Weaknesses of type CWE-327

376 results

Uso de algoritmo criptográfico fraco ou quebrado

A aplicação usa algoritmos de criptografia que já foram quebrados ou são reconhecidamente fracos (como MD5, SHA-1, DES, RC4), deixando dados sensíveis vulneráveis a ataques práticos. Mesmo que o algoritmo ainda funcione tecnicamente, um adversário pode recuperar a mensagem ou falsificar assinaturas com esforço computacional viável.

Example

Um sistema armazena senhas de usuários com hash MD5, ou usa SHA-1 para assinar tokens JWT, ou criptografa dados financeiros com DES. Em todos esses casos, há ferramentas públicas que conseguem quebrar a proteção em horas ou dias.

How to mitigate

Substitua por algoritmos modernos: SHA-256 ou melhor para hash (ou Argon2/bcrypt para senhas), AES-256 para criptografia simétrica, ECDSA ou RSA-2048+ para assinaturas. Revise periodicamente o acervo de dependências e remova bibliotecas que só ofereçam primitivas fracas.

CVE-2013-2566MEDIUMThe RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to EPSS 84.4%CVE-2015-2808LOWThe RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initializatioEPSS 73.9%CVE-2023-28244HIGHWindows Kerberos Elevation of Privilege VulnerabilityEPSS 2.9%CVE-2020-6984CRITICALRockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versionsEPSS 2.8%CVE-2022-3365CRITICALEmote Interactive Remote Mouse Server command injection due to weak encodingEPSS 2.1%CVE-2020-11876HIGHairhost.exe in Zoom Client for Meetings 4.6.11 uses the SHA-256 hash of 0123425234234fsdfsdr3242 for initialization of an OpenSSL EVP AES-25EPSS 1.7%CVE-2021-20305—A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result EPSS 1.6%CVE-2025-2539HIGHFile Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File ReadEPSS 1.6%CVE-2020-25694—A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client aEPSS 1.6%CVE-2024-31989CRITICALArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis CacheEPSS 1.5%CVE-2021-40528MEDIUMThe ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic librariEPSS 1.4%CVE-2023-5347CRITICALUnauthenticated Firmware UpgradeEPSS 1.3%CVE-2022-29217HIGHKey confusion through non-blocklisted public key formats in PyJWTEPSS 1.3%CVE-2024-30098HIGHWindows Cryptographic Services Security Feature Bypass VulnerabilityEPSS 1.3%CVE-2019-7477—A vulnerability in SonicWall SonicOS and SonicOSv TLS CBC Cipher allow remote attackers to obtain sensitive plaintext data when CBC cipher sEPSS 1.2%CVE-2018-7792HIGHA Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versionEPSS 1.1%CVE-2024-29056MEDIUMWindows Authentication Elevation of Privilege VulnerabilityEPSS 1.0%CVE-2019-10929—A vulnerability has been identified in SIMATIC CP 1626 (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variantsEPSS 1.0%CVE-2020-6987—In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the affected products use a weak cEPSS 0.9%CVE-2020-7001—In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the affected products use a weak cryptographic algorithm, which may allow confidentEPSS 0.9%