Weaknesses of type CWE-325

59 results

Etapa Criptográfica Obrigatória Faltando

Ocorre quando o código implementa um protocolo ou mecanismo de segurança, mas omite uma etapa criptográfica essencial do fluxo—como não assinar um dado antes de enviar, não verificar uma assinatura recebida, ou pular a validação de um certificado. Sem essa etapa, a segurança esperada desaba: um atacante pode forjar, modificar ou interceptar dados sem ser detectado.

Example

Um serviço autenticado que valida o token JWT mas esquece de verificar a assinatura dele, acreditando apenas no conteúdo do payload. Um atacante cria seu próprio token com qualquer permissão e ganha acesso total.

How to mitigate

Implemente o protocolo criptográfico completo, seguindo um padrão estabelecido (OAuth 2.0, TLS com validação de certificado, etc.). Faça code review focado em fluxos de segurança e use bibliotecas de criptografia testadas em vez de implementar do zero; adicione testes que forcem a falha se a etapa for pulada.

CVE-2021-3680MEDIUMMissing Cryptographic Step in star7th/showdocEPSS 0.5%CVE-2026-40542HIGHApache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verificationEPSS 0.5%CVE-2026-42770LOWFFC-DH Peer Validation Uses Attacker-Supplied qEPSS 0.5%CVE-2022-20742HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software IPsec IKEv2 VPN Information Disclosure VulnerabilityEPSS 0.4%CVE-2022-20793MEDIUMCisco Touch 10 Device Insufficient Identity Verification VulnerabilityEPSS 0.4%CVE-2023-46129HIGHxkeys Seal encryption used fixed key for all encryptionEPSS 0.4%CVE-2026-45446MEDIUMIncorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modesEPSS 0.4%CVE-2022-1279MEDIUMInsecure EBICS messages encryption implementation in ebics-java/ebics-java-client could allow an adjacent attacker to decrypt EBICS payloadsEPSS 0.4%CVE-2022-29229MEDIUMMissing Cryptographic Step in cassprojectEPSS 0.3%CVE-2020-10702MEDIUMA flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM introduced in version 4.0 and fixed in EPSS 0.3%CVE-2025-3938MEDIUMMissing Cryptographic StepEPSS 0.3%CVE-2026-42246HIGHnet-imap vulnerable to STARTTLS stripping via invalid response timingEPSS 0.3%CVE-2023-34471MEDIUMMissing Cryptographic StepEPSS 0.3%CVE-2026-4601CRITICALVersions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash proEPSS 0.3%CVE-2022-24116CRITICALCertain General Electric Renewable Energy products have inadequate encryption strength. This affects iNET and iNET II before 8.3.0.EPSS 0.3%CVE-2025-58359MEDIUMfrost-core: refresh shares with smaller min_signers will reduce group securityEPSS 0.3%CVE-2025-30147HIGHALTBN128_ADD, ALTBN128_MUL, ALTBN128_PAIRING precompile functions do not check if points are on curveEPSS 0.3%CVE-2026-4258HIGHVersions of the package sjcl before 1.0.9 are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve vEPSS 0.2%CVE-2024-55655LOWsigstore-python has insufficient validation of integration timestamp during verificationEPSS 0.2%CVE-2026-58638MEDIUMWindows Boot Loader Security Feature Bypass VulnerabilityEPSS 0.2%