CWE-325: Missing Cryptographic Step
The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.
A kind of CWE-1240 Use of a Cryptographic Primitive with a Risky Implementation.
From the CWE List. © The MITRE Corporation.
Newest
- nextcloud desktop, nextcloud, kiteworks security-advisories +2 moreNextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders6.9 Medium
- nextcloud desktop, kiteworks security-advisories +1 moreNextcloud Desktop client misbehaves with E2EE when the server returns empty list of metadata keys6.7 Medium
- ge inet 900 firmware, inet ii 900 firmware, sd1 firmware +5 more +7 moreCertain General Electric Renewable Energy products have inadequate encryption strength. This...9.8 Critical
- cassproject cass, competency and skills system +1 moreMissing Cryptographic Step in cassproject6.3 Medium
- haxx curl, netapp clustered data ontap, h300s firmware +10 more +12 moreUsing its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure...4.3 Medium
- cisco adaptive security appliance software, adaptive security appliance (asa) software, secure firewall threat defense +2 moreCisco Adaptive Security Appliance Software and Firepower Threat Defense Software IPsec IKEv2 VPN Information Disclosure Vulnerability7.4 High
- ebics-java ebics-java-client, ebics java project java +1 moreInsecure EBICS messages encryption implementation in ebics-java/ebics-java-client could allow an adjacent attacker to decrypt EBICS payloads6.5 Medium
- juniper junos, juniper networks junos os +1 moreJunos OS: When using J-Web with HTTP an attacker may retrieve encryption keys via Person-in-the-Middle attacks.5.3 Medium
- haxx curl, apple macos, debian linux +29 more +31 moreA user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking...7.5 High
- showdoc, star7th star7th/showdoc +1 moreMissing Cryptographic Step in star7th/showdoc5.3 Medium
- gnupg libgcrypt, debian linux, fedoraproject fedora +8 more +10 moreLibgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks...7.5 High
- python openid connect project openid connect, openidc pyoidc +1 moreCryptographic issues in Python oic6.8 Medium
- typo3, typo3 cms +1 moreMissing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS8.8 High
- friendsoftypo3 mediacePotential Remote Code Execution in TYPO3 with mediace extension9.8 Critical
- qemuA flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for...5.5 Medium
- dell bsafe crypto-j, rsa bsafe crypto-j, bsafe cert-j +14 more +16 moreRSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Improper Verification of...6.5 Medium
- android open source project android, apple ios, macos +3 more +5 moreBluetooth implementations may not sufficiently validate elliptic curve parameters during Diffie-Hellman key exchange8.0 High
- [unknown] jenkinsInadequate Encryption Strength in Jenkins4.3 Medium
- [unknown] jenkinsExposure of Sensitive Information to an Unauthorized Actor in Jenkins2.6 Low
- [unknown] jenkinsExposure of Sensitive Information to an Unauthorized Actor in Jenkins4.3 Medium
- [unknown] nss, mozilla network security services +1 morenss before version 3.30 is vulnerable to a remote denial of service during the session handshake...5.9 Medium
- owasp enterprise security apiMissing Cryptographic Step in OWASP Enterprise Security API for Java5.8 Medium
- owasp enterprise security apiMissing Cryptographic Step in OWASP Enterprise Security API for Java2.6 Low