CWE-329 · Cryptography
Generation of Predictable IV with CBC Mode
17CVEs
SortMost likely exploited
17 CVEs with CWE-329 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2014-3566The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain clea…Openssl · Openssl · CVSS 3.4 · 2014-10-15 | 3.4 | 100% | 2014-10-15 |
| CVE-2008-5161Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through 4.4.11, 5.0 through 5.2.4, and 5.3 through 5.3.8; Client and Server and ConnectSec…Ssh · Tectia Client · CVSS 3.7 · 2008-11-19 | 3.7 | 19% | 2008-11-19 |
| CVE-2020-5408Dictionary attack with Spring Security queryable text encryptorSpring by VMware · Spring Security · 2020-05-14 | – | 1.6% | 2020-05-14 |
| CVE-2022-46397FP.io VPP (Vector Packet Processor) 22.10, 22.06, 22.02, 21.10, 21.06, 21.01, 20.09, 20.05, 20.01, 19.08, and 19.04 Generates a Predictable IV with CBC Mode.Lfprojects · Vector Packet Processor · CVSS 7.5 · 2023-03-28 | 7.5 | 0.6% | 2023-03-28 |
| CVE-2023-0343CVE-2023-0343Akuvox · E11 · CVSS 6.5 · 2023-03-31 | 6.5 | 0.6% | 2023-03-31 |
| CVE-2025-59322CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly handle decryption errors and allows encrypted volumes to be mounted as plaintext.No vendor recorded · CVSS 7.5 · 2026-08-12 | 7.5 | 0.5% | 2026-08-12 |
| CVE-2021-27499Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App: All versions prior to 1.7.5,The application layer encryptio…Ypsomed · Ypsomed mylife Cloud, mylife Mobile Application · 2021-08-02 | – | 0.5% | 2021-08-02 |
| CVE-2024-49783IBM OpenPages with Watson information disclosureIBM · OpenPages with Watson · CVSS 5.3 · 2025-07-08 | 5.3 | 0.3% | 2025-07-08 |
| CVE-2017-3225Das U-Boot's AES-CBC encryption feature uses a zero (0) initialization vector that may allow attacks against the underlying cryptographic implementation and allow an attacker to d…Das · U-Boot · 2018-07-24 | – | 0.3% | 2018-07-24 |
| CVE-2017-3226Das U-Boot's AES-CBC encryption feature improperly handles an error condition and may allow attacks against the underlying cryptographic implementation and allow an attacker to de…Das · U-Boot · 2018-07-24 | – | 0.3% | 2018-07-24 |
| CVE-2022-29054A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the DHCP and DNS keys in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4…Fortinet · FortiOS · CVSS 3.1 · 2023-02-16 | 3.1 | 0.2% | 2023-02-16 |
| CVE-2024-56141Minosoft has IV equal to keyBixilon · Minosoft · CVSS 5 · 2026-07-06 | 5.0 | 0.2% | 2026-07-06 |
| CVE-2026-47842Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext CorrelationSpring · Spring Security · CVSS 6.5 · 2026-08-26 | 6.5 | 0.1% | 2026-08-26 |
| CVE-2026-86363Dell Live Optics Collector, versions prior to 27.3.13.330 contains a Generation of Predictable IV with CBC Mode vulnerability. A low privileged attacker with local access could po…Dell · Live Optics Collector · CVSS 5.5 · 2026-11-11 | 5.5 | 0.1% | 2026-11-11 |
| CVE-2026-14969389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryptionRed Hat · Red Hat Directory Server 11 · CVSS 4.4 · 2026-07-07 | 4.4 | 0.1% | 2026-07-07 |
| CVE-2026-45787electerm's encrypt method not safe enoughelecterm · electerm · CVSS 6 · 2026-05-28 | 6.0 | 0.1% | 2026-05-28 |
| CVE-2026-17137Multiple Vulnerabilities in IBM API ConnectIBM · API Connect · CVSS 4 · 2026-11-07 | 4.0 | 0.1% | 2026-11-07 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.