Weaknesses of type CWE-327

413 results

Uso de algoritmo criptográfico fraco ou quebrado

A aplicação usa algoritmos de criptografia que já foram quebrados ou são reconhecidamente fracos (como MD5, SHA-1, DES, RC4), deixando dados sensíveis vulneráveis a ataques práticos. Mesmo que o algoritmo ainda funcione tecnicamente, um adversário pode recuperar a mensagem ou falsificar assinaturas com esforço computacional viável.

Example

Um sistema armazena senhas de usuários com hash MD5, ou usa SHA-1 para assinar tokens JWT, ou criptografa dados financeiros com DES. Em todos esses casos, há ferramentas públicas que conseguem quebrar a proteção em horas ou dias.

How to mitigate

Substitua por algoritmos modernos: SHA-256 ou melhor para hash (ou Argon2/bcrypt para senhas), AES-256 para criptografia simétrica, ECDSA ou RSA-2048+ para assinaturas. Revise periodicamente o acervo de dependências e remova bibliotecas que só ofereçam primitivas fracas.

CVE-2026-54147MEDIUMhttp4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URIEPSS 0.3%CVE-2024-24559LOWVyper SHA3 code generation bugEPSS 0.3%CVE-2026-114820CRITICALVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). EPSS 0.3%CVE-2024-56344MEDIUMIBM Cognos Analytics 12.0.4 and 12.1.3 versions are affected by security vulnerabilitiesEPSS 0.3%CVE-2023-30994MEDIUMIBM QRadar SIEM information disclosureEPSS 0.3%CVE-2024-49797MEDIUMIBM ApplinX Information DisclosureEPSS 0.3%CVE-2025-59408HIGHFlock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 ships with Secure Boot disabled. This allows an attacker to flash modifEPSS 0.3%CVE-2019-18340MEDIUMA vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0), Control Center Server (CCS) (All versions >= V1.EPSS 0.3%CVE-2026-34950CRITICALfast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public KeyEPSS 0.3%CVE-2025-59745MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.3%CVE-2026-57997MEDIUMStrapi users-permissions - JWT Algorithm Confusion via Missing Algorithm ConfigurationEPSS 0.2%CVE-2026-28252CRITICALUse of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer ConciergeEPSS 0.2%CVE-2025-48946LOWliboqs affected by theoretical design flaw in HQCEPSS 0.2%CVE-2022-46140HIGHAffected devices use a weak encryption scheme to encrypt the debug zip file. This could allow an authenticated attacker to decrypt the conteEPSS 0.2%CVE-2024-37068MEDIUMIBM Maximo Application Suite information disclosureEPSS 0.2%CVE-2026-65309HIGHStorage of passwords in a reversible formatEPSS 0.2%CVE-2021-27795MEDIUMLicense forgery in Brocade Fabric OS (FOS) hardware platforms running any version of Brocade Fabric OS software, EPSS 0.2%CVE-2026-33512HIGHAVideo has an unauthenticated decrypt oracle leaking any ciphertextEPSS 0.2%CVE-2023-50351HIGHInsecure key rotation affects MyXalyticsEPSS 0.2%CVE-2025-30477MEDIUMDell PowerScale OneFS, versions prior to 9.11.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. A high privileEPSS 0.2%