Browse / Cryptography

Cryptography

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Cryptographic Issues - Generic223
• Improper Certificate Validation69
• Man-in-the-Middle33
• Use of a Broken or Risky Cryptographic Algorithm14
• Missing Required Cryptographic Step11
• Improper Validation of Certificate with Host Mismatch8
• Inadequate Encryption Strength7
• Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)6
• Use of Hard-coded Cryptographic Key5
• Use of Insufficiently Random Values5
• Improper Check for Certificate Revocation5
• Reusing a Nonce, Key Pair in Encryption4
• Use of a Key Past its Expiration Date4
• Improper Verification of Cryptographic Signature3
• Reliance on Reverse DNS Resolution for a Security-Critical Action2
• Exploiting Incorrectly Configured SSL/TLS2
• Insufficient Verification of Data Authenticity1
• Reversible One-Way Hash1
• Improper Validation of Certificate Expiration1
• Improper Following of a Certificate's Chain of Trust1

Most upvoted Cryptography reports

AllValidInformativeN/ADuplicate

1. curl Missing Sec-WebSocket-Accept Verification Enables MITM WebSocket Session HijackingN/AMan-in-the-Middle · curl
   37 votes
2. on the implications of permitting procedural cullingN/AUse of Insufficiently Random Values · low · curl
   33 votes
3. ssl info shown N/ACryptographic Issues - Generic · Paragon Initiative Enterprises
   32 votes
4. SSL options ISSUERCERT, EC_CURVES and CRLFILE silently ignored by non-OpenSSL backendsN/AMissing Required Cryptographic Step · medium · curl
   31 votes
5. Default Minimum TLS Version Set to TLS v1.0 (Cryptographic Weakness)N/AUse of a Broken or Risky Cryptographic Algorithm · medium · curl
   26 votes
6. curl GnuTLS backend accepts a clientAuth-only certificate for HTTPS server authenticationN/AImproper Certificate Validation · medium · curl
   24 votes
7. GnuTLS OCSP stapling accepts unrelated SingleResponse (no cert-ID binding)N/AImproper Certificate Validation · high · curl
   23 votes
8. Able to bypass HSTS using trailing dotN/AMissing Required Cryptographic Step · medium · curl
   22 votes
9. Use of a Broken or Risky Cryptographic Algorithm (CWE-327) in libcurlN/AUse of a Broken or Risky Cryptographic Algorithm · curl
   21 votes
10. mbedTLS / wolfSSL / rustls backends silently skip hostname verification when CURLOPT_SSL_VERIFYPEER=0N/AImproper Validation of Certificate with Host Mismatch · medium · curl
    18 votes
11. Free food bug done by burp suiteN/AMan-in-the-Middle · Eternal
    17 votes
12. Exposure of Hard-coded Private Keys and Credentials in curl Source Repository (CWE-321)N/AUse of Hard-coded Cryptographic Key · critical · curl
    14 votes
13. Silent TLS Trust Model Hijacking via `CURL_CA_BUNDLE` Environment Variable Leads to MITMN/AImproper Certificate Validation · critical · curl
    11 votes
14. curl allows SSH connection even if host is not in known_hostsN/AImproper Certificate Validation · high · curl
    11 votes
15. TFTP accepts a first response from an IP other than the requested serverN/AMan-in-the-Middle · low · curl
    10 votes
16. Starbucks.com is reachable via ip address thus possible to link any doamin to Starbucks.N/ACryptographic Issues - Generic · medium · Starbucks
    9 votes
17. Pinned public key check passes for a key the server does not hold with the wolfSSL backendN/AImproper Certificate Validation · low · curl
    8 votes
18. wolfSSL backend disables hostname verification when CURLOPT_SSL_VERIFYPEER is 0N/AImproper Validation of Certificate with Host Mismatch · medium · curl
    7 votes
19. Certificate Pinning Bypass with wolfSSL backend over HTTP/3N/AImproper Certificate Validation · medium · curl
    7 votes
20. --cert-status with OpenSSL accepts a stapled OCSP response of any age when it lacks nextUpdate (revoked certificate keeps passing)N/AImproper Check for Certificate Revocation · curl
    6 votes
21. Open SMTP port can let anyone send email from mail.chihar.comN/ACryptographic Issues - Generic · Weblate
    6 votes
22. TLS session cache ignores CURLOPT_SSL_CTX_FUNCTION identity and resumes one client's session for anotherN/AImproper Certificate Validation · medium · curl
    5 votes
23. i can join without user and pass in this website https://argocd.upchieve.org/settings/accountsN/AReusing a Nonce, Key Pair in Encryption · high · UPchieve
    4 votes
24. SSL certificate public key less than 2048 bitN/ACryptographic Issues - Generic · Ian Dunn
    4 votes
25. Module ngx_http_auth_basic_module is broken and allowing all password after specific lengthN/ACryptographic Issues - Generic · Internet Bug Bounty
    4 votes
26. SSH (SCP/SFTP) host-key verification is skipped on connection reuse — a pinned/known_hosts transfer silently reuses a previously-unverified connectionN/AImproper Validation of Certificate with Host Mismatch · medium · curl
    3 votes
27. OpenSSL+Apple SecTrust: SecTrust accepts certificates that the app's CURLOPT_SSL_CTX_FUNCTION trust store or verify callback rejectedN/AImproper Certificate Validation · low · curl
    3 votes
28. OpenSSL `--cert-status` accepts indefinitely stale GOOD OCSP staplesN/AImproper Check for Certificate Revocation · medium · curl
    2 votes
29. GnuTLS + Apple SecTrust discards authenticated OCSP failureN/AImproper Certificate Validation · medium · curl
    2 votes
30. Insecure TLS Configuration #3530N/AUse of a Broken or Risky Cryptographic Algorithm · low · Linux Foundation Decentralized Trust
    2 votes
31. CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 comparison disasterN/ACryptographic Issues - Generic · medium · curl
    2 votes
32. WordPress Automatic Update Protocol Does Not Authenticate Updates Provided by the ServerN/ACryptographic Issues - Generic · high · WordPress
    2 votes
33. wolfSSL Backend Silently Ignores --cert-status (OCSP Stapling Bypass)N/AImproper Certificate Validation · medium · curl
    1 votes
34. Signature Verification /// golang.org/x/crypto/sshN/ACryptographic Issues - Generic · high · Sifchain
    1 votes
35. Inadequate Cryptographic Key Size and Insecure Cryptographic Mode. File Name :- curl_ntlm_core.cN/AUse of a Broken or Risky Cryptographic Algorithm · high · curl
    1 votes
36. SSL certificate public key less than 2048 bitN/ACryptographic Issues - Generic · Paragon Initiative Enterprises
    1 votes