Threats Tagged 'cwe-327'

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for identical seeds, allowing attackers to reproduce encryption keys and decrypt stored API keys and authentication tokens.

HCL iControl version 3.2.0 uses weak SSL/TLS protocols, specifically TLS 1.0 and 1.1, which are outdated and lack modern security features. This weakness can expose sensitive data during transmission to known cryptographic attacks. The vulnerability is classified under CWE-327 for use of broken or risky cryptographic algorithms. The CVSS score is 4.8, indicating a medium severity level.

ANDRITZ HIPASE-250 stores and transmits user passwords using a reversible format rather than a secure one-way hash. This vulnerability allows attackers who can access the credential store or intercept network traffic to recover all stored passwords. The issue affects unspecified versions of the product. No official patch or remediation guidance is currently available. The vulnerability has a high severity rating with a CVSS score of 7.5.

HCL MyCloud was affected by the SSL/TLS LUCKY13 Vulnerability. An attacker may exploit this vulnerability to decrypt sensitive information through a TLS/SSL padding oracle attack.

HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1. These legacy protocols contain numerous cryptographic design flaws that expose data to interception and decryption. To remediate this risk, the application must disable all support for TLS 1.0 and TLS 1.1, and exclusively enable support for secure protocols, specifically TLS 1.2 and TLS 1.3.