Weaknesses of type CWE-327

414 results

Uso de algoritmo criptográfico fraco ou quebrado

A aplicação usa algoritmos de criptografia que já foram quebrados ou são reconhecidamente fracos (como MD5, SHA-1, DES, RC4), deixando dados sensíveis vulneráveis a ataques práticos. Mesmo que o algoritmo ainda funcione tecnicamente, um adversário pode recuperar a mensagem ou falsificar assinaturas com esforço computacional viável.

Example

Um sistema armazena senhas de usuários com hash MD5, ou usa SHA-1 para assinar tokens JWT, ou criptografa dados financeiros com DES. Em todos esses casos, há ferramentas públicas que conseguem quebrar a proteção em horas ou dias.

How to mitigate

Substitua por algoritmos modernos: SHA-256 ou melhor para hash (ou Argon2/bcrypt para senhas), AES-256 para criptografia simétrica, ECDSA ou RSA-2048+ para assinaturas. Revise periodicamente o acervo de dependências e remova bibliotecas que só ofereçam primitivas fracas.

CVE-2025-54981HIGHApache StreamPark: Weak Encryption Algorithm in StreamParkEPSS 0.2%CVE-2025-68701HIGHJervis has Deterministic AES IV Derivation from PassphraseEPSS 0.2%CVE-2026-1627MEDIUMAn attacker may exploit the use of outdated and weak MAC algorithms in the device’s SSH service to potentially compromise the integrity of tEPSS 0.2%CVE-2026-54780LOWCoreWCF: WS-Security Reference DigestMethod Algorithm-Suite BypassEPSS 0.2%CVE-2026-1626MEDIUMAn attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to potentially observe or manipulate parts of thEPSS 0.2%CVE-2026-7103MEDIUMcode-projects Chat System MD5 Hash update_user.php weak hashEPSS 0.2%CVE-2026-67336CRITICALbetter-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProviderEPSS 0.2%CVE-2021-47712MEDIUMKentico Xperience <= 12.0.102 URL Hashing Cryptography VulnerabilityEPSS 0.2%CVE-2025-65849CRITICALA cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-WoEPSS 0.2%CVE-2024-4563MEDIUMThe Progress MOVEit Automation Configuration Export Function Uses a Cryptographic Method with Insufficient Bit LengthEPSS 0.2%CVE-2021-27784MEDIUMHCL Launch container images may contain non-unique https certificates and database encryption keyEPSS 0.2%CVE-2026-14630LOWForceInjection AI-fundermentals Memory Recall smart_customer_service.py get_conversation_history weak hashEPSS 0.2%CVE-2026-15605LOWwandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hashEPSS 0.2%CVE-2021-43550MEDIUMPhilips Patient Information Center iX (PIC iX) and Efficia CM Series Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.2%CVE-2026-14742LOWlangchain-ai langgraph Task Result Cache _cache.py _freeze weak hashEPSS 0.2%CVE-2026-45701MEDIUMSulu: Weak Cryptographical usage for API Key generation and Reset TokensEPSS 0.2%CVE-2024-22314MEDIUMIBM Storage Defender - Resiliency Service information disclosureEPSS 0.2%CVE-2020-8912LOWIn-band key negotiation issue in AWS S3 Crypto SDK for GoLangEPSS 0.2%CVE-2023-26024MEDIUMIBM Planning Analytics on Cloud Pak for Data information disclosureEPSS 0.2%CVE-2024-38320MEDIUMIBM Storage Protect for Virtual Environments: Data Protection for VMware information disclosureEPSS 0.2%