CWE-325: Missing Cryptographic Step, page 2
Filter
The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.
What the weakness is: CWE-325 at MITRE. OWASP Top 10: A04:2025 Cryptographic Failures
Related attack patterns (CAPEC): 1
- CAPEC-68 Subvert Code-signing Facilities Likelihood: Low · Severity: Very High
The attack patterns MITRE's CAPEC relates to CWE-325, as MITRE names them. Credits.
Ask an AI about CWE-325
Show the prompt
Explain CWE-325: Missing Cryptographic Step and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/325.html and https://cve.bz/cve/cwe/325?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 6.1CVE-2023-28998EPSS 0.7%
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can de…
- 9.8CVE-2022-24116EPSS 0.3%
Certain General Electric Renewable Energy products have inadequate encryption strength. This affects iNET and iNET II before 8.3.0.
- 4.3CVE-2022-30115EPSS 1.4%
Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing d…
- 7.2CVE-2022-29229EPSS 0.4%
CaSS is a Competency and Skills System. CaSS Library, (npm:cassproject) has a missing cryptographic step when storing cryptographic keys that can allow a server administrator access to an account’s cryptographic keys. This affects CaSS ser…
- 7.4CVE-2022-20742EPSS 0.5%
A vulnerability in an IPsec VPN library of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to read or modify data within an IPsec IKEv2 VPN …
- 7.5CVE-2022-1279EPSS 0.4%
A vulnerability in the encryption implementation of EBICS messages in the open source librairy ebics-java/ebics-java-client allows an attacker sniffing network traffic to decrypt EBICS payloads. This issue affects: ebics-java/ebics-java-cl…
- 5.9CVE-2021-31386EPSS 0.7%
A Protection Mechanism Failure vulnerability in the J-Web HTTP service of Juniper Networks Junos OS allows a remote unauthenticated attacker to perform Person-in-the-Middle (PitM) attacks against the device. This issue affects: Juniper Net…
- 7.5CVE-2021-22946EPSS 4.5%
A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibc…
- 4.9CVE-2021-3680EPSS 0.5%
showdoc is vulnerable to Missing Cryptographic Step
- 7.5CVE-2021-33560EPSS 2.4%
Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects u…
- 6.8CVE-2020-26244EPSS 0.8%
Python oic is a Python OpenID Connect implementation. In Python oic before version 1.2.1, there are several related cryptographic issues affecting client implementations that use the library. The issues are: 1) The IdToken signature algori…
- 8.8CVE-2020-15098EPSS 2.2%
In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This al…
- 9.8CVE-2020-15086EPSS 3.6%
In TYPO3 installations with the "mediace" extension from version 7.6.2 and before version 7.6.5, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. The allows to inject arbitrary dat…
- 5.5CVE-2020-10702EPSS 0.3%
A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM introduced in version 4.0 and fixed in version 5.0.0. A general failure of the signature generation process caused every PAuth-enforced po…
- 6.5CVE-2019-3738EPSS 1.7%
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predic…
- 6.8CVE-2018-5383EPSS 0.8%
Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and iOS versions before 11.4, and Android versions before the 2018-06-05 patch may not sufficiently validate elliptic curve parameters used…
- 5.9CVE-2016-9574EPSS 1.4%
nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.
- 4.3CVE-2017-2598EPSS 1.0%
Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored secrets vulnerable to unnecessary risks (SECURITY-304).
- 3.5CVE-2017-2603EPSS 1.0%
Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API tokens (SECURITY-362).
- 4.3CVE-2017-2600EPSS 1.0%
In jenkins before versions 2.44, 2.32.2 node monitor data could be viewed by low privilege users via the remote API. These included system configuration and runtime information of these nodes (SECURITY-343).