept only Emissary is a P2P based data-driven workflow engine. The ChecksumCalculator class within allows for hashing and checksum generation, but it includes or defaults to algorithms that are no longer recommended for secure cryptographic use cases (e.g., SHA-1, CRC32, and SSDEEP). These algorithms, while possibly valid for certain non-security-critical tasks, can expose users to security risks if used in scenarios where strong cryptographic guarantees are required. This issue is fixed in 8.24.0.
CVE-2024-28780 Medium 2025-02-19 Not applicable No public exploit IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 Rich Client  uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVE-2024-4282 High 2025-02-15 Not applicable No public exploit Brocade SANnav OVA before SANnav 2.3.1b enables SHA1 deprecated setting for SSH for port 22.
CVE-2024-10405 Medium 2025-02-15 Not applicable No public exploit Brocade SANnav before SANnav 2.3.1b enables weak TLS ciphers on ports 443 and 18082. In case of a successful exploit, an attacker can read Brocade SANnav data stream that includes monitored Brocade Fabric OS switches performance data, port status, zoning information, WWNs, IP Addresses, but no customer data, no personal data and no secrets or passwords, as it travels across the network.
CVE-2024-52884 High 2025-02-07 Not applicable Proof of concept only An issue was discovered in AudioCodes Mediant Session Border Controller (SBC) before 7.40A.501.841. Due to the use of weak password obfuscation/encryption, an attacker with access to configuration exports (INI) is able to decrypt the passwords.
CVE-2024-49797 Medium 2025-02-06 Not applicable No public exploit IBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
CVE-2025-22475 High 2025-02-04 Not applicable No public exploit Dell PowerProtect DD, versions prior to DDOS 8.3.0.0, 7.10.1.50, and 7.13.1.10 contains a use of a Cryptographic Primitive with a Risky Implementation vulnerability. A remote attacker could potentially exploit this vulnerability, leading to Information tampering.
CVE-2022-3365 Critical 2025-01-28 Not applicable Working exploit published Due to reliance on a trivial substitution cipher, sent in cleartext, and the reliance on a default password when the user does not set a password, the Remote Mouse Server by Emote Interactive can be abused by attackers to inject OS commands over theproduct's custom control protocol. A Metasploit module was written and tested against version 4.110, the current version when this CVE was reserved.
CVE-2024-38320 High 2025-01-27 Not applicable No public exploit IBM Storage Protect for Virtual Environments: Data Protection for VMware and Storage Protect Backup-Archive Client 8.1.0.0 through 8.1.23.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVE-2024-27256 High 2025-01-27 Not applicable No public exploit IBM MQ Container 3.0.0, 3.0.1, 3.1.0 through 3.1.3 CD, 2.0.0 LTS through 2.0.22 LTS and 2.4.0 through 2.4.8, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVE-2024-26317 Medium 2025-01-27 Not applicable No public exploit In illumos illumos-gate 2024-02-15, an error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates, causing the algorithm to yield a result of POINT_AT_INFINITY when it should not. A man-in-the-middle attacker could use this to interfere with a connection, resulting in an attacked party computing an incorrect shared secret.
CVE-2024-52331 High 2025-01-23 Not applicable Proof of concept only ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot.
CVE-2024-22347 High 2025-01-20 Not applicable No public exploit IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVE-2024-8603 High 2025-01-15 Not applicable No public exploit A “Use of a Broken or Risky Cryptographic Algorithm” vulnerability in the SSL/TLS component used in B&R Automation Runtime versions before 6.1 and B&R mapp View versions before 6.1 may be abused by unauthenticated network-based attackers to masquerade as services on impacted devices.
CVE-2024-51456 Medium 2025-01-12 Not applicable No public exploit IBM Robotic Process Automation 21.0.0 through 21.0.7.19 and 23.0.0 through 23.0.19 could allow a remote attacker to obtain sensitive data that may be exposed through certain crypto-analytic attacks.
CVE-2024-52366 Medium 2025-01-07 Not applicable No public exploit IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
CVE-2024-41763 High 2025-01-04 Not applicable No public exploit IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVE-2024-47921 High 2024-12-30 Not applicable No public exploit Smadar SPS – CWE-327: Use of a Broken or Risky Cryptographic Algorithm
CVE-2024-55539 Low 2024-12-23 Not applicable No public exploit Weak algorithm used to sign RPM package. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux) before build 39185, Acronis Cyber Protect 16 (Linux) before build 39938.
CVE-2024-28980 Critical 2024-12-13 Not applicable No public exploit Dell RecoverPoint for VMs, version(s) 6.0.x contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the SSH. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
CVE-2024-55885 Medium 2024-12-12 Not applicable No public exploit beego is an open-source web framework for the Go programming language. Versions of beego prior to 2.3.4 use MD5 as a hashing algorithm. MD5 is no longer considered secure against well-funded opponents due to its vulnerability to collision attacks. Version 2.3.4 replaces MD5 with SHA256.
CVE-2024-53845 Medium 2024-12-12 Not applicable No public exploit ESPTouch is a connection protocol for internet of things devices. In the ESPTouchV2 protocol, while there is an option to use a custom AES key, there is no option to set the IV (Initialization Vector) prior to versions 5.3.2, 5.2.4, 5.1.6, and 5.0.8. The IV is set to zero and remains constant throughout the product's lifetime. In AES/CBC mode, if the IV is not properly initialized, the encrypted output becomes deterministic, leading to potential data leakage. To address the aforementioned issues, the application generates a random IV when activating the AES key starting in versions 5.3.2, 5.2.4, 5.1.6, and 5.0.8. This IV is then transmitted along with the provision data to the provision device. The provision device has also been equipped with a parser for the AES IV. The upgrade is applicable for all applications and users of ESPTouch v2 component from ESP-IDF. As it is implemented in the ESP Wi-Fi stack, there is no workaround for the user to fix the application layer without upgrading the underlying firmware.
CVE-2023-37395 Low 2024-12-11 Not applicable No public exploit IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain sensitive information due to improper encryption of certain data.
CVE-2024-53441 Critical 2024-12-09 Not applicable Proof of concept only An issue in the index.js decryptCookie function of cookie-encrypter v1.0.1 allows attackers to execute a bit flipping attack.
CVE-2024-48847 High 2024-12-05 Not applicable No public exploit MD5 Checksum Bypass vulnerabilities where found exploiting a weakness in the way an application dependency calculates or validates MD5 checksum hashes.  Affected products: ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01; MATRIX Series v3.08.01
CVE-2024-41775 High 2024-12-03 Not applicable No public exploit IBM Cognos Controller 11.0.0 and 11.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVE-2024-52801 Medium 2024-11-29 Not applicable No public exploit sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The OpenID Connect implementation allows authenticated users to brute force session cookies and thereby gain access to other users' data, since the cookies are generated predictably using the xid library and are therefore unique but not cryptographically secure. This issue was fixed in version v2.6.4, where cookies are opaque and cryptographically secure strings. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2022-43934 High 2024-11-21 Not applicable No public exploit Brocade SANnav before Brocade SANnav 2.2.2 supports key exchange algorithms, which are considered weak on ports 24, 6514, 18023, 19094, and 19095.
CVE-2024-43189 Medium 2024-11-15 Not applicable No public exploit IBM Concert Software 1.0.0 through 1.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
CVE-2020-11916 Medium 2024-11-07 Not applicable No public exploit An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. The password for the root user is hashed using an old and deprecated hashing technique. Because of this deprecated hashing, the success probability of an attacker in an offline cracking attack is greatly increased.
CVE-2024-51556 High 2024-11-04 Not applicable No public exploit This vulnerability exists in the Wave 2.0 due to insufficient encryption of sensitive data received at the API response. An authenticated remote attacker could exploit this vulnerability by manipulating API input parameters through API request URL/payload leading to unauthorized access to sensitive information belonging to other users.
CVE-2024-51478 Critical 2024-10-31 Not applicable Proof of concept only YesWiki is a wiki system written in PHP. Prior to 4.4.5, the use of a weak cryptographic algorithm and a hard-coded salt to hash the password reset key allows it to be recovered and used to reset the password of any account. This issue is fixed in 4.4.5.
CVE-2024-48016 High 2024-10-18 Not applicable No public exploit Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.24, contains a Use of a Broken or Risky Cryptographic Algorithm vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information disclosure. The attacker may be able to use exposed credentials to access the system with privileges of the compromised account.
CVE-2024-10128 Medium 2024-10-18 Not applicable Proof of concept only A vulnerability was found in Topdata Inner Rep Plus WebServer 2.01. It has been rated as problematic. Affected by this issue is some unknown functionality of the file td.js.gz. The manipulation leads to risky cryptographic algorithm. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-47188 High 2024-10-16 Not applicable No public exploit Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initialization of the random seed for "thash" leads to byte-range tracking having predictable hash table behavior. This can lead to an attacker forcing lots of data into a single hash bucket, leading to severe performance degradation. This issue has been addressed in 7.0.7.
CVE-2024-47187 High 2024-10-16 Not applicable No public exploit Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initialization of the random seed for "thash" leads to datasets having predictable hash table behavior. This can lead to dataset file loading to use excessive time to load, as well as runtime performance issues during traffic handling. This issue has been addressed in 7.0.7. As a workaround, avoid loading datasets from untrusted sources. Avoid dataset rules that track traffic in rules.
CVE-2024-8452 High 2024-09-30 Not applicable No public exploit Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNMPv3 service, allowing attackers to obtain plaintext SNMPv3 credentials potentially.
CVE-2024-39583 Critical 2024-09-10 Not applicable No public exploit Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains a Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
CVE-2024-37068 High 2024-09-07 Not applicable No public exploit IBM Maximo Application Suite - Manage Component 8.10, 8.11, and 9.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information using man in the middle techniques.
CVE-2024-45394 High 2024-09-03 Not applicable No public exploit Authenticator is a browser extension that generates two-step verification codes. In versions 7.0.0 and below, encryption keys for user data were stored encrypted at-rest using only AES-256 and the EVP_BytesToKey KDF. Therefore, attackers with a copy of a user's data are able to brute-force the user's encryption key. Users on version 8.0.0 and above are automatically migrated away from the weak encoding on first login. Users should destroy encrypted backups made with versions prior to 8.0.0.
CVE-2024-45193 Medium 2024-08-22 Not applicable No public exploit An issue was discovered in Matrix libolm through 3.2.16. There is Ed25519 signature malleability due to lack of validation criteria (does not ensure that S < n). This refers to the libolm implementation of Olm. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2024-39745 High 2024-08-22 Not applicable No public exploit IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVE-2024-36440 Medium 2024-08-22 Not applicable No public exploit An issue was discovered on Swissphone DiCal-RED 4009 devices. An attacker with access to the file /etc/deviceconfig may recover the administrative device password via password-cracking methods, because unsalted MD5 is used.
CVE-2024-41270 Critical 2024-08-06 Not applicable No public exploit An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecated TLS version.
CVE-2024-28972 High 2024-08-01 Not applicable No public exploit Dell InsightIQ, Verion 5.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure.
CVE-2024-40465 High 2024-07-31 Not applicable No public exploit An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go file
CVE-2024-39731 High 2024-07-15 Not applicable No public exploit IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 295970.
CVE-2024-30098 High 2024-07-09 Not applicable No public exploit Windows Cryptographic Services Security Feature Bypass Vulnerability
CVE-2024-32852 High 2024-07-02 Not applicable No public exploit Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.0 contain use of a broken or risky cryptographic algorithm vulnerability. An unprivileged network malicious attacker could potentially exploit this vulnerability, leading to data leaks.
CVE-2023-41928 Medium 2024-07-02 Not applicable No public exploit The device is observed to accept deprecated TLS protocols, increasing the risk of cryptographic weaknesses.
CVE-2023-41927 Medium 2024-07-02 Not applicable No public exploit The server supports at least one cipher suite which is on the NCSC-NL list of cipher suites to be phased out, increasing the risk of cryptographic weaknesses.
CVE-2024-37137 Medium 2024-06-28 Not applicable No public exploit Dell Key Trust Platform, v3.0.6 and prior, contains Use of a Cryptographic Primitive with a Risky Implementation vulnerability. A local privileged attacker could potentially exploit this vulnerability, leading to privileged information disclosure.
CVE-2023-38371 High 2024-06-27 Not applicable No public exploit IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 261198.
CVE-2024-29175 Medium 2024-06-26 Not applicable No public exploit Dell PowerProtect Data Domain, versions prior to 7.13.0.0, LTS 7.7.5.40, LTS 7.10.1.30 contain an weak cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to man-in-the-middle attack that exposes sensitive session information.
CVE-2024-3264 Medium 2024-06-24 Not applicable No public exploit Use of a Broken or Risky Cryptographic Algorithm vulnerability in Mia Technology Inc. Mia-Med Health Aplication allows Signature Spoofing by Improper Validation. This issue affects Mia-Med Health Aplication: before 1.0.14.
CVE-2024-35537 High 2024-06-21 Not applicable No public exploit TVS Motor Company Limited TVS Connect Android v4.6.0 and IOS v5.0.0 was discovered to insecurely handle the RSA key pair, allowing attackers to possibly access sensitive information via decryption.
CVE-2024-32911 Critical 2024-06-13 Not applicable No public exploit There is a possible escalation of privilege due to improperly used crypto. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2024-5559 Medium 2024-06-12 Not applicable No public exploit CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists that could cause denial of service, device reboot, or an attacker gaining full control of the relay when a specially crafted reset token is entered into the front panel of the device.
CVE-2024-36823 High 2024-06-06 No exploit published No public exploit The encrypt() function of Ninja Core v7.0.0 was discovered to use a weak cryptographic algorithm, leading to a possible leakage of sensitive information.
CVE-2024-20070 Medium 2024-06-03 Not applicable No public exploit In modem, there is a possible information disclosure due to using risky cryptographic algorithm during connection establishment negotiation. This could lead to remote information disclosure, when weak encryption algorithm is used, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00942482; Issue ID: MSV-1469.
CVE-2024-31510 Critical 2024-05-24 Not applicable No public exploit An issue in Open Quantum Safe liboqs v.10.0 allows a remote attacker to escalate privileges via the crypto_sign_signature parameter in the /pqcrystals-dilithium-standard_ml-dsa-44-ipd_avx2/sign.c component.
CVE-2024-22588 Medium 2024-05-24 No exploit published Proof of concept only Kwik commit 745fd4e2 does not discard unused encryption keys.
CVE-2024-4563 High 2024-05-22 Not applicable No public exploit The Progress MOVEit Automation configuration export function prior to 2024.0.0 uses a cryptographic method with insufficient bit length.
CVE-2024-31989 Critical 2024-05-21 Not applicable Proof of concept only Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It has been discovered that an unprivileged pod in a different namespace on the same cluster could connect to the Redis server on port 6379. Despite having installed the latest version of the VPC CNI plugin on the EKS cluster, it requires manual enablement through configuration to enforce network policies. This raises concerns that many clients might unknowingly have open access to their Redis servers. This vulnerability could lead to Privilege Escalation to the level of cluster controller, or to information leakage, affecting anyone who does not have strict access controls on their Redis instance. This issue has been patched in version(s) 2.8.19, 2.9.15 and 2.10.10.
CVE-2024-4765 High 2024-05-14 Not applicable No public exploit Web application manifests were stored by using an insecure MD5 hash which allowed for a hash collision to overwrite another application's manifest. This could have been exploited to run arbitrary code in another application's context. *This issue only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 126.
CVE-2024-25968 High 2024-05-14 Not applicable No public exploit Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure.
CVE-2023-40696 High 2024-05-03 Not applicable No public exploit IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 264939.
CVE-2020-4874 High 2024-05-03 Not applicable No public exploit IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 190837.
CVE-2024-33663 Medium 2024-04-26 Not applicable Proof of concept only python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.
CVE-2023-37396 Medium 2024-04-19 Not applicable No public exploit IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain sensitive information due to improper encryption of certain data. IBM X-Force ID: 259671.
CVE-2024-29056 Medium 2024-04-09 Not applicable No public exploit Windows Authentication Elevation of Privilege Vulnerability
CVE-2023-50313 Medium 2024-04-02 No exploit published No public exploit IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configuration. IBM X-Force ID: 274812.
CVE-2024-31033 Medium 2024-04-01 No exploit published Proof of concept only JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey() method within the DefaultJwtParser class and the signWith() method within the DefaultJwtBuilder class. NOTE: the vendor disputes this because the "ignores" behavior cannot occur (in any version) unless there is a user error in how JJWT is used, and because the version that was actually tested must have been more than six years out of date.
CVE-2024-25963 High 2024-03-28 Not applicable No public exploit Dell PowerScale OneFS, versions 8.2.2.x through 9.5.0.x contains a use of a broken cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure.
CVE-2024-28834 Medium 2024-03-21 Not applicable No public exploit A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.
CVE-2024-22463 Critical 2024-03-04 Not applicable No public exploit Dell PowerScale OneFS 8.2.x through 9.6.0.x contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unprivileged attacker could potentially exploit this vulnerability, leading to compromise of confidentiality and integrity of sensitive information
CVE-2024-27255 High 2024-03-03 Not applicable No public exploit IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 283905.
CVE-2024-22458 Medium 2024-03-01 Not applicable No public exploit Dell Secure Connect Gateway, 5.18, contains an Inadequate Encryption Strength Vulnerability. An unauthenticated network attacker could potentially exploit this vulnerability, allowing an attacker to recover plaintext from a block of ciphertext.
CVE-2023-50312 Medium 2024-03-01 No exploit published No public exploit IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.2 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configuration. IBM X-Force ID: 274711.
CVE-2023-51392 Critical 2024-02-23 Not applicable No public exploit Ember ZNet between v7.2.0 and v7.4.0 used software AES-CCM instead of integrated hardware cryptographic accelerators, potentially increasing risk of electromagnetic and differential power analysis sidechannel attacks.
CVE-2022-34310 High 2024-02-12 Not applicable No public exploit IBM CICS TX Standard and Advanced 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 229441.
CVE-2022-34309 High 2024-02-12 Not applicable No public exploit IBM CICS TX Standard and Advanced 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 229440.
CVE-2024-22361 High 2024-02-10 Not applicable No public exploit IBM Semeru Runtime 8.0.302.0 through 8.0.392.0, 11.0.12.0 through 11.0.21.0, 17.0.1.0 - 17.0.9.0, and 21.0.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 281222.
CVE-2024-22318 Medium 2024-02-09 Not applicable Working exploit published IBM i Access Client Solutions (ACS) 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.4 is vulnerable to NT LAN Manager (NTLM) hash disclosure by an attacker modifying UNC capable paths within ACS configuration files to point to a hostile server. If NTLM is enabled, the Windows operating system will try to authenticate using the current user's session. The hostile server could capture the NTLM hash information to obtain the user's credentials. IBM X-Force ID: 279091.
‹ prev page 3 of 8 next ›