CWE-1240.

Misuse and Misconfiguration of Cryptographic Algorithm in Bluetooth Communication

• SwitchBot Lock
• SwitchBot Lock Pro
• CWE-1204
• CWE-1240

HCL Hive is affected by use of a cryptographic primitive with a risky implementation

• HCLSoftware HCL Hive
• CWE-1240

HCL Hive is affected by use of a cryptographic primitive with a risky implementation

• HCLSoftware HCL Hive
• CWE-1240

Windows Key Guard Security Feature Bypass Vulnerability

• Microsoft Windows 10 Version 1809
• Microsoft Windows 10 Version 21H2
• CWE-1240

Function Abusement Vulnerability in ZTE ZXUniPOS NDS-LTE

• ZTE ZXUniPOS NDS-LTE
• CWE-1240

Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss

• CWE-345
• CWE-1240

<0.4.3 || >=0.5.0, <0.5.3 · fixed in 0.4.3, 0.5.3

Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor

• Information disclosure
• CWE-642

>=9.0.13, <9.0.116 || >=10.1.50, <10.1.53 || >=11.0.0-M1, <11.0.20 || >=8.5.38, <=8.5.100 || >=7.0.100, <=7.0.109 · fixed in 9.0.116, 10.1.53, 11.0.20

libcrux has All-Zero Key Generation Upon Catastrophic RNG Failure

• CWE-331
• CWE-392

<0.0.7 · fixed in 0.0.7

Multiple Vulnerabilities in IBM Concert Software

• IBM Concert
• CWE-1240

uTLS has a fingerprint vulnerability from GREASE ECH mismatch for Chrome parrots

• CWE-1240

>=1.6.0, <1.8.1 · fixed in 1.8.1

`libparsec_crypto` does not check for weak order point of curve 25519

• Scille parsec-cloud
• Weak cryptography or TLS
• CWE-1240

Elliptic Uses a Cryptographic Primitive with a Risky Implementation

• CWE-1240

<=6.6.1 · no fixed version yet

Apache StreamPark: Use the user’s password as the secret key Vulnerability

• CWE-1240

>=2.0.0, <2.1.7 · fixed in 2.1.7

Timing side-channel in ML-DSA decomposition

• CWE-1240

>=0.0.0-0, <0.1.0-rc.3 · fixed in 0.1.0-rc.3

Dell CloudLink: Dell CloudLink, versions prior to 8.2…

• Dell CloudLink
• CWE-1240

Windows Cryptographic Services Information Disclosure Vulnerability

• Microsoft Windows 10 Version 1809
• Microsoft Windows 10 Version 21H2
• CWE-1240

Windows Cryptographic Services Information Disclosure Vulnerability

• Microsoft Windows Server 2022
• CWE-1240

Post-Quantum Secure Feldman's Verifiable Secret Sharing has Inadequate Fault Injection Countermeasures in `secure_redundant_execution`

• CWE-1240
• CWE-1279

<=0.8.0b2 · no fixed version yet

Dell PowerProtect DD: Dell PowerProtect DD, versions prior to DDOS 8.3.0.0, 7.10.1.50…

• Dell PowerProtect DD
• CWE-1240

Soundness issue with Plonky2 look up tables

• CWE-1240

>=1.0.0, <1.0.1 · fixed in 1.0.1

PQClean has a correctness error in HQC decapsulation

• Information disclosure
• CWE-1240

<0.2.1 · fixed in 0.2.1

Dell Key Trust Platform, v3.0.6 and prior, contains Use of a Cryptographic Primitive with a Risky Implementation vulnerability.

• Dell CloudLink
• CWE-1240

Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior

• CWE-1240

<5.5.40 || >=5.6.0, <5.6.15 · fixed in 5.5.40, 5.6.15

Laravel Encrypter Failure to decryption vulnerability

• CWE-1240

>=5.5.0, <5.5.40 || >=5.6.0, <5.6.15 · fixed in 5.5.40, 5.6.15

Silicon Labs EFR32xxx parts with classic key storage do not use hardware accelerated AES-CCM

• silabs.com Ember ZNet SDK
• CWE-1240

B&R products use insufficient communication encryption

• B&R Industrial Automation Automation Studio
• B&R Industrial Automation Technology Guarding
• Code injection
• Weak cryptography or TLS

FTP uses unsecure encryption mechanisms

• B&R Industrial Automation Automation Runtime
• CWE-1240

scalarmult() vulnerable to degenerate public keys

• CWE-1240

<0.0.14 · fixed in 0.0.14