Browse / Cryptography

Cryptography

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Cryptographic Issues - Generic223
• Improper Certificate Validation69
• Man-in-the-Middle33
• Use of a Broken or Risky Cryptographic Algorithm14
• Missing Required Cryptographic Step11
• Improper Validation of Certificate with Host Mismatch8
• Inadequate Encryption Strength7
• Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)6
• Use of Hard-coded Cryptographic Key5
• Use of Insufficiently Random Values5
• Improper Check for Certificate Revocation5
• Reusing a Nonce, Key Pair in Encryption4
• Use of a Key Past its Expiration Date4
• Improper Verification of Cryptographic Signature3
• Reliance on Reverse DNS Resolution for a Security-Critical Action2
• Exploiting Incorrectly Configured SSL/TLS2
• Insufficient Verification of Data Authenticity1
• Reversible One-Way Hash1
• Improper Validation of Certificate Expiration1
• Improper Following of a Certificate's Chain of Trust1

Most upvoted Cryptography reports

AllValidInformativeN/ADuplicate

1. `Curl_socketpair()` fallback vulnerable to man-in-the-middle attackInformativeMan-in-the-Middle · curl
   45 votes
2. Invisible Salamanders Attack against end_to_end_encryption in NextcloudInformativeUse of a Broken or Risky Cryptographic Algorithm · medium · Nextcloud
   38 votes
3. Apple SecTrust legacy path accepts untrusted certificates on pre-10.14 macOS/iOS when built with USE_APPLE_SECTRUSTInformativeImproper Certificate Validation · high · curl
   30 votes
4. Missing AES-GCM Authentication Tag Validation and Improper Deprecation HandlingInformativeMissing Required Cryptographic Step · high · Node.js
   24 votes
5. Missing HMAC validation on /uninstall webhook in Shopify/sample-django-app reference templateInformativeImproper Verification of Cryptographic Signature · Shopify
   18 votes
6. LM Challenge-Response Hash Always Sent in SMB AuthenticationInformativeReversible One-Way Hash · medium · curl
   18 votes
7. curl built with GnuTLS backend defaults to weak crypto parametersInformativeInadequate Encryption Strength · curl
   18 votes
8. SSL session-cache peer key omits signature_algorithms: strict-sigalg handle silently resumes a permissive sibling's sessionInformativeImproper Certificate Validation · curl
   17 votes
9. Certificate Hostname Validation Bypass via Leading Dot in HostnameInformativeImproper Certificate Validation · medium · curl
   17 votes
10. TLS session cache case-folds CA paths and bypasses the active trust profileInformativeImproper Certificate Validation · medium · curl
    15 votes
11. OpenSSL TLS 1.2 session resumption accepts expired server certificates in libcurlInformativeImproper Validation of Certificate Expiration · curl
    14 votes
12. CURLOPT_PROXY_CRLFILE / CURLOPT_PROXY_ISSUERCERT / CURLOPT_PROXY_ISSUERCERT_BLOB silently ignored on backends that don't support themInformativeImproper Check for Certificate Revocation · low · curl
    14 votes
13. Predictable Random Number GeneratorInformativeUse of Cryptographically Weak Pseudo-Random Number Generator (PRNG) · medium · Nextcloud
    12 votes
14. Double-free vulnerability in libcurl with rustls via NoServerCertVerifier condition leads to application crashInformativeCryptographic Issues - Generic · curl
    11 votes
15. Domain does not Match SSL CertificateInformativeMan-in-the-Middle · Urban Dictionary
    11 votes
16. 29: CURLOPT_ISSUERCERT accepts a different-key certificate when issuer metadata collidesInformativeCryptographic Issues - Generic · curl
    10 votes
17. 08: CVE-2026-7009 fix incomplete for AWS-LC: `--cert-status` bypass on SecTrust pathInformativeImproper Certificate Validation · curl
    9 votes
18. 06: Incomplete fix for CVE-2026-7009: GCC/SecTrust builds silently discard stapled OCSP responsesInformativeImproper Certificate Validation · curl
    9 votes
19. blockstack.org - is vulnerable to (CVE-2016-2183, CVE-2016-6329)InformativeCryptographic Issues - Generic · Hiro
    9 votes
20. Broken authentication and invalidated email address leads to account takeoverInformativeCryptographic Issues - Generic · X / xAI
    9 votes
21. Coinbase Android Security VulnerabilitiesInformativeCryptographic Issues - Generic · Coinbase
    9 votes
22. HSTS cache file: three trailing dots silently disable HSTS for that hostInformativeImproper Certificate Validation · medium · curl
    8 votes
23. TLS session cache key omits native_ca_store: a session validated with CURLSSLOPT_NATIVE_CA can be resumed by a transfer that disabled it (incomplete fInformativeImproper Certificate Validation · low · curl
    6 votes
24. Timing Attack in Google Authenticator - Per User PromptInformativeCryptographic Issues - Generic · high · Ian Dunn
    $256 votes
25. wolfSSL TLS sessions retain native-CA trust after the application narrows trustInformativeImproper Certificate Validation · low · curl
    5 votes
26. OpenSSL ENGINE selection omitted from mTLS connection matchingInformativeCryptographic Issues - Generic · low · curl
    5 votes
27. Gratipay uses the random module's cryptographically insecure PRNG.InformativeCryptographic Issues - Generic · Gratipay
    5 votes
28. Substantially weakened authenticity verification when using 'Remember me for a week'InformativeCryptographic Issues - Generic · HackerOne
    5 votes
29. Misconfigured crossdomain.xml - vimeo.comInformativeCryptographic Issues - Generic · Vimeo
    5 votes
30. Bruteforce protection not enabled on the login page https://www.irccloud.com/InformativeCryptographic Issues - Generic · IRCCloud
    5 votes
31. Man in the middle leading to root privilege escalation using hostNetwork=true (CAP_NET_RAW considered harmful)InformativeMan-in-the-Middle · medium · Kubernetes
    4 votes
32. Link obfuscation bugInformativeCryptographic Issues - Generic · low · Brave Software
    4 votes
33. SWEET32 TLS attackInformativeCryptographic Issues - Generic · Legal Robot
    4 votes
34. Cross site Port Scanning bug in twitter developers console InformativeCryptographic Issues - Generic · X / xAI
    4 votes
35. MD5 used for Key-Auth signaturesInformativeCryptographic Issues - Generic · WP API
    4 votes
36. (lack of) smtp transport layer securityInformativeCryptographic Issues - Generic · HackerOne
    4 votes
37. 10: CURLOPT_MAXLIFETIME_CONN bypass on active HTTP/2 connectionsInformativeImproper Certificate Validation · curl
    3 votes
38. Vulnerability Report - sweet32 UPchieveInformativeCryptographic Issues - Generic · UPchieve
    3 votes
39. Net::SMTP with tls allows forged certificates as long as the hostname matchesInformativeImproper Certificate Validation · medium · Ruby
    3 votes
40. No Email VerificationInformativeImproper Certificate Validation · medium · Infogram
    3 votes
41. federalist.18f.gov vulnerable to Sweet32 attackInformativeMan-in-the-Middle · medium · GSA Bounty
    3 votes
42. SSL/TLS Vulnerability at khanacademy.orgInformativeCryptographic Issues - Generic · high · Khan Academy
    3 votes
43. [URGENT] Password reset emails are sent in clear-text (without encryption)InformativeCryptographic Issues - Generic · Paragon Initiative Enterprises
    3 votes
44. Open Url redirection on login with facebookInformativeCryptographic Issues - Generic · Imgur
    3 votes
45. Lack of SSL Pinning on POS Application ( iOS )InformativeCryptographic Issues - Generic · Shopify
    3 votes
46. uclfinal.twitter.com and euro2012.twitter.com are vulnerable to CRIME attackInformativeCryptographic Issues - Generic · X / xAI
    3 votes
47. Registration Allows Disposable Email AddressesInformativeCryptographic Issues - Generic · Legal Robot
    2 votes
48. sweet32 InformativeCryptographic Issues - Generic · Udemy
    2 votes
49. Nextcloud.com is vulnerable to SWEET32 attackInformativeCryptographic Issues - Generic · Nextcloud
    2 votes
50. Yelp.com is vulnerable to SWEET32 attackInformativeCryptographic Issues - Generic · Yelp
    2 votes
51. faspex.uber.com uses an invalid SSL certificateInformativeCryptographic Issues - Generic · Uber
    2 votes
52. Directory Listing On download.nextcloud.com & Practical Attacks on PGP (Pretty Good Privacy) InformativeCryptographic Issues - Generic · Nextcloud
    2 votes
53. SSL/TLS BEAST ATTACKInformativeCryptographic Issues - Generic · drchrono
    2 votes
54. SPF Protection not used, I can hijack your email serverInformativeCryptographic Issues - Generic · Gratipay
    2 votes
55. Missing HSTS header in https://app.simplenote.comInformativeCryptographic Issues - Generic · Automattic
    2 votes
56. TLS1/SSLv3 Renegotiation VulnerabilityInformativeCryptographic Issues - Generic · Slack
    2 votes
57. Download of (later executed) .NET installer over insecure channelInformativeMan-in-the-Middle · low · Brave Software
    1 votes
58. Uncloaking hidden services and hidden service usersInformativeMan-in-the-Middle · Tor
    1 votes
59. POODLE SSLv3.0InformativeCryptographic Issues - Generic · Gratipay
    1 votes
60. Using plain git protocol (vulnerable to MITM)InformativeCryptographic Issues - Generic · Paragon Initiative Enterprises
    1 votes
61. Missing HSTS header in https://public-api.wordpress.comInformativeCryptographic Issues - Generic · Automattic
    1 votes
62. Captcha bypass with extension at http://www.mopub.com/about/contact/InformativeCryptographic Issues - Generic · X / xAI
    1 votes
63. curl successfully matches IP address literal in URL against IP address literal in certificate Common NameInformativeImproper Certificate Validation · curl
64. Only OpenSSL handles a CRL when passed in via CApath InformativeImproper Certificate Validation · high · curl
65. Improper Certificate ValidationInformativeImproper Certificate Validation · low · PortSwigger Web Security
66. SSL BREACH attack (CVE-2013-3587)InformativeCryptographic Issues - Generic · low · Legal Robot
67. Directory Listing on grtp.coInformativeCryptographic Issues - Generic · Gratipay
68. Potential for Double Spend via Sign Message UtilityInformativeCryptographic Issues - Generic · Coinbase