Weaknesses of type CWE-327

401 results

Uso de algoritmo criptográfico fraco ou quebrado

A aplicação usa algoritmos de criptografia que já foram quebrados ou são reconhecidamente fracos (como MD5, SHA-1, DES, RC4), deixando dados sensíveis vulneráveis a ataques práticos. Mesmo que o algoritmo ainda funcione tecnicamente, um adversário pode recuperar a mensagem ou falsificar assinaturas com esforço computacional viável.

Example

Um sistema armazena senhas de usuários com hash MD5, ou usa SHA-1 para assinar tokens JWT, ou criptografa dados financeiros com DES. Em todos esses casos, há ferramentas públicas que conseguem quebrar a proteção em horas ou dias.

How to mitigate

Substitua por algoritmos modernos: SHA-256 ou melhor para hash (ou Argon2/bcrypt para senhas), AES-256 para criptografia simétrica, ECDSA ou RSA-2048+ para assinaturas. Revise periodicamente o acervo de dependências e remova bibliotecas que só ofereçam primitivas fracas.

CVE-2026-32959HIGHSD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a use of a broken or risky cryptographic algorithm. InformEPSS 0.2%CVE-2024-3264MEDIUMBroken or Risky Cryptographic Algorithm in Mia Technology's Mia-Med Health AplicationEPSS 0.2%CVE-2025-66017HIGHCGGMP21 presignatures can be used in the way that significantly reduces securityEPSS 0.2%CVE-2026-44699CRITICALLibJWT: Algorithm confusion allows JWT forgery with RSA JWK as empty-key HMACEPSS 0.2%CVE-2025-14762MEDIUMMissing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3 bucket to introduce a new EDK thatEPSS 0.2%CVE-2025-30477MEDIUMDell PowerScale OneFS, versions prior to 9.11.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. A high privileEPSS 0.2%CVE-2025-27508HIGHEmissary Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.2%CVE-2024-32852MEDIUMDell PowerScale OneFS versions 8.2.2.x through 9.7.0.0 contain use of a broken or risky cryptographic algorithm vulnerability. An unprivilegEPSS 0.2%CVE-2022-45858LOWA use of a weak cryptographic algorithm vulnerability [CWE-327] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.0 all versions, 8.8.0 all EPSS 0.2%CVE-2026-21907HIGHJunos Space: TLS/SSL server supports use of static key ciphers (ssl-static-key-ciphers)EPSS 0.2%CVE-2021-27784MEDIUMHCL Launch container images may contain non-unique https certificates and database encryption keyEPSS 0.2%CVE-2024-55912MEDIUMIBM Concert Software information disclosureEPSS 0.2%CVE-2025-13916MEDIUMMultiple vulnerabilities have been addressed in IBM Aspera SharesEPSS 0.2%CVE-2024-41763MEDIUMIBM Engineering Lifecycle Optimization - Publishing information disclosureEPSS 0.2%CVE-2026-15638CRITICALCryptographic Padding OracleEPSS 0.2%CVE-2024-28780MEDIUMIBM Cognos Controller information disclosureEPSS 0.2%CVE-2025-68931HIGHJervis has AES CBC Mode Without AuthenticationEPSS 0.2%CVE-2024-10405MEDIUMWeak TLS Ciphers on Brocade SANnav port 443 & 18082EPSS 0.2%CVE-2026-1627MEDIUMAn attacker may exploit the use of outdated and weak MAC algorithms in the device’s SSH service to potentially compromise the integrity of tEPSS 0.2%CVE-2026-1626MEDIUMAn attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to potentially observe or manipulate parts of thEPSS 0.2%