Weak cryptography or TLS.

Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint

• themehigh Payment Gateway of Stripe for WooCommerce
• Weak cryptography or TLS

Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG

• Cotonti
• Weak cryptography or TLS

IBM Guardium Data Protection is affected by multiple vulnerabilities.

• IBM Guardium Data Protection
• Weak cryptography or TLS

Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

• Weak cryptography or TLS

<3.10.1 · fixed in 3.10.1

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

• Weak cryptography or TLS

<4.14.2 · fixed in 4.14.2

PJSIP: TLS server identity (hostname) verification bypass via embedded NUL in certificate SubjectAltName (OpenSSL and GnuTLS backends)

• pjsip pjproject
• Weak cryptography or TLS

CareCam CM2507 Use of Password Hash With Insufficient Computational Effort

• CareCam HMT.CM2507 Firmware
• Weak cryptography or TLS

Cleartext Transmission of Sensitive Information in Bransys ELD

• Bransys ELD
• Weak cryptography or TLS

Multiple vulnerabilities in IBM Controller

• IBM Controller
• Weak cryptography or TLS

IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities

• IBM Cognos Analytics
• Weak cryptography or TLS

IBM Cognos Analytics 12.0.4 and 12.1.3 versions are affected by security vulnerabilities

• IBM Cognos Analytics
• Weak cryptography or TLS

Sensitive File Disclosure via Relative Path Traversal in NetBackup Flex OS Shell

• Cohesity NetBackup Flex OS
• Weak cryptography or TLS

Privilege Escalation via Cryptographic Signature Verification Bypass in NetBackup Flex OS Shell

• Cohesity NetBackup Flex OS
• Weak cryptography or TLS

Improper certificate validation in Synology DiskStation Manager (DSM)

• Synology DiskStation Manager (DSM)
• Weak cryptography or TLS

OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning

• Weak cryptography or TLS
• CWE-923

<0.21.0 · fixed in 0.21.0

Steeltoe: Header-forwarded client cert lacks proof of private-key possession

• Authentication bypass
• Weak cryptography or TLS

<4.3.0 · fixed in 4.3.0

Malformed connection string may disable field level encryption

• MongoDB Inc. MongoDB Entity Framework Core Provider
• Weak cryptography or TLS

Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python

• AWSIoTPythonSDK
• Weak cryptography or TLS

Combining encryption settings may disable encryption

• MongoDB Inc. MongoDB Entity Framework Core Provider
• Weak cryptography or TLS

libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID

• Weak cryptography or TLS
• CWE-345

>=15.0.0, <16.0.5 · fixed in 16.0.5

AsyncHttpClient sends origin credentials to the proxy on the plaintext CONNECT request

• Weak cryptography or TLS
• Hard-coded credentials

>=3.0.0, <3.0.12 || >=2.0.0, <2.16.1 · fixed in 3.0.12, 2.16.1

RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser

• Weak cryptography or TLS
• CWE-316

<1.13.0 · fixed in 1.13.0

mport permits repository and package mirror fetches over insecure transport

• MidnightBSD mport
• Weak cryptography or TLS
• CWE-345

mport bootstrap index fetch can continue after hash verification failure

• MidnightBSD mport
• Weak cryptography or TLS
• CWE-345

AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP

• AsyncHttpClient async-http-client
• Weak cryptography or TLS
• Hard-coded credentials

Improper certificate validation in Dell OpenManage Server Administrator Managed Node (Patch) for Windows and others

• Dell OpenManage Server Administrator Managed Node (Patch) for Windows
• Dell OpenManage Server Administrator Managed Node for RHEL 8.10
• Weak cryptography or TLS

Token revocation record built from unverified JWT claims in AshAuthentication

• Weak cryptography or TLS

>=0.2.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14 · fixed in 4.15.0, 5.0.0-rc.14

admin3 through 3.0.0 Weak Password Hashing via Single-Round MD5

• cjbi admin3
• Weak cryptography or TLS

AVideo Weak PRNG Activation Code Authentication Bypass

• WWBN AVideo
• Weak cryptography or TLS

AVideo Cryptographically Weak PRNG via uniqid Stream Key

• WWBN AVideo
• Weak cryptography or TLS

Broken or risky cryptographic algorithm in Dell OpenManage Server Administrator Managed Node (Patch) for Windows and others

• Dell OpenManage Server Administrator Managed Node (Patch) for Windows
• Dell OpenManage Server Administrator Managed Node for RHEL 8.10
• Weak cryptography or TLS

Newsletter < 9.3.8 - Unauthenticated Subscriber PII Disclosure and Modification via Predictable Tracking Signature Key

• Newsletter
• Weak cryptography or TLS

SafeLine through 9.4.1 Authentication Bypass via Weak Session Secret

• chaitin SafeLine
• Weak cryptography or TLS

Cisco Secure Firewall Management Center and Secure Firewall Threat Defense Software sftunnel Unauthorized Authentication Bypass Vulnerability

• Cisco Secure Firewall Management Center (FMC)
• Cisco Secure Firewall Threat Defense (FTD) Software
• Weak cryptography or TLS

Nuclei from 3.7.0 before 3.11.1 Template Signature Bypass via Modification-Time-Only Cache

• projectdiscovery nuclei
• Weak cryptography or TLS

Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

• Red Hat Ansible Automation Platform 2.6 for RHEL 9
• Red Hat Enterprise Linux 10
• Weak cryptography or TLS

Broken or risky cryptographic algorithm in Dell Elastic Cloud Storage (ECS)

• Dell Elastic Cloud Storage (ECS)
• Weak cryptography or TLS

Cleartext transmission of sensitive information in Advantech EKI-1242IEIMS and others

• Advantech EKI-1242IEIMS
• Advantech EKI-1242EIMS
• Weak cryptography or TLS

Improper Verification of the Firmware Signature vulnerability

• Fermax Electronica S.A.U. DUOX PLUS monitor firmware (VEO Wi-Fi range)
• Weak cryptography or TLS

Improper Certificate Validation in the Firmware Download vulnerability

• Fermax Electronica S.A.U. DUOX PLUS monitor firmware (VEO Wi-Fi range)
• Weak cryptography or TLS

Cleartext Transmission of Sensitive Information in the Pairing Process vulnerability

• Fermax Electronica S.A.U. DuoxMe
• Fermax Electronica S.A.U. DUOX PLUS monitor firmware (VEO Wi-Fi range)
• Weak cryptography or TLS

Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode

• Apache Software Foundation Apache ZooKeeper
• Weak cryptography or TLS

Security Advisory 0182

• Arista Networks VeloCloud Edge
• Weak cryptography or TLS

EspoCRM through 10.0.8 Weak Token Generation via rand()

• EspoCRM
• Weak cryptography or TLS

Cryptographic Padding Oracle

• Delinea Secret Server (On-Prem)
• Weak cryptography or TLS

Improper certificate validation in Devolutions Server

• Devolutions Server
• Weak cryptography or TLS

Improper certificate validation in Devolutions Server

• Devolutions Server
• Weak cryptography or TLS

Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redirect

• http4s
• Information disclosure
• Weak cryptography or TLS

Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

• IBM Verify Identity Access
• IBM Security Verify Access
• Weak cryptography or TLS

GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK

• Google Cloud Gemini Enterprise Agent Platform SDK for Python
• Weak cryptography or TLS

Insufficiently random values in Apple iOS and iPadOS and others

• Apple iOS and iPadOS
• Apple macOS
• Authentication bypass
• Weak cryptography or TLS

Improper certificate validation in Apple macOS

• Apple macOS
• Weak cryptography or TLS

Improper certificate validation in Apple iOS and iPadOS and others

• Apple iOS and iPadOS
• Apple macOS
• Weak cryptography or TLS

Vulnerabilities exists in IBM Cloud Pak for Data System

• IBM Cloud Pak for Data System (Yosemite 1.0)
• Weak cryptography or TLS

Apache Syncope: SRA OAuth2 JWT signature verification bypass

• Apache Software Foundation Apache Syncope
• Weak cryptography or TLS

andreashappe cochise SSH Host Key ssh_connection.py asyncssh.connect certificate validation

• andreashappe cochise
• Authentication bypass
• Weak cryptography or TLS

Cleartext transmission of sensitive information in supremainc BioStar 2

• supremainc BioStar 2
• Weak cryptography or TLS

Improper certificate validation in Socket Firewall

• Socket Firewall
• Weak cryptography or TLS

Improper certificate validation in Kalkitech ASE2000 V2 Communication Test Set

• Kalkitech ASE2000 V2 Communication Test Set
• Weak cryptography or TLS

Weak password hashing in CISA Malcolm

• CISA Malcolm
• Weak cryptography or TLS