CWE-329: Generation of Predictable IV with CBC Mode
The product generates and uses a predictable initialization Vector (IV) with Cipher Block Chaining (CBC) Mode, which causes algorithms to be susceptible to dictionary attacks when they are encrypted under the same key.
10 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2024-49783 — IBM OpenPages with Watson information disclosure
- CVE-2026-45787 — electerm's encrypt method not safe enough
- CVE-2024-56141 — Minosoft has IV equal to key
- CVE-2026-14969 — 389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryption
- CVE-2025-2814 — Crypt::CBC versions between 1.21 and 3.05 for Perl may use insecure rand() function for cryptographic functions
Recently published
- CVE-2026-14969 — 389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryption
- CVE-2024-56141 — Minosoft has IV equal to key
- CVE-2026-45787 — electerm's encrypt method not safe enough
- CVE-2024-49783 — IBM OpenPages with Watson information disclosure
- CVE-2025-2814 — Crypt::CBC versions between 1.21 and 3.05 for Perl may use insecure rand() function for cryptographic functions