Weak cryptography or TLS.

OpenSSL partial chain store policy bypass

• curl
• Weak cryptography or TLS

No QUIC certificate pinning with GnuTLS

• curl
• Weak cryptography or TLS

FaceSentry Access Control System 6.4.8 Authentication Credentials MiTM Disclosure

• iWT Ltd. FaceSentry Access Control System
• Weak cryptography or TLS

EXCHANGE OF CREDENTIALS IN CLEAR TEXT

• EFACEC QC 60/90/120
• Weak cryptography or TLS

Apache Uniffle: Insecure SSL Configuration in Uniffle HTTP Client

• Apache Software Foundation Apache Uniffle
• Weak cryptography or TLS

iDS6 DSSPro Digital Signage System 6.2 Cleartext Password Disclosure via Cookie

• Guangzhou Yeroo Tech Co., Ltd. iDS6 DSSPro Digital Signage System
• Weak cryptography or TLS

QiHang Media Web Digital Signage 3.0.9 Cookie Authentication Credentials Disclosure

• Shenzhen Xingmeng Qihang Media Co., Ltd. QiHang Media Web (QH.aspx) Digital Signage
• Weak cryptography or TLS

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.5 - Unauthenticated Sensitive Information Exposure

• croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
• Weak cryptography or TLS

libtpms returns wrong initialization vector when certain symmetric ciphers are used

• stefanberger libtpms
• Weak cryptography or TLS

Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext.

• Weak cryptography or TLS

Improper certificate validation in KDE messagelib

• KDE messagelib
• Weak cryptography or TLS

Coturn has unsafe nonce and relay port randomization due to weak random number generation.

• coturn
• Weak cryptography or TLS

Weak Algorithm Support in SSH Server on TL-WR820N

• TP-Link Systems Inc. TL-WR820N v2.8
• Weak cryptography or TLS

Data Exposure in Kings Information & Network KESS Enterprise

• Kings Information & Network Co. KESS Enterprise
• Information disclosure
• Weak cryptography or TLS

Improper signature verification in GnuPG

• GnuPG
• Weak cryptography or TLS

FreshRSS has weak cryptographic randomness in remember-me token and nonce generation

• FreshRSS
• Weak cryptography or TLS

DVP-12SE - Modbus/TCP Cleartext Transmission of Sensitive Information

• Delta Electronics DVP-12SE
• Weak cryptography or TLS

Insufficient certificate validation

• Hanwha Vision Co., Ltd. QNV-C8012
• Weak cryptography or TLS

Amazon S3 Encryption Client has a Key Commitment Issue in github.com/aws/amazon-s3-encryption-client-go

• Weak cryptography or TLS

* · no fixed version yet

Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG use of Cryptographically Weak Pseudo-Random Number Generator

• Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG
• Weak cryptography or TLS

Johnson Controls PowerG and IQPanel cleartext transmission of sensitive information

• Johnson Controls IQPanel2, IQHub,IQPanel2+,IQPanel 4,PowerG
• Weak cryptography or TLS

Ever Gauzy v0.281.9 JWT Authentication Weakness via HMAC Secret

• ever gauzy
• Weak cryptography or TLS

Apache Log4j does not verify the TLS hostname in its Socket Appender

• Weak cryptography or TLS

>=2.0-beta9, <2.25.3 · fixed in 2.25.3

Kentico Xperience <= 12.0.102 URL Hashing Cryptography Vulnerability

• Kentico Xperience
• Weak cryptography or TLS

AWS SDK for PHP's S3 Encryption Client has a Key Commitment Issue

• Weak cryptography or TLS

<3.368.0 · fixed in 3.368.0

AWS SDK for Ruby's S3 Encryption Client has a Key Commitment Issue

• Weak cryptography or TLS

<1.208.0 · fixed in 1.208.0

Amazon S3 Encryption Client for Java has a Key Commitment Issue

• Weak cryptography or TLS

<4.0.0 · fixed in 4.0.0

Amazon S3 Encryption Client for .NET has a Key Commitment Issue

• Weak cryptography or TLS

<3.2.0 · fixed in 3.2.0

Broken or risky cryptographic algorithm in AWS SDK for C++

• AWS SDK for C++
• Weak cryptography or TLS

RiteCMS v3.1.0 was discovered to use insecure encryption to store passwords.

• Weak cryptography or TLS

The OTA firmware update mechanism in Netun Solutions HelpFlash IoT (firmware v18_178_221102_ASCII_PRO_1R5_50) uses hard-coded WiFi credentials identical across all devices and does not authenticate u…

• Weak cryptography or TLS
• Hard-coded credentials

Weak Password Hash in Core Privileged Access Manager (BoKS)

• Fortra Core Privileged Access Manager (BoKS)
• Weak cryptography or TLS

HCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information

• HCL Software DevOps Deploy
• Weak cryptography or TLS

ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay

• Weak cryptography or TLS
• CWE-115

<1.0.0 · fixed in 1.0.0

ReyeeOS 1.204.1614 Man-in-the-Middle Remote Code Execution via CWMP

• Ruijie ReyeeOS
• Weak cryptography or TLS

GOM Player 2.3.90.5360 Remote Code Execution via Insecure IE Component

• Gomlab GOM Player
• Weak cryptography or TLS

IBM DevOps Deploy is susceptible to a Cleartext Transmission of Sensitive Information

• UCD - IBM DevOps Deploy
• Weak cryptography or TLS

Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values in github.com/gofiber/utils

• Weak cryptography or TLS
• CWE-252

<1.2.0 · fixed in 1.2.0

Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client Certificates

• Authentication bypass
• Weak cryptography or TLS

>=7.0.0-alpha1, <8.19.8 || >=9.0.0-beta1, <9.1.8 || >=9.2.0, <9.2.2 · fixed in 8.19.8, 9.1.8, 9.2.2

Improper certificate validation in LINE Corporation LINE client for iOS

• LINE Corporation LINE client for iOS
• Weak cryptography or TLS

Tenda AX9 httpd image_check weak hash

• Tenda AX9
• Weak cryptography or TLS

Missing encryption on Local Configuration Interface or Cloud Endpoint Communication - Growatt MIC3300TL-X and ShineLan-X

• Growatt ShineLan-X
• Weak cryptography or TLS

Login Lockdown & Protection <= 2.14 - IP Block Bypass

• webfactory Login Lockdown & Protection
• Weak cryptography or TLS

Improper signature verification in Apple macOS

• Apple macOS
• Weak cryptography or TLS

Improper signature verification in Apple macOS

• Apple macOS
• Weak cryptography or TLS

NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM)

• Weak cryptography or TLS

>=5.3.0, <5.4.8 · fixed in 5.4.8

Apache StreamPark uses a Weak Encryption Algorithm

• Weak cryptography or TLS

>=2.0.0, <2.1.7 · fixed in 2.1.7

A missing encryption of sensitive data vulnerability was found in the UPS settings of ADM

• ASUSTOR ADM
• Weak cryptography or TLS

An improper certificates validation vulnerability was found in the Notification settings of ADM

• ASUSTOR ADM
• Weak cryptography or TLS

Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via triggers.

• Weak cryptography or TLS

An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2.

• Weak cryptography or TLS

Predictable Default Wi-Fi Password in EZCast Pro II Dongle

• EZCast Pro II
• Weak cryptography or TLS

The application uses an insecure hashing algorithm (MD5) to hash passwords.

• Weak cryptography or TLS

Due to a lack of certificate validation, all traffic from the mobile application can be intercepted.

• Weak cryptography or TLS

The mobile application is configured to allow clear text traffic to all domains and communicates with an API server over HTTP.

• Weak cryptography or TLS

The firmware on the basestation of the Meatmeet is not encrypted.

• Weak cryptography or TLS

Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 devices, allow attackers to install malicious firmware without…

• Weak cryptography or TLS
• Memory corruption

Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, Camera Hub G3 4.1.9_0027 fail to validate server certificates in TLS connections for discovery services and CoAP gateway communicatio…

• Weak cryptography or TLS

Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 fail to validate server certificates during HTTPS firmware downloads, allowing man-in-the-middle attacke…

• Weak cryptography or TLS

Acrobat Reader | Improper Verification of Cryptographic Signature (CWE-347)

• Adobe Acrobat Reader
• Weak cryptography or TLS