Are transactions with the same ScriptSig a security problem? For instance while looking at the transaction stack of my address, tracing it to exchanges I use, I came across this:

https://www.blockchain.com/btc/tx/543f319e52123528847681ffc62941219196983b6b2daa51aa7fd44c9bc5c981

ScriptSig: PUSHDATA(34)[0020431a072cb6352277b34d2bd4b7963939c37c2f121feb288106f64369eb1467d6]

The same ScriptSig occurs twice on this page within the same transaction? 

I know reading years ago in paper by someone was outlining how you can derive the private key from the scriptsig but I remember you need to have way more data in the field...in other words: the value between two inputs should match but there were other different values? Here it's just the exact same string but occuring twice? 

aka, example of signature I am sure it's hackable: 

(some header data) + (vulnerable data that occurs in other inputs) + (some more data)

very dumbed-down example:

00207777777777777777777777777123123 &lt;- input1;
00217777777777777777777777777000000 &lt;- input2 

then by doing some simple math people can get the private key from input1 and input2 (multiplying/dviding etc, forgot how it worked just because the middle is the same of both inputs).

I have no idea what is 'witness' either, guessing miner who confirmed it?
In the example you specified, the scriptsig is duplicated as these are p2sh-p2wpkh addresses. The actual signature is still different, with unique R values.

It is only possible to recover the private key if your have two different signatures from the same key that use the same R-value. This is avoided in any sane wallet by following rfc6979, which creates an R-value deterministically from the data being signed.