Weaknesses of type CWE-326

195 results

Força criptográfica inadequada

A aplicação usa algoritmos ou tamanhos de chave criptográfica insuficientes para proteger dados sensíveis contra ataques conhecidos. Por exemplo, usar DES, MD5 ou chaves RSA de 512 bits fornece proteção que pode ser quebrada em tempo viável com poder computacional moderno, deixando dados expostos.

Example

Um sistema de autenticação que armazena senhas hasheadas com MD5, ou uma API que criptografa dados com DES em vez de AES-256. Um atacante com acesso aos hashes consegue recuperar as senhas por força bruta, ou quebra a criptografia DES em horas.

How to mitigate

Use algoritmos reconhecidos como seguro (AES-256 para cifra simétrica, RSA 2048+ ou ECDSA para assimétrica, bcrypt/scrypt/argon2 para senhas). Revise regularmente o padrão criptográfico da sua stack — o que era seguro em 2015 pode estar comprometido hoje.

CVE-2026-86670MEDIUMaircheng-org iWebShop-5 Authentication Storage admin.php weak password hashEPSS 0.3%CVE-2020-10601—VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module allow weak hashing algorithm and insecure permissions which may allow a locaEPSS 0.3%CVE-2026-33488HIGHAVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl PluginEPSS 0.3%CVE-2024-22892HIGHOpenSlides 4.0.15 was discovered to be using a weak hashing algorithm to store passwords.EPSS 0.2%CVE-2024-45719LOWApache Answer: Predictable Authorization Token Using UUIDv1EPSS 0.2%CVE-2024-38277MEDIUMmoodle: QR login key and auto-login key for the Moodle mobile app should be generated as separate keysEPSS 0.2%CVE-2023-36748MEDIUMA vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEEPSS 0.2%CVE-2017-9635—Schneider Electric Ampla MES 6.4 provides capability to configure users and their privileges. When Ampla MES users are configured to use SimEPSS 0.2%CVE-2017-9645—An Inadequate Encryption Strength issue was discovered in Mirion Technologies DMC 3000 Transmitter Module, iPam Transmitter f/DMC 2000, RDS-EPSS 0.2%CVE-2002-1975MEDIUMSharp Zaurus PDA SL-5000D and SL-5500 uses a salt of "A0" to encrypt the screen-locking password as stored in the Security.conf file, which EPSS 0.2%CVE-2026-44351CRITICALfast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypassEPSS 0.2%CVE-2025-55039MEDIUMApache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacksEPSS 0.2%CVE-2026-33512HIGHAVideo has an unauthenticated decrypt oracle leaking any ciphertextEPSS 0.2%CVE-2025-65295HIGHMultiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 deviEPSS 0.2%CVE-2026-9201HIGHLangflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handlingEPSS 0.2%CVE-2021-32010MEDIUMClients may connect to a GateManager with TLS 1.0EPSS 0.2%CVE-2026-77405CRITICALRabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI ParserEPSS 0.2%CVE-2024-45259MEDIUMAn issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP reqEPSS 0.2%CVE-2025-12478CRITICALNon-Compliant TLS ConfigurationEPSS 0.2%CVE-2025-46626HIGHReuse of a static AES key and initialization vector for encrypted traffic to the 'ate' management service of the Tenda RX2 Pro 16.03.30.14 aEPSS 0.2%