CWE-326 vulnerabilities

The Password Reset with Code for WordPress REST API WordPress plugin before 0.0.17 does not use cryptographically sound algorithms to generate OTP codes, potentially leading to account takeovers.

jsrsasign v11.1.0 was discovered to contain weak encryption. NOTE: this issue has been disputed by a third party who believes that CVE IDs can be assigned for key lengths in specific applications that use a library, and should not be assigned to the default key lengths in a library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant to recommend an outcome for this CVE Record.

IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 could allow malicious actors to view and modify information coming to and from the application which could then be used to access confidential information on the device or network by using a the deprecated or misconfigured AFNetworking library at runtime.

Brocade ASCG before 3.3.0 allows for the use of medium strength cryptography algorithms on internal ports ports 9000 and 8036.

Weak server key used for TLS encryption. The following products are affected: Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 39938.

CVE-2025-22446 is a medium severity vulnerability in the Edge Orchestrator software for Intel Tiber Edge Platform. It involves inadequate encryption strength that may allow an authenticated user with adjacent network access to escalate privileges. The vulnerability does not require user interaction and has limited impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. No affected versions or patch information are provided.

Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. `cmd/dex/serve.go` line 425 seemingly sets TLS 1.2 as minimum version, but the whole `tlsConfig` is ignored after `TLS cert reloader` was introduced in v2.37.0. Configured cipher suites are not respected either. This issue is fixed in Dex 2.38.0.

CVE-2023-4333 is a vulnerability in the Broadcom LSI Storage Authority (LSA) RAID Controller web interface where the server does not enforce SSL cipher ordering. This weakness relates to inadequate encryption strength (CWE-326), potentially allowing weaker ciphers to be negotiated during SSL/TLS sessions.