Weak cryptography or TLS.

Acrobat Reader | Improper Verification of Cryptographic Signature (CWE-347)

• Adobe Acrobat Reader
• Weak cryptography or TLS

Improper signature verification in Fortinet FortiSwitchManager and others

• Fortinet FortiSwitchManager
• Fortinet FortiOS
• Weak cryptography or TLS

Improper signature verification in Fortinet FortiWeb

• Fortinet FortiWeb
• Weak cryptography or TLS

Improper signature verification in Ivanti Endpoint Manager

• Ivanti Endpoint Manager
• Weak cryptography or TLS

Improper certificate validation in Siemens COMOS V10.6 and others

• Siemens COMOS V10.6
• Siemens JT Bi-Directional Translator for STEP
• Weak cryptography or TLS

Improper certificate validation in Siemens COMOS V10.6 and others

• Siemens COMOS V10.6
• Siemens NX V2412
• Weak cryptography or TLS

Weak/Predictable root Password

• Phoenix Contact FL SWITCH 2005
• Phoenix Contact FL SWITCH 2008
• Weak cryptography or TLS

WBCE CMS has Weak Random Number Generator in Password Generation Function

• WBCE_CMS
• Weak cryptography or TLS
• CWE-331

Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature validation

• Weak cryptography or TLS

<1.18.0 · fixed in 1.18.0

Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)

• Weak cryptography or TLS

<1.18.0 · fixed in 1.18.0

Altcha Proof-of-Work obfuscation mode cryptanalytic break

• Weak cryptography or TLS

>=0.8.0, <=2.2.4 · no fixed version yet

Traefik Inverted TLS Verification Logic in ingress-nginx Provider

• Weak cryptography or TLS

>=3.5.0, <3.6.3 · fixed in 3.6.3

Nextcloud Calendar app used predictable proposal participant tokens

• nextcloud security-advisories
• Weak cryptography or TLS

Solstice Pod API Session Key Extraction via API Endpoint

• mersive Solstice Pod API
• Weak cryptography or TLS

libcrux incorrectly calculates on aarch64

• Information disclosure
• Weak cryptography or TLS

>=0.0.3, <0.0.4 · fixed in 0.0.4

auth0/node-jws Improperly Verifies HMAC Signature

• Weak cryptography or TLS

<3.2.3 || >=4.0.0, <4.0.1 · fixed in 3.2.3, 4.0.1

Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 was discovered to transmit Administrator credentials in plaintext.

• Weak cryptography or TLS

gokey allows secret recovery from a seed file without the master password in github.com/cloudflare/gokey

• Weak cryptography or TLS

<0.2.0 · fixed in 0.2.0

Sprecher Automation: SPRECON-E series prone to weak encryption of update files

• Sprecher Automation SPRECON-E-C
• Sprecher Automation SPRECON-E-P
• Weak cryptography or TLS

Cleartext transmission of sensitive information in Socomec DIRIS Digiware M-70

• Socomec DIRIS Digiware M-70
• Weak cryptography or TLS

An issue in Technitium through v13.2.2 enables attackers to conduct a DNS cache poisoning attack and inject fake responses by reviving the birthday attack.

• Weak cryptography or TLS

Kerlink gateways running KerOS prior to version 5.10 expose their web interface exclusively over HTTP, without HTTPS support.

• Weak cryptography or TLS

XML-Sig prior to 0.68 for Perl improperly validates XML without signatures

• TIMLEGGE XML::Sig
• Weak cryptography or TLS

Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions

• Authentication bypass
• Weak cryptography or TLS

>=1.3.34, <1.4.0 · fixed in 1.4.0

Apache Druid’s Kerberos authenticator uses a weak fallback secret

• Weak cryptography or TLS

<35.0.0 · fixed in 35.0.0

cggmp24 and cggmp21 are vulnerable to signature forgery through altered presignatures

• Weak cryptography or TLS

<=0.6.3 · no fixed version yet

cggmp21 has a missing check in the ZK proof used in CGGMP21

• Weak cryptography or TLS
• CWE-345

<0.6.3 · fixed in 0.6.3

Insufficiently random values in ASUS Router

• ASUS Router
• Weak cryptography or TLS

Improper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB Server

• MongoDB Inc. MongoDB Server
• Weak cryptography or TLS

Inside Track / Entropy Derby Timelock Encryption Bypassed via Pre-Computed VDF Output Leakage

• mescuwa entropy-derby
• Information disclosure
• Weak cryptography or TLS

IBM Concert Information Disclosure

• IBM Concert
• Weak cryptography or TLS

Improper certificate validation in GL-Inet GL-AXT1800

• GL-Inet GL-AXT1800
• Weak cryptography or TLS

Forward Secrecy Violation in WolfSSL TLS 1.3

• wolfSSL
• Weak cryptography or TLS

RNP 0.18.0 Vulnerable PKESK session keys

• Ribose RNP
• Weak cryptography or TLS

IBM Concert Software Information Disclosure

• IBM Concert
• Weak cryptography or TLS

GoSign Desktop < 2.4.1 Insecure Update Mechanism RCE

• Tinexta InfoCert S.p.A. GoSign Desktop
• Weak cryptography or TLS

Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves in github.com/evervault/evervault-go

• Weak cryptography or TLS

<1.3.2 · fixed in 1.3.2

Improper certificate validation in KDDI CORPORATION 'デジラアプリ' App for iOS

• KDDI CORPORATION 'デジラアプリ' App for iOS
• Weak cryptography or TLS

Improper certificate validation in Tinexta Infocert GoSign Desktop

• Tinexta Infocert GoSign Desktop
• Weak cryptography or TLS

Freebox v5 HD (firmware = 1.7.20), Freebox v5 Crystal (firmware = 1.7.20), Freebox v6 Révolution r1–r3 (firmware = 4.7.x), Freebox Mini 4K (firmware = 4.7.x), and Freebox One (firmware = 4.7.x) were…

• Weak cryptography or TLS

AVEVA Edge Use of a Broken or Risky Cryptographic Algorithm

• AVEVA Edge
• Weak cryptography or TLS

General Industrial Controls Lynx+ Gateway Cleartext Transmission of Sensitive Information

• General Industrial Controls Lynx+ Gateway
• Weak cryptography or TLS

A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2.

• Weak cryptography or TLS

pgAdmin has vulnerability in LDAP authentication mechanism that allows bypassing TLS certificate verification

• Weak cryptography or TLS

<9.10 · fixed in 9.10

Zoom Workplace Clients - Improper Certificate Validation

• Zoom Communications Inc. Zoom Workplace Clients
• Weak cryptography or TLS

Zoom Workplace VDI Client for Windows - Improper Verification of Cryptographic Signature

• Zoom Communications Inc. Zoom Workplace VDI Client
• Weak cryptography or TLS

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The ...

• Weak cryptography or TLS

>=1.4.0, <1.4.2 · fixed in 1.4.2

Improper certificate validation in Lenovo Scanner Pro

• Lenovo Scanner Pro
• Weak cryptography or TLS

Improper certificate validation in Lenovo App Store and others

• Lenovo App Store
• Lenovo PC Manager
• Weak cryptography or TLS

Improper certificate validation in Siemens Solid Edge SE2025

• Siemens Solid Edge SE2025
• Weak cryptography or TLS

Improper certificate validation in firmware update logic in NETGEAR RAX30 and RAXE300

• NETGEAR RAX30
• NETGEAR RAXE300
• Weak cryptography or TLS

Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Genera…

• themefic Hydra Booking — Appointment Scheduling & Booking Calendar
• Weak cryptography or TLS

Broken or risky cryptographic algorithm in Dell PowerScale OneFS

• Dell PowerScale OneFS
• Weak cryptography or TLS

Improper signature verification in JetBrains ReSharper

• JetBrains ReSharper
• Weak cryptography or TLS

Improper certificate validation in JetBrains YouTrack

• JetBrains YouTrack
• Weak cryptography or TLS

Jumo: Insufficient entropy in PRNG may lead to root access

• Jumo variTRON300
• Jumo variTRON500
• Weak cryptography or TLS

Weak password hashing in BUFFALO INC. WSR-1800AX4 and others

• BUFFALO INC. WSR-1800AX4
• BUFFALO INC. WSR-1800AX4S
• Weak cryptography or TLS

KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer

• Authentication bypass
• Weak cryptography or TLS

<1.5.3 || >=1.6.0-alpha.0, <1.6.1 || >=1.7.0-alpha.0, <1.7.0-rc.0 · fixed in 1.5.3, 1.6.1, 1.7.0-rc.0

HCL DevOps Loop is susceptible to an improper authentication vulnerability

• HCL Software DevOps Loop
• Weak cryptography or TLS
• Authentication bypass

Tonec Internet Download Manager 6.42.41.1 and earlier suffers from Missing SSL Certificate Validation, which allows attackers to bypass update protections.

• Weak cryptography or TLS