CWE-325.

Multiple vulnerabilities that affects IBM Db2 Genius Hub

• IBM Db2 Genius Hub
• CWE-325

Cryptographic issue in the WebRTC: Networking component

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-325

IBM Db2 Genius Hub Missing Cryptographic Step

• IBM Db2 Genius Hub
• CWE-325

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a missing cryptographic step

• IBM WebSphere Application Server - Liberty
• IBM WebSphere Application Server
• CWE-325

Crux Agent silently fails SKA preshared key rotation when SHA-512 peering is negotiated

• Sirius Computer, Inc. Crux Agent
• CWE-252
• CWE-325

KCcmBlockCipher (DSTU 7624 CCM) tag not bound to nonce when no associated data is used

• Legion of the Bouncy Castle Inc. bc-csharp
• CWE-325

Cryptography misuse in Storage: Quota Manager component

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-325

sfturing hosp_order User Password MD5.java MD5.getMD5 hash without salt

• sfturing hosp_order
• CWE-325
• CWE-759

Dell Wyse Management Suite: Dell Wyse Management Suite, versions prior to 2605.0.3.683…

• Dell Wyse Management Suite
• CWE-325

eazsolution EazyFix: EAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic…

• eazsolution EazyFix
• CWE-325

Insufficient Cryptographic Protections in Local Device Communication Protocol on Multiple TP-Link Kasa Smart Home Devices

• TP-Link Systems Inc. HS103P3 / HS103P4 v5
• TP-Link Systems Inc. EP10
• CWE-325

Google Chrome: Cryptographic Flaw in Enterprise in Google Chrome prior to 151.0.7922.72 allowed an…

• Google Chrome
• CWE-325

Sony Corporation FeliCa IC chips: Missing Cryptographic Step (CWE-325) vulnerability exists in certain FeliCa IC chips…

• Sony Corporation FeliCa IC chips
• CWE-325

Windows Boot Loader Security Feature Bypass Vulnerability

• Microsoft Windows 10 Version 1809
• Microsoft Windows 10 Version 21H2
• CWE-325

Windows Cryptography API: Next Generation (CNG) Tampering Vulnerability

• Microsoft Windows 11 Version 24H2
• Microsoft Windows 11 Version 25H2
• CWE-325

AES-256-GCM Authentication Tag Does Not Cover First Ciphertext Blocks When AAD Is Empty

• Caliptra Core Runtime Firmware
• CWE-325

OHttpVersionChunkDraft: Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation

• CWE-325

<0.0.22.Final · fixed in 0.0.22.Final

Deno: Miller-Rabin Primality Test Allows Zero Rounds

• CWE-325

<2.8.1 · fixed in 2.8.1

A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and controllers.

• Moxa UC-1200A Series
• CWE-325

Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes

• OpenSSL
• CWE-325

AES-OCB IV Ignored on EVP_Cipher() Path

• OpenSSL
• CWE-325

FFC-DH Peer Validation Uses Attacker-Supplied q

• OpenSSL
• CWE-325

Missing TLS certificate validation in NETGEAR's ReadyCloud client app

• NETGEAR RAX120v1
• NETGEAR RAX120v2
• CWE-325

net-imap vulnerable to STARTTLS stripping via invalid response timing

• CWE-325
• CWE-392

<0.3.10 || >=0.4.0, <0.4.24 || >=0.5.0, <0.5.14 || >=0.6.0, <0.6.4 · fixed in 0.3.10, 0.4.24, 0.5.14, 0.6.4

Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification

• Authentication bypass
• CWE-325

>=5.6-alpha1, <5.6.1 · fixed in 5.6.1

Plaintext secure-mail.html

• SEPPmail Secure Email Gateway
• CWE-325

OpenClaw: Voice-call Plivo V3 webhook replay key uses unsorted URL, allowing replay via query-parameter reordering

• Authentication bypass
• CWE-325

<2026.3.28 · fixed in 2026.3.28

jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction

• CWE-325

<11.1.1 · fixed in 11.1.1

sjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKey

• Weak cryptography or TLS
• CWE-325

<1.0.9 · fixed in 1.0.9

Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding

• CWE-325
• CWE-354

<1.6.9 · fixed in 1.6.9

Missing Cryptographic Step in Data Modem

• Qualcomm, Inc. Snapdragon
• CWE-325

Unauthenticated/unencrypted trailing bytes with low-level OCB function calls

• OpenSSL
• CWE-325

Deno node:crypto doesn't finalize cipher

• CWE-325

<2.6.0 · fixed in 2.6.0

Windows Kerberos Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-325

The Bastion ttyrec files are not signed after encryption by the osh-encrypt-rsync script

• ovh the-bastion
• CWE-325

frost-core: refresh shares with smaller min_signers will reduce security of group

• Privilege escalation
• CWE-325

>=2.0.0, <2.2.0 · fixed in 2.2.0

mbedtls: In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept invalid signatures if hash…

• mbedtls
• CWE-325

RLPx 5 has two CTR streams based on the same key, IV, and nonce.

• Ethereum RLPx
• CWE-325

fossasia open-event-server Mail Verification mail.py send_email_change_user_email reliance on obfuscation or encryption of security-relevant inputs without integrity checking

• fossasia open-event-server
• CWE-325
• CWE-649

Missing Cryptographic Step

• Tridium Niagara Framework
• Tridium Niagara Enterprise Security
• CWE-325

ALTBN128_ADD, ALTBN128_MUL, ALTBN128_PAIRING precompile functions do not check if points are on curve

• hyperledger besu-native
• CWE-325

sigstore has insufficient validation of integration timestamp during verification

• CWE-20
• CWE-325

>=2.0.0, <3.6.0 · fixed in 3.6.0

Bit flip attack vulnerability in cookie-encrypter

• Weak cryptography or TLS
• CWE-325

<=1.0.1 · no fixed version yet

Cisco Touch 10 Device Insufficient Identity Verification Vulnerability

• Cisco RoomOS Software
• Cisco TelePresence Endpoint Software (TC/CE)
• CWE-325

Windows Kerberos Information Disclosure Vulnerability

• Microsoft Windows 10 Version 1507
• Microsoft Windows 10 Version 1607
• CWE-325

Zoom Video Communications, Inc. Zoom Clients: Cryptographic issues with In-Meeting Chat for some Zoom clients may allow a privileged…

• Zoom Video Communications, Inc. Zoom Clients
• CWE-325

xkeys seal encryption used fixed key for all encryption

• Hard-coded credentials
• CWE-325

>=2.10.0, <2.10.4 · fixed in 2.10.4

uthenticode EKU validation bypass

• trailofbits uthenticode
• Weak cryptography or TLS
• CWE-325

Missing Cryptographic Step

• AMI MegaRAC_SPx
• CWE-325

Information disclosure in Zoom Video Communications, Inc. Zoom clients

• Zoom Video Communications, Inc. Zoom clients
• Information disclosure
• CWE-325

Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders

• nextcloud security-advisories
• CWE-325

Nextcloud Desktop client misbehaves with E2EE when the server returns empty list of metadata keys

• nextcloud security-advisories
• CWE-325

Certain General Electric Renewable Energy products have inadequate encryption strength.

• CWE-325

Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL.

• https://github.com/curl/curl
• CWE-325

Missing Cryptographic Step in cassproject

• CWE-325

<1.5.8 · fixed in 1.5.8

Missing Cryptographic Step in OWASP Enterprise Security API for Java

• CWE-325

>=2.0.0, <2.1.0 · fixed in 2.1.0

Missing Cryptographic Step in OWASP Enterprise Security API for Java

• CWE-325

>=2.0.0.0, <2.1.0.1 · fixed in 2.1.0.1

Inadequate Encryption Strength in Jenkins

• Weak cryptography or TLS
• CWE-325

<2.32.2 || >=2.34, <2.44 · fixed in 2.32.2, 2.44

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

• Information disclosure
• CWE-325

<2.32.2 || >=2.34, <2.44 · fixed in 2.32.2, 2.44

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

• Information disclosure
• CWE-325

<2.32.2 || >=2.34, <2.44 · fixed in 2.32.2, 2.44