Weak cryptography or TLS.

Weak hashing algorithm in Redeight CMS

• Redeight CMS
• Weak cryptography or TLS

Net::BitTorrent versions before 2.1.0 for Perl generate the MSE Diffie-Hellman private key with a non-cryptographic PRNG

• SANKO Net::BitTorrent
• Weak cryptography or TLS

Strapi users-permissions - JWT Algorithm Confusion via Missing Algorithm Configuration

• strapi
• Weak cryptography or TLS

Home Assistant: iOS Companion App ignores internal SSID allowlist for connections – possible leak of access token and sensor data

• home-assistant core
• Weak cryptography or TLS

FrontAccounting < 2.4.20 SQL Injection via rep601.php

• FrontAccounting
• SQL injection
• Weak cryptography or TLS

motionEye: Authentication possible via password hash

• Authentication bypass
• Weak cryptography or TLS

<0.44.0 · fixed in 0.44.0

rfc3161-client has insufficient verification for timestamp response signatures

• Weak cryptography or TLS

<1.0.3 · fixed in 1.0.3

lack of validation for firmware update in Hitachi Virtual Storage

• Hitachi Virtual Storage Platform One Block 23, 24, 26, 28
• Weak cryptography or TLS

SimStudioAI sim Password Protection deployment.ts weak hash

• sim
• Weak cryptography or TLS

skypilot-org skypilot User ID server.py username.encode weak hash

• skypilot
• Weak cryptography or TLS

Relyra SAML SignatureValue not cryptographically verified -> authentication bypass

• Authentication bypass
• Weak cryptography or TLS

>=1.0.0, <1.2.0 · fixed in 1.2.0

Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack

• kestra
• Weak cryptography or TLS

HCL Traveler for Microsoft Outlook (HTMO) is susceptible to an application modification vulnerability

• HCLSoftware Traveler for Microsoft Outlook
• Weak cryptography or TLS

@sigstore/core has DSSE payloadType type-binding failure

• Weak cryptography or TLS

<3.2.1 · fixed in 3.2.1

Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption

• envoy
• Information disclosure
• Weak cryptography or TLS

The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although the control channel was TLS-protected the data channel was tr...

• Weak cryptography or TLS

<3.15.1 · fixed in 3.15.1

Improper certificate validation in node

• node
• Weak cryptography or TLS

Duplicate Advisory: Authentication bypass via jwt algorithm confusion

• Weak cryptography or TLS

<26.6.4 · fixed in 26.6.4

Setracker2 Children's Smartwatch Ecosystem Use of a Broken or Risky Cryptographic Algorithm

• Shenzhen i365-Tech Co. Ltd. Setracker2 Parental Control App (Android) package com.tgelec.setracker
• Weak cryptography or TLS

Cacti: Package Import Signature Validation Bypass Allows Self-Signed Packages

• cacti
• Weak cryptography or TLS

Authenticate method auth bypass in github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension

• Authentication bypass
• Weak cryptography or TLS

>=0.124.0, <0.151.0 · fixed in 0.151.0

golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions

• Weak cryptography or TLS
• CWE-281

<0.52.0 · fixed in 0.52.0

Lemur: JWT verifier honors attacker-supplied alg, enabling ATO

• Weak cryptography or TLS

<1.9.2 · fixed in 1.9.2

PKCS7_verify signer confusion allows forged signatures to be accepted

• wolfSSL
• Weak cryptography or TLS

iPAddress name constraints not enforced when WOLFSSL_IP_ALT_NAME is undefined

• wolfSSL
• Weak cryptography or TLS

OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status

• wolfSSL
• Weak cryptography or TLS

PKCS#12 MAC verification uses attacker-controlled comparison length

• wolfSSL
• Weak cryptography or TLS

ML-KEM ARM64 NEON ciphertext comparison only compares half of the input

• wolfSSL
• Weak cryptography or TLS

HMAC zero-length tag forgery in EVP_DigestVerifyFinal

• wolfSSL
• Weak cryptography or TLS

Continued acceptance of SHA-1/MD5 digests in certificate processing

• wolfSSL
• Weak cryptography or TLS

CRL critical extension bypass in ParseCRL_Extensions

• wolfSSL
• Weak cryptography or TLS

X.509 name constraint bypass via Subject CN treated as a DNS name

• wolfSSL
• Weak cryptography or TLS

Wildcard DNS SAN bypasses CA name-constraint checks

• wolfSSL
• Weak cryptography or TLS

X.509 trust-chain bypass in wolfSSL_X509_verify_cert() via untrusted intermediate anchoring

• wolfSSL
• Weak cryptography or TLS

Un-negotiated Raw Public Key (RFC 7250) accepted in place of X.509, bypassing chain validation

• wolfSSL
• Weak cryptography or TLS

Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA (temporary CA exemption)

• wolfSSL
• Weak cryptography or TLS

OpenAM: Unauthenticated Authentication Bypass via RADIUS Spoofing

• Weak cryptography or TLS

<16.1.1 · fixed in 16.1.1

X.509 trust-chain bypass via path-depth exhaustion in wolfSSL_X509_verify_cert()

• wolfSSL
• Weak cryptography or TLS

wolfSSL_PKCS7_verify() reports success for degenerate (certs-only) PKCS#7 with no signer

• wolfSSL
• Weak cryptography or TLS

Partial-chain verification accepts untrusted intermediate as trust anchor

• wolfSSL
• Weak cryptography or TLS

Improper certificate validation in Dell Display and Peripheral Manager

• Dell Display and Peripheral Manager
• Weak cryptography or TLS

ATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Execution Vulnerability

• ATEN Unizon
• Weak cryptography or TLS

Rocket.Chat: SAML signature validation skipped when IdP certificate field is empty

• RocketChat Rocket.Chat
• Weak cryptography or TLS

Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuring

• mastodon
• Weak cryptography or TLS

Jenkins Bitbucket Push and Pull Request Plugin unconditionally disables SSL/TLS certificate validation

• Weak cryptography or TLS

<3.3.9 · fixed in 3.3.9

phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing

• Weak cryptography or TLS

<4.1.4 · fixed in 4.1.4

motionEye: LFI → pass‑the‑hash admin → unsafe restore → unauth action exec (RCE)

• Path traversal
• Privilege escalation

<0.44.0 · fixed in 0.44.0

Daytona: Git credential leak via git clone with TLS verification disabled

• daytona
• Weak cryptography or TLS

HCL Connections is vulnerable to broken access control

• HCLSoftware Connections
• Broken access control
• Weak cryptography or TLS

Account Takeover via Predictable SSO Ticket Generation

• zohocorp manageengine_adselfservice_plus
• zohocorp manageengine_recovery_manager_plus
• Authentication bypass
• Weak cryptography or TLS

Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter

• HAYAJO Mojolicious::Plugin::Web::Auth::OAuth2
• Weak cryptography or TLS
• CWE-340

Cleartext transmission of sensitive information in Yokogawa Electric Corporation FAST/TOOLS and others

• Yokogawa Electric Corporation FAST/TOOLS
• Yokogawa Electric Corporation CI Server
• Weak cryptography or TLS

Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.

• IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data
• Weak cryptography or TLS

Windows-machine-config-operator: windows-machine-config-operator: ssh host key not verified enables credential theft

• Red Hat OpenShift for Windows Containers 10.19
• Red Hat OpenShift for Windows Containers 10.20
• Weak cryptography or TLS

@jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing

• Weak cryptography or TLS

>=0.3.0, <0.4.0 · fixed in 0.4.0

CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality

• Weak cryptography or TLS
• CWE-523

>=1.9.0, <1.9.1 · fixed in 1.9.1

CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages

• Authentication bypass
• Weak cryptography or TLS

<1.8.1 || >=1.9.0, <1.9.1 · fixed in 1.8.1, 1.9.1

CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation

• Authentication bypass
• Weak cryptography or TLS

<1.8.1 || >=1.9.0, <1.9.1 · fixed in 1.8.1, 1.9.1

CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass

• Weak cryptography or TLS
• CWE-757

<1.8.1 || >=1.9.0, <1.9.1 · fixed in 1.8.1, 1.9.1

CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate

• Weak cryptography or TLS
• CWE-345

<1.8.1 || >=1.9.0, <1.9.1 · fixed in 1.8.1, 1.9.1