Weaknesses of type CWE-326

195 results

Força criptográfica inadequada

A aplicação usa algoritmos ou tamanhos de chave criptográfica insuficientes para proteger dados sensíveis contra ataques conhecidos. Por exemplo, usar DES, MD5 ou chaves RSA de 512 bits fornece proteção que pode ser quebrada em tempo viável com poder computacional moderno, deixando dados expostos.

Example

Um sistema de autenticação que armazena senhas hasheadas com MD5, ou uma API que criptografa dados com DES em vez de AES-256. Um atacante com acesso aos hashes consegue recuperar as senhas por força bruta, ou quebra a criptografia DES em horas.

How to mitigate

Use algoritmos reconhecidos como seguro (AES-256 para cifra simétrica, RSA 2048+ ou ECDSA para assimétrica, bcrypt/scrypt/argon2 para senhas). Revise regularmente o padrão criptográfico da sua stack — o que era seguro em 2015 pode estar comprometido hoje.

CVE-2018-5461—An Inadequate Encryption Strength issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS ClassEPSS 0.4%CVE-2024-32758CRITICALexacqVision - Key exchangesEPSS 0.4%CVE-2024-23656HIGHDex 2.37.0 is discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphersEPSS 0.4%CVE-2025-20667MEDIUMIn Modem, there is a possible information disclosure due to incorrect error handling. This could lead to remote information disclosure, if aEPSS 0.4%CVE-2018-25272CRITICALELBA5 5.8.0 Remote Code Execution via Database AccessEPSS 0.4%CVE-2001-1546HIGHPathways Homecare 6.5 uses weak encryption for user names and passwords, which allows local users to gain privileges by recovering the passwEPSS 0.4%CVE-2021-32945HIGHMDT AutoSave Inadequate Encryption StrengthEPSS 0.4%CVE-2024-28755MEDIUMAn issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum EPSS 0.4%CVE-2021-21387HIGHPartial secret key disclosure, improper safety number calculation, & inadequate encryption strengthEPSS 0.4%CVE-2022-24318—A CWE-326: Inadequate Encryption Strength vulnerability exists that could cause non-encrypted communication with the server when outdated veEPSS 0.4%CVE-2021-36337MEDIUMDell Wyse Management Suite version 3.3.1 and prior support insecure Transport Security Protocols TLS 1.0 and TLS 1.1 which are susceptible tEPSS 0.4%CVE-2022-2758MEDIUMUpdateEPSS 0.4%CVE-2021-37209MEDIUMA vulnerability has been identified in RUGGEDCOM i800 (All versions < V4.3.8), RUGGEDCOM i801 (All versions < V4.3.8), RUGGEDCOM i802 (All vEPSS 0.4%CVE-2023-41305—Vulnerability of 5G messages being sent without being encrypted in a VPN environment in the SMS message module. Successful exploitation of tEPSS 0.4%CVE-2023-37301—An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3. Because it doesn't use EditEntity for undo and restorEPSS 0.3%CVE-2021-38464MEDIUMInHand Networks IR615 RouterEPSS 0.3%CVE-2019-18241—In Philips IntelliBridge EC40 and EC80, IntelliBridge EC40 Hub all versions, and IntelliBridge EC80 Hub all versions, the SSH server runningEPSS 0.3%CVE-2024-42163HIGHPassword ManipulationEPSS 0.3%CVE-2023-29549MEDIUMUnder certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm. This may have created a vulnEPSS 0.3%CVE-2018-16499—In VOS compromised, an attacker at network endpoints can possibly view communications between an unsuspecting user and the service using manEPSS 0.3%