地图 / 密码学问题（通用）

密码学问题（通用）

Cryptographic Issues - Generic · 密码学缺陷

密码学缺陷 / 密码学问题（通用）

188公开报告

—CWE 编号

0已标注发现方式

188关联报告

发现方式分布

暂无发现方式标注。

关联报告

elections.k8s.io uses weak session secret key, may place elections at riskKubernetes · 2025-09-19 · 中危 · $250 · 86 票 SMTP interaction theft via MITMPortSwigger Web Security · 2020-11-04 · 低危 · 78 票 Able to change password by entering wrong old passwordStripo Inc · 2019-12-18 · 未评级 · 56 票 HashDoS in V8Node.js · 2025-07-15 · 中危 · 53 票 The POODLE attack (SSLv3 supported) at status.slack.comSlack · 2018-11-28 · 低危 · 44 票 SSL certificate not validated when registering with a providerNextcloud · 2021-06-02 · 低危 · $300 · 43 票 Type Juggling -> PHP Object Injection -> SQL Injection ChainExpressionEngine · 2017-02-07 · 未评级 · 40 票 Twitter iOS fails to validate server certificate and sends oauth tokenX / xAI · 2016-12-23 · 中危 · $2,100 · 40 票 Improper error handling in async cryptographic operations crashes processNode.js · 2025-05-14 · 中危 · 37 票 DiffieHellman doesn't generate keys after setting a keyInternet Bug Bounty · 2023-06-30 · 低危 · $1,800 · 34 票 ssl info shownParagon Initiative Enterprises · 2016-07-05 · 未评级 · 32 票 POODLE SSLv3 bug on multiple twitter smtp servers (mx3.twitter.com,199.59.148.204,199.16.156.108 and 199.59.148.204)X / xAI · 2018-02-22 · 未评级 · 28 票 CVE-2019-1551: rsaz_512_sqr overflow bug on x86_64Internet Bug Bounty · 2024-05-09 · 未评级 · 26 票 Local File Include on marketing-dam.yahoo.comYahoo! · — · 未评级 · 24 票 Length extension attack leading to HTML injectionEternal · 2017-09-01 · 低危 · $100 · 22 票 CBC "cut and paste" attack may cause Open Redirect(even XSS)Uber · 2016-08-12 · 未评级 · $500 · 22 票 Secure Client-Initiated RenegotiationLocalTapiola · — · 未评级 · 21 票 Command Injection via STARTTLS in SMTPOpen-Xchange · — · 未评级 · $350 · 20 票 Some build dependencies are downloaded over an insecure channel (without subsequent integrity checks)Internet Bug Bounty · 2020-12-04 · 中危 · $100 · 20 票 Missing Certificate Authority Authorization ruleHackerOne · 2017-08-17 · 未评级 · 20 票 HashDoS in V8Node.js · 2026-03-30 · 低危 · 19 票 Updating and Deleting any Ads on OLX PhilippinesOLX · — · 未评级 · 19 票 Insecure password change mechanism may lead to full account takeoverFantasyTote · 2016-07-23 · 未评级 · 18 票 Missing Certificate Authority Authorization ruleHackerOne · 2019-04-11 · 低危 · 17 票 Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgeryNode.js · 2026-03-30 · 低危 · 16 票 Vulnerability Report - Missing Certificate Authority Authorization ruleMariaDB · 2018-11-11 · 低危 · 16 票 Gem signature forgeryRubyGems · 2018-08-03 · 低危 · $1,000 · 16 票 Dovecot authentication is vulnerable to timing attacks.Open-Xchange · — · 未评级 · $600 · 16 票 Invitation reminder emails contain insecure linksSlack · 2019-06-29 · 低危 · $350 · 15 票 Critical vulnerability in JSON Web Encryption (JWE) - RFC 7516 Invalid Curve attackInternet Bug Bounty · 2019-11-12 · 中危 · $1,000 · 15 票 test.zba.se is vulnerable to SSL POODLEEternal · 2017-02-27 · 低危 · 15 票 CVE-2023-23919: Multiple OpenSSL error handling issues in nodejs crypto libraryInternet Bug Bounty · 2023-03-29 · 低危 · $1,800 · 14 票 Fragmentation and Aggregation Flaws in Wi-FiInternet Bug Bounty · 2021-07-23 · 未评级 · 14 票 Insecure Transportation Security Protocol Supported (TLS 1.0) on https://www.jamieweb.netJamieWeb · 2018-05-11 · 低危 · 13 票 Cross-protocol attack on TLS using SSLv2 (DROWN) (CVE-2016-0800)Internet Bug Bounty · 2016-09-21 · 未评级 · 13 票 RCE on https://█████/ Using CVE-2017-9248U.S. Dept Of Defense · 2019-10-10 · 高危 · 12 票 APT repository is signed using weak digest (SHA-1)New Relic · — · 未评级 · 12 票 Public Facing Barracuda LoginPornhub · — · 未评级 · $250 · 12 票 SHA512 incorrect on most/many releasesKubernetes · 2021-05-09 · 低危 · 11 票 imap: StartTLS stripping attack (CVE-2016-0772).Ruby · 2021-07-08 · 低危 · 10 票 Non-secure requests to www.lahitapiola.fi are not automatically upgraded to HTTPSLocalTapiola · — · 未评级 · 10 票 Session Issue Maybe Can lead to huge loss [CRITICAL]Coinbase · 2016-02-21 · 未评级 · $1,000 · 10 票 RC4 cipher suites detectedRadancy · — · 未评级 · 10 票 blockstack.org - is vulnerable to (CVE-2016-2183, CVE-2016-6329)Hiro · 2025-10-31 · 低危 · 9 票 RCE (Remote code execution) in one of DoD's websitesU.S. Dept Of Defense · 2020-07-30 · 高危 · 9 票 Reduced purmations on encryptionNextcloud · 2020-10-28 · 低危 · 9 票 Ubuntu/Debian installation method allows key poisoning and code execution for network attackerMariaDB · 2020-01-21 · 低危 · 9 票 [Twitter Open Source] Releases were & are built/executed/tested/released in the context of insecure/untrusted codeX / xAI · 2019-12-13 · 中危 · $280 · 9 票 ShopifyAPI is vulnerable to timing attacks.Shopify · 2017-06-23 · 低危 · 9 票 Starbucks.com is reachable via ip address thus possible to link any doamin to Starbucks.Starbucks · 2017-01-26 · 低危 · 9 票 Poodle attack SSLv3 Support (viestinta.lahitapiola.fi)LocalTapiola · — · 未评级 · 9 票 Broken authentication and invalidated email address leads to account takeoverX / xAI · 2014-11-28 · 未评级 · 9 票 Coinbase Android Security VulnerabilitiesCoinbase · 2014-05-07 · 未评级 · 9 票 Apple Pay cryptogram replay and amount tamperingRBKmoney · 2021-03-10 · 中危 · 8 票 smtp service vulnerable to POODLE SSLv3MariaDB · 2019-05-11 · 低危 · 8 票 Update php-saml library to 2.10.5Nextcloud · 2017-04-27 · 低危 · 8 票 Status Bar ObfuscationBrave Software · 2016-10-15 · 低危 · 8 票 The POODLE attack (SSLv3 supported)Radancy · — · 未评级 · 8 票 Недочет в поиске по хештегамVK.com · 2018-03-04 · 低危 · 8 票 Inadequate Encryption Strength in nodejs-current reads openssl.cnf from /home/iojs/build/... upon startup on MacOSInternet Bug Bounty · 2023-04-09 · 低危 · $2,400 · 7 票 CVE-2021-22947: STARTTLS protocol injection via MITMcurl · 2021-09-24 · 低危 · 7 票 Dragonblood: Design and Implementation Flaws in WPA3 and EAP-pwdInternet Bug Bounty · 2020-05-05 · 低危 · 7 票 TOTP Key is shorter than RFC 4226 recommended minimumPhabricator · 2018-12-07 · 低危 · $300 · 7 票 Samlify is vulnerable to signature wrappingNode.js third-party modules · 2018-10-23 · 中危 · 7 票 Firefly's verify_access_token() function does a byte-by-byte comparison of HMAC values.Yelp · 2017-07-10 · 低危 · 7 票 SSLv2 doesn't block disabled ciphers (CVE-2015-3197)Internet Bug Bounty · 2016-09-21 · 未评级 · 7 票 Timing Attack in Google Authenticator - Per User PromptIan Dunn · 2017-10-29 · 中危 · $25 · 6 票 Open SMTP port can let anyone send email from mail.chihar.comWeblate · 2017-05-20 · 未评级 · 6 票 Webhook allows sending payload using insecure HTTP protocolMoneybird · 2017-06-28 · 未评级 · 6 票 No Rate Limit In Inviting Similar Contact Multiple TimesAlgolia · 2016-09-07 · 未评级 · $100 · 6 票 weak ssl cipher suitesGratipay · 2015-09-13 · 低危 · 6 票 Insecure Data Storage in Vine Android AppX / xAI · 2015-06-24 · 未评级 · $140 · 6 票 Poodle bleed vulnerability in cloud sub domainVimeo · 2015-03-05 · 未评级 · 6 票 Local file inclusionYahoo! · — · 未评级 · 6 票 Multiple OpenSSL error handling issues in nodejs crypto libraryNode.js · 2023-02-17 · 低危 · 5 票 Downgrade encryption scheme and break integrity through known-plaintext attackNextcloud · 2020-11-05 · 低危 · 5 票 Missing Certificate Authority Authorization ruleGratipay · 2017-09-09 · 未评级 · 5 票 Web server is vulnerable to Beast AttackWeblate · 2017-04-24 · 低危 · 5 票 formassembly.com is vulnerable to padding-oracle attacks.FormAssembly · 2017-03-17 · 低危 · 5 票 Gratipay uses the random module's cryptographically insecure PRNG.Gratipay · 2016-12-12 · 低危 · 5 票 RC4 cipher suites detectedRadancy · — · 未评级 · 5 票 SSL certificate invalid dateRadancy · — · 未评级 · 5 票 Missing spf flags for hackerone.comHackerOne · 2015-04-23 · 未评级 · 5 票 FREAK: Factoring RSA_EXPORT Keys to Impersonate TLS ServersInternet Bug Bounty · 2015-04-01 · 未评级 · 5 票 Substantially weakened authenticity verification when using 'Remember me for a week'HackerOne · 2015-03-12 · 未评级 · 5 票 Improper way of validating a programHackerOne · 2015-02-04 · 未评级 · 5 票 Misconfigured crossdomain.xml - vimeo.comVimeo · 2015-02-09 · 未评级 · 5 票 Bruteforce protection not enabled on the login page https://www.irccloud.com/IRCCloud · 2014-10-08 · 未评级 · 5 票 Strict Transport Security MisconfigurationReddAPI · 2014-10-28 · 未评级 · 5 票 Widespread failure of certificate validation in Android appsInternet Bug Bounty · 2019-11-12 · 未评级 · 5 票 Link obfuscation bugBrave Software · 2019-08-12 · 低危 · 4 票 █████████ - Insecure download cookie generation allows bypass of CAC authentication, access to deleted and locked filesU.S. Dept Of Defense · 2020-05-11 · 高危 · 4 票 SSL Padding Oracle On Downgraded Legacy Encryption (POODLE) VulnerabilityNew Relic · — · 未评级 · 4 票 SWEET32 TLS attackLegal Robot · 2017-02-01 · 未评级 · 4 票 GlobaLeaks is vulnerable to timing attacks.GlobaLeaks · — · 未评级 · 4 票 Information disclosure vulnerability in a DoD websiteU.S. Dept Of Defense · 2017-06-23 · 低危 · 4 票 SSL certificate public key less than 2048 bitIan Dunn · 2016-08-18 · 未评级 · 4 票 CVE-2016-0772 - python: smtplib StartTLS stripping attackInternet Bug Bounty · 2016-08-30 · 未评级 · $1,000 · 4 票 Module ngx_http_auth_basic_module is broken and allowing all password after specific lengthInternet Bug Bounty · 2016-05-30 · 未评级 · 4 票 Divide-and-conquer session key recovery in SSLv2 (CVE-2016-0703)Internet Bug Bounty · 2016-06-01 · 未评级 · 4 票

查看全部 188 份报告 →