Inadequate Encryption Strength
CWE-326
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
We track 89 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.1. 4 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Use an encryption scheme that is currently considered to be strong by experts in the field.
Latest Inadequate Encryption Strength vulnerabilities
- 7.5 High severity
Spectrum Scale: Inadequate Encryption Strength
IBM Spectrum Scale 5.1.0 through 5.1.3.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 221012.
- 8.1 High severity
Bulletproofs: Inadequate Encryption Strength
The Bulletproofs 2017/1066 paper mishandles Fiat-Shamir generation because the hash computation fails to include all of the public values from the Zero Knowledge proof statement as well as all of the public values computed in the proof, aka the Frozen Heart is
- 8.1 High severity
Mitsubishi Electric MELSEC iQ-F series FX5U(C)…: Inadequate Encryption Strength
Use of Weak Hash vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU all versions, Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU all versions, Mitsubishi Electric MELSEC iQ-R
- 7.5 High severity
ClearSCADA (All Versions), EcoStruxure Geo…: Inadequate Encryption Strength
A CWE-326: Inadequate Encryption Strength vulnerability exists that could cause non-encrypted communication with the server when outdated versions of the ViewX client are used. Affected Product: ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All
- 7.5 High severity
jawn: Inadequate Encryption Strength
Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack which may result in a denial of service. Most applicati
- 7.5 High severity
DotNetNuke (DNN) Inadequate Encryption Strength Exploited
DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.
- 7.5 High severity
DotNetNuke (DNN) Inadequate Encryption Strength Exploited
DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
- 9.8 Critical severity
Primetek Primefaces Remote Code Execution Exploited
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
- 9.8 Critical severity
Telerik UI for ASP.NET AJAX Unrestricted File Upload Exploited
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.