CWE-326
Allowed-with-ReviewInadequate Encryption Strength
Abstraction: Class · Status: Draft
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
654 vulnerabilities reference this CWE, most recent first.
GHSA-X9WR-745J-RM5J
Vulnerability from github – Published: 2024-08-28 09:30 – Updated: 2024-09-12 18:31Insufficient or weak TLS protocol version identified in Advance authentication client server communication when specific service is accessed between devices. This issue affects NetIQ Advance Authentication versions before 6.3.5.1
{
"affected": [],
"aliases": [
"CVE-2021-38121"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-28T07:15:07Z",
"severity": "HIGH"
},
"details": "Insufficient or weak TLS protocol version identified in Advance authentication client server communication when specific service is accessed between devices.\u00a0 This issue affects NetIQ Advance Authentication versions before 6.3.5.1",
"id": "GHSA-x9wr-745j-rm5j",
"modified": "2024-09-12T18:31:39Z",
"published": "2024-08-28T09:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38121"
},
{
"type": "WEB",
"url": "https://www.netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6351/data/advanced-authentication-releasenotes-6351.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-XC56-2WGW-3623
Vulnerability from github – Published: 2022-04-30 18:22 – Updated: 2024-02-14 18:30Click2Learn Ingenium Learning Management System 5.1 and 6.1 uses weak encryption for passwords (reversible algorithm), which allows attackers to obtain passwords.
{
"affected": [],
"aliases": [
"CVE-2002-1910"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2002-12-31T05:00:00Z",
"severity": "MODERATE"
},
"details": "Click2Learn Ingenium Learning Management System 5.1 and 6.1 uses weak encryption for passwords (reversible algorithm), which allows attackers to obtain passwords.",
"id": "GHSA-xc56-2wgw-3623",
"modified": "2024-02-14T18:30:23Z",
"published": "2022-04-30T18:22:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1910"
},
{
"type": "WEB",
"url": "http://online.securityfocus.com/archive/1/295309"
},
{
"type": "WEB",
"url": "http://www.iss.net/security_center/static/10389.php"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/5970"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XFJ2-8V99-WP6X
Vulnerability from github – Published: 2022-05-24 17:16 – Updated: 2024-04-04 02:50A missing secure communication definition and an incomplete TLS validation in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, < 4.3.11SP, < 4.4.9SP, < 4.5.5SP, < 4.6.4 and < 4.7.2 enable unauthenticated users to perform MITM attacks via the B&R upgrade server.
{
"affected": [],
"aliases": [
"CVE-2019-19101"
],
"database_specific": {
"cwe_ids": [
"CWE-295",
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-04-29T03:15:00Z",
"severity": "MODERATE"
},
"details": "A missing secure communication definition and an incomplete TLS validation in the upgrade service in B\u0026R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, \u003c 4.3.11SP, \u003c 4.4.9SP, \u003c 4.5.5SP, \u003c 4.6.4 and \u003c 4.7.2 enable unauthenticated users to perform MITM attacks via the B\u0026R upgrade server.",
"id": "GHSA-xfj2-8v99-wp6x",
"modified": "2024-04-04T02:50:24Z",
"published": "2022-05-24T17:16:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19101"
},
{
"type": "WEB",
"url": "https://www.br-automation.com/en/downloads/032020-multiple-vulnerabilities-in-automation-studio"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XFM3-5PRM-P3XQ
Vulnerability from github – Published: 2022-05-24 16:45 – Updated: 2024-04-04 00:24IBM Rational Engineering Lifecycle Manager 6.0 through 6.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 143798.
{
"affected": [],
"aliases": [
"CVE-2018-1608"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-05-01T16:29:00Z",
"severity": "HIGH"
},
"details": "IBM Rational Engineering Lifecycle Manager 6.0 through 6.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 143798.",
"id": "GHSA-xfm3-5prm-p3xq",
"modified": "2024-04-04T00:24:37Z",
"published": "2022-05-24T16:45:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1608"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/143798"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10882778"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/108290"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XFXC-48QF-J4G6
Vulnerability from github – Published: 2023-12-05 00:31 – Updated: 2023-12-08 18:30Weak encryption mechanisms in RFID Tags in Yale Conexis L1 v1.1.0 allows attackers to create a cloned tag via physical proximity to the original.
{
"affected": [],
"aliases": [
"CVE-2023-26941"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-05T00:15:08Z",
"severity": "MODERATE"
},
"details": "Weak encryption mechanisms in RFID Tags in Yale Conexis L1 v1.1.0 allows attackers to create a cloned tag via physical proximity to the original.",
"id": "GHSA-xfxc-48qf-j4g6",
"modified": "2023-12-08T18:30:41Z",
"published": "2023-12-05T00:31:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26941"
},
{
"type": "WEB",
"url": "https://arxiv.org/abs/2312.00021"
},
{
"type": "WEB",
"url": "https://www.researchgate.net/publication/375759408_Technical_Report_-_CVE-2022-46480_CVE-2023-26941_CVE-2023-26942_and_CVE-2023-26943#fullTextFileContent"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XG5W-J24M-8379
Vulnerability from github – Published: 2023-01-06 00:30 – Updated: 2023-01-12 18:30DES cipher, which has inadequate encryption strength, is used Hitachi Energy FOXMAN-UN to encrypt user credentials used to access the Network Elements. Successful exploitation allows sensitive information to be decrypted easily. This issue affects * FOXMAN-UN product: FOXMAN-UN R16A, FOXMAN-UN R15B, FOXMAN-UN R15A, FOXMAN-UN R14B, FOXMAN-UN R14A, FOXMAN-UN R11B, FOXMAN-UN R11A, FOXMAN-UN R10C, FOXMAN-UN R9C; * UNEM product: UNEM R16A, UNEM R15B, UNEM R15A, UNEM R14B, UNEM R14A, UNEM R11B, UNEM R11A, UNEM R10C, UNEM R9C. List of CPEs: * cpe:2.3:a:hitachienergy:foxman-un:R16A::::::: * cpe:2.3:a:hitachienergy:foxman-un:R15B::::::: * cpe:2.3:a:hitachienergy:foxman-un:R15A::::::: * cpe:2.3:a:hitachienergy:foxman-un:R14B::::::: * cpe:2.3:a:hitachienergy:foxman-un:R14A::::::: * cpe:2.3:a:hitachienergy:foxman-un:R11B::::::: * cpe:2.3:a:hitachienergy:foxman-un:R11A::::::: * cpe:2.3:a:hitachienergy:foxman-un:R10C::::::: * cpe:2.3:a:hitachienergy:foxman-un:R9C::::::: * cpe:2.3:a:hitachienergy:unem:R16A::::::: * cpe:2.3:a:hitachienergy:unem:R15B::::::: * cpe:2.3:a:hitachienergy:unem:R15A::::::: * cpe:2.3:a:hitachienergy:unem:R14B::::::: * cpe:2.3:a:hitachienergy:unem:R14A::::::: * cpe:2.3:a:hitachienergy:unem:R11B::::::: * cpe:2.3:a:hitachienergy:unem:R11A::::::: * cpe:2.3:a:hitachienergy:unem:R10C::::::: * cpe:2.3:a:hitachienergy:unem:R9C:::::::
{
"affected": [],
"aliases": [
"CVE-2021-40341"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-05T22:15:00Z",
"severity": "MODERATE"
},
"details": "DES cipher, which has inadequate encryption strength, is used Hitachi Energy FOXMAN-UN to encrypt user credentials used to access the Network Elements. Successful exploitation allows sensitive information to be decrypted easily. This issue affects * FOXMAN-UN product: FOXMAN-UN R16A, FOXMAN-UN R15B, FOXMAN-UN R15A, FOXMAN-UN R14B, FOXMAN-UN R14A, FOXMAN-UN R11B, FOXMAN-UN R11A, FOXMAN-UN R10C, FOXMAN-UN R9C; * UNEM product: UNEM R16A, UNEM R15B, UNEM R15A, UNEM R14B, UNEM R14A, UNEM R11B, UNEM R11A, UNEM R10C, UNEM R9C. List of CPEs: * cpe:2.3:a:hitachienergy:foxman-un:R16A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R15B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R15A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R14B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R14A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R11B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R11A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R10C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R9C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R16A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R15B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R15A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R14B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R14A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R11B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R11A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R10C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R9C:*:*:*:*:*:*:*",
"id": "GHSA-xg5w-j24m-8379",
"modified": "2023-01-12T18:30:29Z",
"published": "2023-01-06T00:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40341"
},
{
"type": "WEB",
"url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000083\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"type": "WEB",
"url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000084\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XJ59-9QJV-FR54
Vulnerability from github – Published: 2022-05-01 02:31 – Updated: 2025-04-12 13:05SHA-1 is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of SHA-1 in TLS 1.2. NOTE: this CVE exists to provide a common identifier for referencing this SHA-1 issue; the existence of an identifier is not, by itself, a technology recommendation.
{
"affected": [],
"aliases": [
"CVE-2005-4900"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-10-14T16:59:00Z",
"severity": "MODERATE"
},
"details": "SHA-1 is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of SHA-1 in TLS 1.2. NOTE: this CVE exists to provide a common identifier for referencing this SHA-1 issue; the existence of an identifier is not, by itself, a technology recommendation.",
"id": "GHSA-xj59-9qjv-fr54",
"modified": "2025-04-12T13:05:40Z",
"published": "2022-05-01T02:31:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-4900"
},
{
"type": "WEB",
"url": "https://arstechnica.com/security/2017/02/at-deaths-door-for-years-widely-used-sha1-function-is-now-dead"
},
{
"type": "WEB",
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10340"
},
{
"type": "WEB",
"url": "https://security.googleblog.com/2015/12/an-update-on-sha-1-certificates-in.html"
},
{
"type": "WEB",
"url": "https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html"
},
{
"type": "WEB",
"url": "https://sites.google.com/site/itstheshappening"
},
{
"type": "WEB",
"url": "https://www.schneier.com/blog/archives/2005/02/sha1_broken.html"
},
{
"type": "WEB",
"url": "https://www.schneier.com/blog/archives/2005/08/new_cryptanalyt.html"
},
{
"type": "WEB",
"url": "http://ia.cr/2007/474"
},
{
"type": "WEB",
"url": "http://shattered.io"
},
{
"type": "WEB",
"url": "http://www.cwi.nl/news/2017/cwi-and-google-announce-first-collision-industry-security-standard-sha-1"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/12577"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XM5H-PCCR-WQ9G
Vulnerability from github – Published: 2022-05-24 19:10 – Updated: 2022-05-24 19:10In SapphireIMS 4097_1, the password in the database is stored in Base64 format.
{
"affected": [],
"aliases": [
"CVE-2017-16632"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-11T21:15:00Z",
"severity": "HIGH"
},
"details": "In SapphireIMS 4097_1, the password in the database is stored in Base64 format.",
"id": "GHSA-xm5h-pccr-wq9g",
"modified": "2022-05-24T19:10:39Z",
"published": "2022-05-24T19:10:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16632"
},
{
"type": "WEB",
"url": "https://vuln.shellcoder.party/2020/07/18/cve-2017-16632-sapphireims-insecure-storage-of-password"
},
{
"type": "WEB",
"url": "https://vuln.shellcoder.party/tags/sapphireims"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-XM9V-FG48-44V7
Vulnerability from github – Published: 2024-06-15 00:31 – Updated: 2024-07-03 18:45HCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security Header. This could allow an attacker to intercept or manipulate data during redirection.
{
"affected": [],
"aliases": [
"CVE-2024-30119"
],
"database_specific": {
"cwe_ids": [
"CWE-326",
"CWE-522"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-14T22:15:10Z",
"severity": "LOW"
},
"details": "HCL DRYiCE Optibot Reset Station\u00a0is impacted by a missing Strict Transport Security Header. \u00a0This could allow an attacker to intercept or manipulate data during redirection.",
"id": "GHSA-xm9v-fg48-44v7",
"modified": "2024-07-03T18:45:28Z",
"published": "2024-06-15T00:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30119"
},
{
"type": "WEB",
"url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0113496"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XPPM-X368-2QJM
Vulnerability from github – Published: 2022-10-06 18:52 – Updated: 2022-10-07 18:15In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables.
{
"affected": [],
"aliases": [
"CVE-2022-2781"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-06T18:15:00Z",
"severity": "MODERATE"
},
"details": "In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables.",
"id": "GHSA-xppm-x368-2qjm",
"modified": "2022-10-07T18:15:43Z",
"published": "2022-10-06T18:52:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2781"
},
{
"type": "WEB",
"url": "https://advisories.octopus.com/post/2022/sa2022-16"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Use an encryption scheme that is currently considered to be strong by experts in the field.
CAPEC-112: Brute Force
In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset.
CAPEC-192: Protocol Analysis
An adversary engages in activities to decipher and/or decode protocol information for a network or application communication protocol used for transmitting information between interconnected nodes or systems on a packet-switched data network. While this type of analysis involves the analysis of a networking protocol inherently, it does not require the presence of an actual or physical network.
CAPEC-20: Encryption Brute Forcing
An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext.