Browse / Cryptography

Cryptography

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Cryptographic Issues - Generic223
• Improper Certificate Validation69
• Man-in-the-Middle33
• Use of a Broken or Risky Cryptographic Algorithm14
• Missing Required Cryptographic Step11
• Improper Validation of Certificate with Host Mismatch8
• Inadequate Encryption Strength7
• Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)6
• Use of Hard-coded Cryptographic Key5
• Use of Insufficiently Random Values5
• Improper Check for Certificate Revocation5
• Reusing a Nonce, Key Pair in Encryption4
• Use of a Key Past its Expiration Date4
• Improper Verification of Cryptographic Signature3
• Reliance on Reverse DNS Resolution for a Security-Critical Action2
• Exploiting Incorrectly Configured SSL/TLS2
• Insufficient Verification of Data Authenticity1
• Reversible One-Way Hash1
• Improper Validation of Certificate Expiration1
• Improper Following of a Certificate's Chain of Trust1

Most upvoted Cryptography reports

AllValidInformativeN/ADuplicate

1. Infromation Disclosure To Use of Hard-coded Cryptographic KeyDuplicateUse of Hard-coded Cryptographic Key · medium · Reddit
   238 votes
2. Key Reinstallation Attacks: Breaking WPA2 by forcing nonce reuseReusing a Nonce, Key Pair in Encryption · medium · Internet Bug Bounty
   191 votes
3. Slack DTLS uses a private key that is in the public domain, which may lead to SRTP stream hijackUse of Hard-coded Cryptographic Key · high · Slack
   $2,000170 votes
4. Build fetches jars over HTTPMan-in-the-Middle · medium · PortSwigger Web Security
   $1,000135 votes
5. Account takeover due to misconfigurationUse of a Key Past its Expiration Date · low · Mattermost
   133 votes
6. [3DS][SSL] Improper certificate validation allows an attacker to perform MitM attacksImproper Certificate Validation · Nintendo
   129 votes
7. Multiple Subdomain Takeovers: fly.staging.shipt.com, fly.us-west-2.staging.shipt.com, fly.us-east-1.staging.shipt.comReliance on Reverse DNS Resolution for a Security-Critical Action · Shipt
   128 votes
8. connect.8x8.com/api/v1: JWT Algorithm Confusion VulnerabilityImproper Verification of Cryptographic Signature · high · 8x8
   $1,337111 votes
9. elections.k8s.io uses weak session secret key, may place elections at riskCryptographic Issues - Generic · high · Kubernetes
   $25086 votes
10. Integrity checks according to policies can be circumvented in Node.js 20 and Node.js 18Insufficient Verification of Data Authenticity · medium · Internet Bug Bounty
    $1,27082 votes
11. Invite tokens have Insufficient entropy in GHES Management Console Use of Insufficiently Random Values · medium · GitHub
    81 votes
12. SMTP interaction theft via MITMCryptographic Issues - Generic · medium · PortSwigger Web Security
    78 votes
13. AWS Credentials leaked: access to production database backups, SSL certs and moreCryptographic Issues - Generic · ██████
    78 votes
14. Grammarly Keyboard for Android "Authorization Code with PKCE" flow implementation vulnerability that allows account takeoverUse of Cryptographically Weak Pseudo-Random Number Generator (PRNG) · medium · Superhuman (formerly Grammarly)
    76 votes
15. SameSite restrictions are lifted, and SameSite:Strict cookie are being sent.Improper Certificate Validation · high · Brave Software
    73 votes
16. HMAC signature verification omits endpoint and payload allowing request forgery on CoinMate APIMissing Required Cryptographic Step · low · CoinMate.io
    66 votes
17. Takeover of hackerone.engineering via Medium Reliance on Reverse DNS Resolution for a Security-Critical Action · low · HackerOne
    63 votes
18. Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoSCryptographic Issues - Generic · high · Node.js
    59 votes
19. 0 Click account takeover via timed requests to ███████forgot-password (single-packet attack)Use of a Broken or Risky Cryptographic Algorithm · high · Mars
    58 votes
20. Able to change password by entering wrong old passwordCryptographic Issues - Generic · Stripo Inc
    56 votes
21. Splatoon 3 Anticheat Seed Randomization WeaknessUse of Cryptographically Weak Pseudo-Random Number Generator (PRNG) · Nintendo
    55 votes
22. CVE-2025-5025: No QUIC certificate pinning with wolfSSLImproper Certificate Validation · medium · curl
    54 votes
23. Man-in-the-middle through broken SSL certificate verificationMan-in-the-Middle · medium · Nintendo
    53 votes
24. HashDoS in V8Cryptographic Issues - Generic · high · Node.js
    53 votes
25. CVE-2020-8286: Inferior OCSP verificationImproper Certificate Validation · medium · curl
    51 votes
26. Mystery with a leaked token and Reusability of email confirmation link leading to Account TakeoverInadequate Encryption Strength · low · Sorare
    $30049 votes
27. CVE-2024-2466: TLS certificate check bypass with mbedTLS (reward request)Improper Certificate Validation · medium · Internet Bug Bounty
    $2,58048 votes
28. [smena.samokat.ru] Predictable JWT secretInadequate Encryption Strength · Mail.ru
    47 votes
29. In App purchase Hack Use of a Key Past its Expiration Date · critical · Kaspersky
    47 votes
30. `Curl_socketpair()` fallback vulnerable to man-in-the-middle attackInformativeMan-in-the-Middle · curl
    45 votes
31. The POODLE attack (SSLv3 supported) at status.slack.comCryptographic Issues - Generic · medium · Slack
    44 votes
32. CVE-2025-10966: missing SFTP host verification with wolfSSHImproper Certificate Validation · low · curl
    43 votes
33. CVE-2025-4947: QUIC certificate check skip with wolfSSLImproper Validation of Certificate with Host Mismatch · medium · curl
    43 votes
34. SSL certificate not validated when registering with a providerCryptographic Issues - Generic · medium · Nextcloud
    $30043 votes
35. iOS group chat denial of serviceUse of a Broken or Risky Cryptographic Algorithm · low · LY Corporation
    $30042 votes
36. Web protection component in Anti-Virus products family ignores HSTS security policyMan-in-the-Middle · medium · Kaspersky
    41 votes
37. Type Juggling -> PHP Object Injection -> SQL Injection ChainCryptographic Issues - Generic · ExpressionEngine
    40 votes
38. Twitter iOS fails to validate server certificate and sends oauth tokenCryptographic Issues - Generic · high · X / xAI
    $2,10040 votes
39. burp does not validate the common name of the presented collaborator server certificateMan-in-the-Middle · medium · PortSwigger Web Security
    $1,50039 votes
40. Invisible Salamanders Attack against end_to_end_encryption in NextcloudInformativeUse of a Broken or Risky Cryptographic Algorithm · medium · Nextcloud
    38 votes
41. curl Missing Sec-WebSocket-Accept Verification Enables MITM WebSocket Session HijackingN/AMan-in-the-Middle · curl
    37 votes
42. HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934)Exploiting Incorrectly Configured SSL/TLS · medium · Node.js
    37 votes
43. `check_reserve_proof` sums RingCT ECDH amounts without checking the output commitmentMissing Required Cryptographic Step · medium · Monero
    37 votes
44. Improper error handling in async cryptographic operations crashes processCryptographic Issues - Generic · high · Node.js
    37 votes
45. Weak ssh algorithms and CVE-2023-48795 Discovered on various subdomains of nextcloud.comUse of a Broken or Risky Cryptographic Algorithm · medium · Nextcloud
    37 votes
46. CVE-2024-2379: QUIC certificate check bypass with wolfSSLImproper Certificate Validation · low · Internet Bug Bounty
    $56037 votes
47. CVE-2024-8096: OCSP stapling bypass with GnuTLSImproper Certificate Validation · medium · curl
    36 votes
48. registry.nodejs.org Subdomain TakeoverMan-in-the-Middle · Node.js
    35 votes
49. DiffieHellman doesn't generate keys after setting a keyCryptographic Issues - Generic · medium · Internet Bug Bounty
    $1,80034 votes
50. Acronis True Image (Windows) does not validate server certificate on a TLS connectionImproper Certificate Validation · high · Acronis
    $50034 votes
51. CVE-2026-7009: OCSP stapling bypass with Apple SecTrustImproper Certificate Validation · medium · curl
    33 votes
52. on the implications of permitting procedural cullingN/AUse of Insufficiently Random Values · low · curl
    33 votes
53. [Critical] billion dollars issueSpamMan-in-the-Middle · critical · Paragon Initiative Enterprises
    32 votes
54. ssl info shown N/ACryptographic Issues - Generic · Paragon Initiative Enterprises
    32 votes
55. SSL options ISSUERCERT, EC_CURVES and CRLFILE silently ignored by non-OpenSSL backendsN/AMissing Required Cryptographic Step · medium · curl
    31 votes
56. Apple SecTrust legacy path accepts untrusted certificates on pre-10.14 macOS/iOS when built with USE_APPLE_SECTRUSTInformativeImproper Certificate Validation · high · curl
    30 votes
57. CVE-2025-10148: predictable WebSocket maskReusing a Nonce, Key Pair in Encryption · low · curl
    30 votes
58. TLS certificate hostname bypass when the IP is written fullwidth digitsImproper Certificate Validation · high · Node.js
    29 votes
59. ID4ME does not validate signature or expirationImproper Verification of Cryptographic Signature · medium · Nextcloud
    $75029 votes
60. Node.js: TLS session reuse can lead to hostname verification bypassMan-in-the-Middle · high · Node.js
    29 votes
61. Passive mixed content issues on the site https://*.fanduel.comMan-in-the-Middle · low · FanDuel
    $10029 votes
62. SpendProofV1 txid-substitution: get_spend_proof/check_spend_proof do not verify returned transaction hashMissing Required Cryptographic Step · medium · Monero
    28 votes
63. POODLE SSLv3 bug on multiple twitter smtp servers (mx3.twitter.com,199.59.148.204,199.16.156.108 and 199.59.148.204)Cryptographic Issues - Generic · X / xAI
    28 votes
64. X-E2EE-SIGNATURE verification can be bypassed, leading to loss of confidentiality of end-to-end encrypted filesImproper Certificate Validation · medium · Nextcloud
    27 votes
65. Hardware Wallets Do Not Check Unlock TImeMan-in-the-Middle · medium · Monero
    27 votes
66. Insufficient DKIM record with RSA 512-bit key used on WordPress.comInadequate Encryption Strength · medium · Automattic
    27 votes
67. Default Minimum TLS Version Set to TLS v1.0 (Cryptographic Weakness)N/AUse of a Broken or Risky Cryptographic Algorithm · medium · curl
    26 votes
68. CVE-2019-1551: rsaz_512_sqr overflow bug on x86_64Cryptographic Issues - Generic · Internet Bug Bounty
    26 votes
69. Predictable proposal participant tokens enable unauthorized access and vote submissionUse of Insufficiently Random Values · low · Nextcloud
    $10025 votes
70. TLS certificate hostname bypass when the host loosely resolves to an IP addressImproper Certificate Validation · high · Node.js
    24 votes
71. curl GnuTLS backend accepts a clientAuth-only certificate for HTTPS server authenticationN/AImproper Certificate Validation · medium · curl
    24 votes
72. Missing AES-GCM Authentication Tag Validation and Improper Deprecation HandlingInformativeMissing Required Cryptographic Step · high · Node.js
    24 votes
73. Usage of unsafe random function in undici for choosing boundaryUse of Insufficiently Random Values · medium · Node.js
    24 votes
74. Disk-o Cloud application (Windows) does not validate server certificate on a TLS connectionImproper Certificate Validation · Mail.ru
    $2,50024 votes
75. Local File Include on marketing-dam.yahoo.comCryptographic Issues - Generic · Yahoo!
    24 votes
76. GnuTLS OCSP stapling accepts unrelated SingleResponse (no cert-ID binding)N/AImproper Certificate Validation · high · curl
    23 votes
77. The initial E2EE password generated by Rocket.Chat mobile can be recovered in a practical timescale.Use of Insufficiently Random Values · high · Rocket.Chat
    23 votes
78. CVE-2024-0853: OCSP verification bypass with TLS session reuseImproper Check for Certificate Revocation · low · curl
    23 votes
79. Sauce Labs API key unencrypted in an old commitDuplicateUse of Hard-coded Cryptographic Key · medium · Ruby on Rails
    23 votes
80. Phabricator is vulnerable to padding oracle attacks and chosen-ciphertext attacks.Missing Required Cryptographic Step · medium · Phabricator
    $75023 votes
81. TLS Virtual Host ConfusionCryptographic Issues - Generic · Internet Bug Bounty
    23 votes
82. Able to bypass HSTS using trailing dotN/AMissing Required Cryptographic Step · medium · curl
    22 votes
83. Length extension attack leading to HTML injectionCryptographic Issues - Generic · medium · Eternal
    $10022 votes
84. CBC "cut and paste" attack may cause Open Redirect(even XSS)Cryptographic Issues - Generic · Uber
    $50022 votes
85. Use of a Broken or Risky Cryptographic Algorithm (CWE-327) in libcurlN/AUse of a Broken or Risky Cryptographic Algorithm · curl
    21 votes
86. Secure Client-Initiated RenegotiationCryptographic Issues - Generic · LocalTapiola
    21 votes
87. Built-in TLS module unexpectedly treats "rejectUnauthorized: undefined" as "rejectUnauthorized: false", disabling all certificate validationImproper Certificate Validation · low · Node.js
    $15020 votes
88. Command Injection via STARTTLS in SMTPCryptographic Issues - Generic · Open-Xchange
    $35020 votes
89. Some build dependencies are downloaded over an insecure channel (without subsequent integrity checks)Cryptographic Issues - Generic · high · Internet Bug Bounty
    $10020 votes
90. Insecure HostnameVerifier within WebView of Razer Pay Android (TLS Vulnerability)Improper Certificate Validation · Razer
    $75020 votes
91. OAuth2 Access Token and App Password Security VulnerabilityUse of a Key Past its Expiration Date · medium · Nextcloud
    20 votes
92. Missing Certificate Authority Authorization ruleCryptographic Issues - Generic · HackerOne
    20 votes
93. HashDoS in V8Cryptographic Issues - Generic · medium · Node.js
    19 votes
94. Active mixed content issues on the site https://stage-go.wepay.com.Man-in-the-Middle · WePay
    $10019 votes
95. Insecure SHA1withRSA in b5s.hackerone-ext-content.com and a4l.hackerone-ext-content.comUse of a Broken or Risky Cryptographic Algorithm · HackerOne
    19 votes
96. Updating and Deleting any Ads on OLX Philippines Cryptographic Issues - Generic · OLX
    19 votes
97. mbedTLS / wolfSSL / rustls backends silently skip hostname verification when CURLOPT_SSL_VERIFYPEER=0N/AImproper Validation of Certificate with Host Mismatch · medium · curl
    18 votes
98. Missing HMAC validation on /uninstall webhook in Shopify/sample-django-app reference templateInformativeImproper Verification of Cryptographic Signature · Shopify
    18 votes
99. Sandbox User Can Inject Rogue CA Certificate into OS Trust Store via Sudo-Allowed deploy-certificates.shImproper Certificate Validation · medium · AWS VDP
    18 votes
100. LM Challenge-Response Hash Always Sent in SMB AuthenticationInformativeReversible One-Way Hash · medium · curl
     18 votes