CWE-325: Missing Cryptographic Step
The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.
A kind of CWE-1240 Use of a Cryptographic Primitive with a Risky Implementation.
From the CWE List. © The MITRE Corporation.
Newest
- ibm db2 genius hub Multiple vulnerabilities that affects IBM Db2 Genius Hub 4.3 Medium
- mozilla firefox, thunderbird +1 more Cryptographic issue in the WebRTC: Networking component 8.1 High
- ibm db2 genius hub IBM Db2 Genius Hub Missing Cryptographic Step 3.1 Low
- ibm websphere application server, websphere application server - liberty +1 more IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a missing cryptographic step 8.7 High
- sirius computer, inc. crux agent Crux Agent silently fails SKA preshared key rotation when SHA-512 peering is negotiated 6.3 Medium
- bouncycastle bc-csharp KCcmBlockCipher (DSTU 7624 CCM) tag not bound to nonce when no associated data is used 8.7 High
- mozilla firefox, thunderbird +1 more Cryptography misuse in Storage: Quota Manager component 8.1 High
- sfturing hosp order sfturing hosp_order User Password MD5.java MD5.getMD5 hash without salt 2.3 Low
- dell wyse management suite Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Cryptographic Step... 8.0 High
- eazsolution eazyfix EAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic Step"... 6.0 Medium
- tp-link systems inc. ep10, ep25 v2, ep40a +17 more +19 more Insufficient Cryptographic Protections in Local Device Communication Protocol on Multiple TP-Link Kasa Smart Home Devices 8.7 High
- google chrome Cryptographic Flaw in Enterprise in Google Chrome prior to 151.0.7922.72 allowed an attacker in a... 9.1 Critical
- sony corporation felica ic chips Missing Cryptographic Step (CWE-325) vulnerability exists in certain FeliCa IC chips shipped in... 7.0 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +21 more +23 more Windows Boot Loader Security Feature Bypass Vulnerability 6.0 Medium
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +6 more +8 more Windows Cryptography API: Next Generation (CNG) Tampering Vulnerability 7.1 High
- caliptra core runtime firmware AES-256-GCM Authentication Tag Does Not Cover First Ciphertext Blocks When AAD Is Empty 5.1 Medium
- deno Deno: Miller-Rabin Primality Test Allows Zero Rounds 7.4 High
- moxa uc-1200a series A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux... 7.0 High
- netgear rax120 firmware, rax120v1, rax120v2 +6 more +8 more Missing TLS certificate validation in NETGEAR's ReadyCloud client app 4.6 Medium
- openssl Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes 4.8 Medium
- openssl AES-OCB IV Ignored on EVP_Cipher() Path 7.5 High
- openssl FFC-DH Peer Validation Uses Attacker-Supplied q 3.7 Low
- netty netty-incubator-codec-ohttp netty-incubator-codec-ohttp OHttpVersionChunkDraft's Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation 6.6 Medium
- apache httpclient, red hat cryostat 4, migration toolkit for applications 8 +45 more +47 more Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification 7.3 High
- seppmail secure email gateway Plaintext secure-mail.html 6.3 Medium
- openclaw OpenClaw < 2026.3.28 - Webhook Replay via Query Parameter Reordering in Plivo V3 8.2 High
- kjur jsrsasign, red hat migration toolkit for virtualization 2.1, migration toolkit for virtualization 2.9 +5 more +7 more jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction 9.4 Critical
- bitwiseshiftleft stanford javascript crypto library sjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKey 8.7 High
- authlib, red hat lightspeed core, ansible automation platform 2 +7 more +9 more Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding 8.2 High
- qualcomm 5g fixed wireless access platform firmware, 9206 lte modem firmware, 9207 lte modem firmware +204 more +206 more Missing Cryptographic Step in Data Modem 7.2 High
- openssl, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 more Unauthenticated/unencrypted trailing bytes with low-level OCB function calls 4.0 Medium
- deno Deno node:crypto doesn't finalize cipher 9.2 Critical
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +30 more +32 more Windows Kerberos Elevation of Privilege Vulnerability 7.5 High
- ovh the-bastion The Bastion ttyrec files are not signed after encryption by the osh-encrypt-rsync script 4.4 Medium
- zcashfoundation frost frost-core: refresh shares with smaller min_signers will reduce group security 6.0 Medium
- mbed mbedtls, trustedfirmware mbed tls +1 more In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept invalid signatures if hash... 4.9 Medium
- ruby net-imap, red hat 3scale api management platform 2, enterprise linux 10 +17 more +19 more net-imap vulnerable to STARTTLS stripping via invalid response timing 7.6 High
- ethereum rlpx RLPx 5 has two CTR streams based on the same key, IV, and nonce. This can facilitate decryption... 3.4 Low
- fossasia open-event-server fossasia open-event-server Mail Verification mail.py send_email_change_user_email reliance on obfuscation or encryption of security-relevant inputs without integrity checking 6.3 Medium
- tridium niagara, niagara enterprise security, niagara framework +2 more Missing Cryptographic Step 6.8 Medium
- hyperledger besu-native ALTBN128_ADD, ALTBN128_MUL, ALTBN128_PAIRING precompile functions do not check if points are on curve 8.7 High
- sigstore sigstore-python sigstore-python has insufficient validation of integration timestamp during verification 2.7 Low
-
cookie-encrypternpm Bit flip attack vulnerability in cookie-encrypter 9.1 Critical - cisco roomos software, roomos, telepresence ce software +3 more +5 more Cisco Touch 10 Device Insufficient Identity Verification Vulnerability 6.8 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +33 more +35 more Windows Kerberos Information Disclosure Vulnerability 6.5 Medium
- zoom, zoom communications inc. clients, zoom meetings +2 more +4 more Cryptographic issues with In-Meeting Chat for some Zoom clients may allow a privileged user to... 4.9 Medium
- linuxfoundation nats-server, nats nkeys +1 more xkeys Seal encryption used fixed key for all encryption 7.5 High
- trailofbits uthenticode uthenticode EKU validation bypass 5.9 Medium
- ami megarac sp-x, megarac spx +1 more Missing Cryptographic Step 6.3 Medium
- zoom, zoom communications inc. clients, zoom meetings +7 more +9 more Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of... 5.3 Medium
- Show olderLoading…