Weaknesses of type CWE-326

208 results

Força criptográfica inadequada

A aplicação usa algoritmos ou tamanhos de chave criptográfica insuficientes para proteger dados sensíveis contra ataques conhecidos. Por exemplo, usar DES, MD5 ou chaves RSA de 512 bits fornece proteção que pode ser quebrada em tempo viável com poder computacional moderno, deixando dados expostos.

Example

Um sistema de autenticação que armazena senhas hasheadas com MD5, ou uma API que criptografa dados com DES em vez de AES-256. Um atacante com acesso aos hashes consegue recuperar as senhas por força bruta, ou quebra a criptografia DES em horas.

How to mitigate

Use algoritmos reconhecidos como seguro (AES-256 para cifra simétrica, RSA 2048+ ou ECDSA para assimétrica, bcrypt/scrypt/argon2 para senhas). Revise regularmente o padrão criptográfico da sua stack — o que era seguro em 2015 pode estar comprometido hoje.

CVE-2023-37301—An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3. Because it doesn't use EditEntity for undo and restorEPSS 0.3%CVE-2021-38464MEDIUMInHand Networks IR615 RouterEPSS 0.3%CVE-2025-7789MEDIUMXuxueli xxl-job Token Generation IndexController.java makeToken weak password hashEPSS 0.3%CVE-2023-29549MEDIUMUnder certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm. This may have created a vulnEPSS 0.3%CVE-2019-18241—In Philips IntelliBridge EC40 and EC80, IntelliBridge EC40 Hub all versions, and IntelliBridge EC80 Hub all versions, the SSH server runningEPSS 0.3%CVE-2024-42163HIGHPassword ManipulationEPSS 0.3%CVE-2018-16499—In VOS compromised, an attacker at network endpoints can possibly view communications between an unsuspecting user and the service using manEPSS 0.3%CVE-2024-29950HIGHBrocade SANnav before v2.3.1, v2.3.0a uses weak encryptionEPSS 0.3%CVE-2026-114616HIGHAuthlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)EPSS 0.3%CVE-2024-23564CRITICALHCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from thEPSS 0.3%CVE-2020-7565HIGHA CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker EPSS 0.3%CVE-2024-29969HIGHTLS/SSL weak message authentication code ciphers are added by default for port 18082EPSS 0.3%CVE-2024-21881HIGHUpload of encrypted packages allows authenticated command execution in Enphase IQ Gateway v4.x and v5.xEPSS 0.3%CVE-2026-7830HIGHUltraVNC MS-Logon II uses 64-bit Diffie-Hellman and seeded libc rand() enabling credential interceptionEPSS 0.3%CVE-2024-33662HIGHPortainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function.EPSS 0.3%CVE-2026-77405CRITICALRabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI ParserEPSS 0.3%CVE-2020-10636MEDIUMICSA-20-140-02 Emerson OpenEnterpriseEPSS 0.3%CVE-2025-4894MEDIUMcalmkart Django-sso-server crypto.py gen_rsa_keys inadequate encryptionEPSS 0.3%CVE-2024-41594HIGHAn issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the VigoEPSS 0.3%CVE-2022-48193MEDIUMWeak ciphers vulnerability in Softing smartLink SW-HTEPSS 0.3%