Home / CVEs
CVE Database
Published vulnerabilities with severity, known exploitation and official sources.
CVE-2018-18325
High · 7.5
KEV Urgent · 79 Public exploit CWE-326 Jul 3, 2019
DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability
DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.
CVE-2018-15811
High · 7.5
KEV Urgent · 79 Public exploit CWE-326 Jul 3, 2019
DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability
DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
CVE-2017-1000486
Critical · 9.8
KEV Urgent · 93 Public exploit CWE-326 Jan 3, 2018
Primetek Primefaces Remote Code Execution Vulnerability
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
CVE-2017-11317
Critical · 9.8
KEV Urgent · 83 Public exploit CWE-326 Aug 23, 2017
Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
CVE-2011-3389
Medium · 4.3
Public exploit CWE-326 Sep 6, 2011
Inadequate Encryption Strength in Google Chrome
The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.