# CWE-649.

Every Advisory and CVE whose sources give the weakness CWE-649, newest first.

## Records, newest first

- [Cloak AES-CTR cipher lacks ciphertext authentication, allowing chosen-plaintext forgery by bit flipping](https://agentprime.io/advisories/EEF-CVE-2026-95105.md)
  `EEF-CVE-2026-95105`, `CVE-2026-95105` · Hex `cloak`: affected `>=0.1.0-pre`, no fixed version yet · CVSS 8.2 High · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-649
- [ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens](https://agentprime.io/advisories/CVE-2026-105208.md)
  `CVE-2026-105208` · CVE record: zitadel zitadel · CVSS 8.7 High · Not analysed yet · Published 4 Oct 2026 · Tags: CWE-649
- [Weak encryption on Funambol's cloud server](https://agentprime.io/advisories/CVE-2025-41351.md)
  `CVE-2025-41351` · CVE record: Funambol Cloud Server · CVSS 6.0 Medium · Not analysed yet · Published 28 Jan 2026 · Tags: CWE-649
- [fossasia open-event-server Mail Verification mail.py send_email_change_user_email reliance on obfuscation or encryption of security-relevant inputs without integrity checking](https://agentprime.io/advisories/CVE-2025-5323.md)
  `CVE-2025-5323` · CVE record: fossasia open-event-server · CVSS 6.3 Medium · Not analysed yet · Published 29 May 2025 · Tags: CWE-325, CWE-649
- [SICK InspectorP61x and SICK InspectorP62x are vulnerable for firmware modification](https://agentprime.io/advisories/CVE-2024-10772.md)
  `CVE-2024-10772` · CVE record: SICK AG SICK InspectorP61x and 1 more · CVSS 8.8 High · Not analysed yet · Published 6 Dec 2024 · Tags: CWE-649
- [Reliance on obfuscation or encryption of security-relevant inputs without integrity checking issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS.](https://agentprime.io/advisories/CVE-2024-36279.md)
  `CVE-2024-36279` · CVE record: FreeFrom K.K. "FreeFrom - the nostr client" App for Android and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 17 Jun 2024 · Tags: CWE-649
- [Padding oracle attacks](https://agentprime.io/advisories/GHSA-3gp6-hhfw-4gqx.md)
  `GHSA-3gp6-hhfw-4gqx`, `CVE-2010-3300` · Maven `org.owasp.esapi:esapi`: affected `<2.0GA`, fixed in `2.0GA` · CVSS 5.9 Medium · Not analysed yet · Published 13 Aug 2021 · Tags: CWE-649
- [RSA BSAFE Micro Edition Suite versions prior to 4.1.6.3 (in 4.1.x) and prior to 4.4 (in 4.2.x and 4.3.x), are vulnerable to an Information Exposure Through an Error Message vulnerability, also known…](https://agentprime.io/advisories/CVE-2019-3730.md)
  `CVE-2019-3730` · CVE record: Dell RSA BSAFE MES · CVSS 5.9 Medium · Not analysed yet · Published 30 Sept 2019 · Tags: CWE-649

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-649>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-649/>. Everything for agents: <https://agentprime.io/llms.txt>.