CWE-326
Allowed-with-ReviewInadequate Encryption Strength
Abstraction: Class · Status: Draft
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
657 vulnerabilities reference this CWE, most recent first.
GHSA-8VFH-F45H-33PP
Vulnerability from github – Published: 2022-05-14 01:54 – Updated: 2022-05-14 01:54An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. The password encryption method can be retrieved from the firmware. This encryption method is based on a chall value that is sent in cleartext as a POST parameter. An attacker could reverse the password encryption algorithm to retrieve it.
{
"affected": [],
"aliases": [
"CVE-2017-13699"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-11-23T21:29:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. The password encryption method can be retrieved from the firmware. This encryption method is based on a chall value that is sent in cleartext as a POST parameter. An attacker could reverse the password encryption algorithm to retrieve it.",
"id": "GHSA-8vfh-f45h-33pp",
"modified": "2022-05-14T01:54:40Z",
"published": "2022-05-14T01:54:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-13699"
},
{
"type": "WEB",
"url": "https://www.sentryo.net/wp-content/uploads/2017/11/Switch-Moxa-Analysis.pdf"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/106047"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8VH3-29MR-M9XG
Vulnerability from github – Published: 2021-09-01 18:31 – Updated: 2021-08-30 21:53showdoc makes use of a hardcoded salt in its user password hash function
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "showdoc/showdoc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.9.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-3680"
],
"database_specific": {
"cwe_ids": [
"CWE-326",
"CWE-347"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-30T21:53:31Z",
"nvd_published_at": "2021-08-04T13:15:00Z",
"severity": "MODERATE"
},
"details": "showdoc makes use of a hardcoded salt in its user password hash function\n\n",
"id": "GHSA-8vh3-29mr-m9xg",
"modified": "2021-08-30T21:53:31Z",
"published": "2021-09-01T18:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3680"
},
{
"type": "WEB",
"url": "https://github.com/star7th/showdoc/commit/4b962c1740311e0d46775023b6acba39ad60e370"
},
{
"type": "PACKAGE",
"url": "https://github.com/star7th/showdoc"
},
{
"type": "WEB",
"url": "https://github.com/star7th/showdoc/blob/fd1740234a12804b45af9cac3563567d83ba414d/server/Application/Home/Model/UserModel.class.php#L20"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/76b49607-fba9-4100-9be7-cb459fe6cfe2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Inadequate Encryption Strength in showdoc"
}
GHSA-8VQM-PJ2F-G578
Vulnerability from github – Published: 2023-06-30 18:31 – Updated: 2024-04-04 05:19An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3. Because it doesn't use EditEntity for undo and restore, the intended interaction with AbuseFilter does not occur.
{
"affected": [],
"aliases": [
"CVE-2023-37301"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-30T17:15:09Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3. Because it doesn\u0027t use EditEntity for undo and restore, the intended interaction with AbuseFilter does not occur.",
"id": "GHSA-8vqm-pj2f-g578",
"modified": "2024-04-04T05:19:00Z",
"published": "2023-06-30T18:31:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37301"
},
{
"type": "WEB",
"url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/933663"
},
{
"type": "WEB",
"url": "https://phabricator.wikimedia.org/T250720"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8WR8-GR7J-V6CG
Vulnerability from github – Published: 2022-05-24 19:07 – Updated: 2022-07-13 00:01A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to tamper with signed URLs by appending further data which allows bypass of signature verification.
{
"affected": [],
"aliases": [
"CVE-2021-24020"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-09T19:15:00Z",
"severity": "CRITICAL"
},
"details": "A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to tamper with signed URLs by appending further data which allows bypass of signature verification.",
"id": "GHSA-8wr8-gr7j-v6cg",
"modified": "2022-07-13T00:01:10Z",
"published": "2022-05-24T19:07:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24020"
},
{
"type": "WEB",
"url": "https://fortiguard.com/advisory/FG-IR-21-027"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8WVX-W97G-7FQ3
Vulnerability from github – Published: 2024-08-13 09:30 – Updated: 2024-08-13 09:30A vulnerability has been identified in Location Intelligence family (All versions < V4.4). The web server of affected products is configured to support weak ciphers by default. This could allow an unauthenticated attacker in an on-path position to to read and modify any data passed over the connection between legitimate clients and the affected device.
{
"affected": [],
"aliases": [
"CVE-2024-41681"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-13T08:15:11Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been identified in Location Intelligence family (All versions \u003c V4.4). The web server of affected products is configured to support weak ciphers by default. This could allow an unauthenticated attacker in an on-path position to to read and modify any data passed over the connection between legitimate clients and the affected device.",
"id": "GHSA-8wvx-w97g-7fq3",
"modified": "2024-08-13T09:30:52Z",
"published": "2024-08-13T09:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41681"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-720392.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-9225-WWJ6-C3W3
Vulnerability from github – Published: 2023-06-30 03:30 – Updated: 2024-04-04 05:18Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information.
{
"affected": [],
"aliases": [
"CVE-2023-36539"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-30T03:15:09Z",
"severity": "HIGH"
},
"details": "\nExposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information.\n\n",
"id": "GHSA-9225-wwj6-c3w3",
"modified": "2024-04-04T05:18:36Z",
"published": "2023-06-30T03:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36539"
},
{
"type": "WEB",
"url": "https://explore.zoom.us/en/trust/security/security-bulletin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-92C8-RFC2-VG9X
Vulnerability from github – Published: 2026-08-11 18:31 – Updated: 2026-08-11 18:31Inadequate encryption strength in Windows Active Directory allows an authorized attacker to bypass a security feature over a network.
{
"affected": [],
"aliases": [
"CVE-2026-65777"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-11T17:18:57Z",
"severity": "MODERATE"
},
"details": "Inadequate encryption strength in Windows Active Directory allows an authorized attacker to bypass a security feature over a network.",
"id": "GHSA-92c8-rfc2-vg9x",
"modified": "2026-08-11T18:31:38Z",
"published": "2026-08-11T18:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65777"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65777"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-92WP-JGHR-HH87
Vulnerability from github – Published: 2024-06-07 00:30 – Updated: 2024-06-07 19:36The encrypt() function of Ninja Core v7.0.0 was discovered to use a weak cryptographic algorithm, leading to a possible leakage of sensitive information.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.ninjaframework:ninja-core"
},
"versions": [
"7.0.0"
]
}
],
"aliases": [
"CVE-2024-36823"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": true,
"github_reviewed_at": "2024-06-07T19:36:27Z",
"nvd_published_at": "2024-06-06T22:15:10Z",
"severity": "MODERATE"
},
"details": "The encrypt() function of Ninja Core v7.0.0 was discovered to use a weak cryptographic algorithm, leading to a possible leakage of sensitive information.",
"id": "GHSA-92wp-jghr-hh87",
"modified": "2024-06-07T19:36:27Z",
"published": "2024-06-07T00:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36823"
},
{
"type": "WEB",
"url": "https://github.com/ninjaframework/ninja/issues/759"
},
{
"type": "PACKAGE",
"url": "https://github.com/ninjaframework/ninja"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Weak encryption in Ninja Core"
}
GHSA-92WQ-Q9PQ-GW47
Vulnerability from github – Published: 2023-05-17 17:07 – Updated: 2023-05-25 19:07Impact
Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph <v23.0.0 are affected.
Patches
This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.
Workarounds
Store existing audit logs in a secure location. For extra security, encrypt using a tool like gpg.
References
See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/dgraph-io/dgraph"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "23.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-31135"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": true,
"github_reviewed_at": "2023-05-17T17:07:40Z",
"nvd_published_at": "2023-05-17T18:15:09Z",
"severity": "MODERATE"
},
"details": "### Impact\nExisting Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph \u003cv23.0.0 are affected.\n\n### Patches\nThis issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0.\n\n### Workarounds\nStore existing audit logs in a secure location. For extra security, encrypt using a tool like `gpg`.\n\n### References\nSee https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.",
"id": "GHSA-92wq-q9pq-gw47",
"modified": "2023-05-25T19:07:49Z",
"published": "2023-05-17T17:07:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/dgraph-io/dgraph/security/advisories/GHSA-92wq-q9pq-gw47"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31135"
},
{
"type": "WEB",
"url": "https://github.com/dgraph-io/dgraph/pull/8323"
},
{
"type": "WEB",
"url": "https://en.wikipedia.org/wiki/Cryptographic_nonce"
},
{
"type": "PACKAGE",
"url": "https://github.com/dgraph-io/dgraph"
},
{
"type": "WEB",
"url": "https://github.com/dgraph-io/dgraph/releases/tag/v23.0.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Dgraph Audit Log Encryption Vulnerability"
}
GHSA-93F9-WG2H-R6P5
Vulnerability from github – Published: 2022-05-24 17:34 – Updated: 2026-05-29 15:30A CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryption key when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller.
{
"affected": [],
"aliases": [
"CVE-2020-7565"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-19T22:15:00Z",
"severity": "HIGH"
},
"details": "A CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryption key when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller.",
"id": "GHSA-93f9-wg2h-r6p5",
"modified": "2026-05-29T15:30:23Z",
"published": "2022-05-24T17:34:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7565"
},
{
"type": "WEB",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-343-04"
},
{
"type": "WEB",
"url": "https://www.se.com/ww/en/download/document/SEVD-2020-315-05"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Use an encryption scheme that is currently considered to be strong by experts in the field.
CAPEC-112: Brute Force
In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset.
CAPEC-192: Protocol Analysis
An adversary engages in activities to decipher and/or decode protocol information for a network or application communication protocol used for transmitting information between interconnected nodes or systems on a packet-switched data network. While this type of analysis involves the analysis of a networking protocol inherently, it does not require the presence of an actual or physical network.
CAPEC-20: Encryption Brute Forcing
An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext.