Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,531

Export CSV
CVE-2017-7526

libgcrypt: Use of left-to-right sliding window method allows full RSA key recovery

libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used.

CVSS 3.0 · 6.1 Medium EPSS 3.8% KEV · Not listed
Vendors
Canonical Debian Gnupg
Products
Ubuntu Linux Debian Linux Libgcrypt
CVE-2013-6673

Mozilla: Trust settings for built-in roots ignored during EV certificate validation (MFSA 2013-113)

Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 do not recognize a user's removal of trust from an EV X.509 certificate, which makes it easier for man-in-the-middle attackers to spoof SSL servers in opportunistic circumstances via a valid certificate that is unacceptable to the user.

CVSS 3.1 · 5.9 Medium EPSS 2.9% KEV · Not listed
Vendors
Canonical Fedoraproject Mozilla and 2 more
Products
Ubuntu Linux Fedora Firefox and 6 more
CVE-2014-5419

GE Multilink Use of Hard-coded Cryptographic Key

GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware 4.2.1 and earlier and Multilink ML810, ML3000, and ML3100 switches with firmware 5.2.0 and earlier use the same RSA private key across different customers' installations, which makes it easier for remote attackers to obtain the cleartext content of network traffic by reading this key from a firmware image and then sniffing the network.

CVSS 2.0 · 10 Critical EPSS 2.4% KEV · Not listed
Vendors
Ge
Products
Multilink Ml1200 Multilink Ml1200 Firmware Multilink Ml1600 and 11 more
CVE-2014-5413

Schneider Electric SCADA Expert ClearSCADA Cryptographic Issues

Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 uses the MD5 algorithm for an X.509 certificate, which makes it easier for remote attackers to spoof servers via a cryptographic attack against this algorithm.

CVSS 2.0 · 6.4 Medium EPSS 1.0% KEV · Not listed
Vendors
Aveva Schneider-electric
Products
Clearscada Scada Expert Clearscada
CVE-2014-5403

Hospira MedNet Use of Hard-coded Cryptographic Key

Hospira MedNet before 6.1 uses hardcoded cryptographic keys for protection of data transmission from infusion pumps, which allows remote attackers to obtain sensitive information by sniffing the network.

CVSS 2.0 · 6.8 Medium EPSS 1.7% KEV · Not listed
Vendors
Hospira
Products
Mednet
CVE-2025-9239

elunez eladmin DES Key EncryptUtils.java EncryptUtils inadequate encryption

A vulnerability was identified in elunez eladmin up to 2.7. Affected by this vulnerability is the function EncryptUtils of the file eladmin-common/src/main/java/me/zhengjie/utils/EncryptUtils.java of the component DES Key Handler. The manipulation of the argument STR_PARAM with the input Passw0rd leads to inadequate encryption strength. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitation appears to be difficult.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Eladmin Elunez
Products
Eladmin Eladmin
CVE-2025-11640

Tomofun Furbo 360/Furbo Mini Bluetooth Low Energy cleartext transmission

A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. This affects an unknown function of the component Bluetooth Low Energy. The manipulation results in cleartext transmission of sensitive information. Access to the local network is required for this attack. Attacks of this nature are highly complex. The exploitability is reported as difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Furbo Tomofun
Products
Furbo 360 Dog Camera Furbo 360 Dog Camera Firmware Furbo Mini and 3 more
CVE-2014-2379

Sensys Networks Traffic Sensor Missing Encryption of Sensitive Data

Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not use encryption, which allows remote attackers to interfere with traffic control by replaying transmissions on a wireless network.

CVSS 2.0 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sensysnetworks
Products
Trafficdot Vds Vsn240-f and 1 more
CVE-2014-0786

Ecava IntegraXor Information Exposure

Ecava IntegraXor before 4.1.4393 allows remote attackers to read cleartext credentials for administrative accounts via SELECT statements that leverage the guest role.

CVSS 2.0 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Ecava
Products
Integraxor
CVE-2025-9828

Tenda CP6 uhttp sub_2B7D04 risky encryption

A vulnerability was determined in Tenda CP6 11.10.00.243. The affected element is the function sub_2B7D04 of the component uhttp. Executing manipulation can lead to risky cryptographic algorithm. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tenda
Products
Cp6 Cp6 Firmware
CVE-2025-9146

Linksys E5600 Firmware checkFw.sh verify_gemtek_header risky encryption

A flaw has been found in Linksys E5600 1.1.0.26. The affected element is the function verify_gemtek_header of the file checkFw.sh of the component Firmware Handler. Executing manipulation can lead to risky cryptographic algorithm. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is described as difficult. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Linksys
Products
E5600 E5600 Firmware
CVE-2025-8741

macrozheng mall login cleartext transmission

A vulnerability was found in macrozheng mall up to 1.0.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/login. The manipulation leads to cleartext transmission of sensitive information. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Macrozheng
Products
Mall
CVE-2025-0784

Intelbras InControl Registered User usuario cleartext transmission

A vulnerability has been found in Intelbras InControl up to 2.21.58 and classified as problematic. This vulnerability affects unknown code of the file /v1/usuario/ of the component Registered User Handler. The manipulation leads to cleartext transmission of sensitive information. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.21.59 is able to address this issue. It is recommended to upgrade the affected component.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Intelbras
Products
Incontrol Incontrol Web
CVE-2025-8205

Comodo Dragon IP DNS Leakage Detector cleartext transmission

A vulnerability, which was classified as problematic, has been found in Comodo Dragon up to 134.0.6998.179. Affected by this issue is some unknown functionality of the component IP DNS Leakage Detector. The manipulation leads to cleartext transmission of sensitive information. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Comodo
Products
Dragon
CVE-2012-4687

Post Oak Bluetooth Traffic Systems Insufficient Entropy

Post Oak AWAM Bluetooth Reader Traffic System does not use a sufficient source of entropy for private keys, which makes it easier for man-in-the-middle attackers to spoof a device by predicting a key value.

CVSS 2.0 · 7.6 High EPSS 1.5% KEV · Not listed
Vendors
Postoaktraffic
Products
Awam Bluetooth Reader
CVE-2012-4898

Tropos Wireless Mesh Routers Insufficient Entropy

Mesh OS before 7.9.1.1 on Tropos wireless mesh routers does not use a sufficient source of entropy for SSH keys, which makes it easier for man-in-the-middle attackers to spoof a device or modify a client-server data stream by leveraging knowledge of a key from a product installation elsewhere.

CVSS 2.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Tropos
Products
1310 Distrubution Automation Mesh Router 1410 Mesh Router 1410 Wireless Mesh Router and 6 more
CVE-2012-5862

Sinapsi eSolar Hard-Coded Password

These Sinapsi devices store hard-coded passwords in the PHP file of the device. By using the hard-coded passwords in the device, attackers can log into the device with administrative privileges. This could allow the attacker to have unauthorized access.

CVSS 2.0 · 10 Critical EPSS 12.1% KEV · Not listed
Vendors
Sinapsitech
Products
Esolar Duo Photovoltaic System Monitor Esolar Light Photovoltaic System Monitor Esolar Photovoltaic System Monitor and 1 more
CVE-2025-5136

Tmall Demo Payment Identifier pay random values

A vulnerability, which was classified as problematic, was found in Tmall Demo up to 20250505. This affects an unknown part of the file /tmall/order/pay/ of the component Payment Identifier Handler. The manipulation leads to insufficiently random values. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Project Team
Products
Tmall Demo