Weaknesses of type CWE-327

401 results

Uso de algoritmo criptográfico fraco ou quebrado

A aplicação usa algoritmos de criptografia que já foram quebrados ou são reconhecidamente fracos (como MD5, SHA-1, DES, RC4), deixando dados sensíveis vulneráveis a ataques práticos. Mesmo que o algoritmo ainda funcione tecnicamente, um adversário pode recuperar a mensagem ou falsificar assinaturas com esforço computacional viável.

Example

Um sistema armazena senhas de usuários com hash MD5, ou usa SHA-1 para assinar tokens JWT, ou criptografa dados financeiros com DES. Em todos esses casos, há ferramentas públicas que conseguem quebrar a proteção em horas ou dias.

How to mitigate

Substitua por algoritmos modernos: SHA-256 ou melhor para hash (ou Argon2/bcrypt para senhas), AES-256 para criptografia simétrica, ECDSA ou RSA-2048+ para assinaturas. Revise periodicamente o acervo de dependências e remova bibliotecas que só ofereçam primitivas fracas.

CVE-2020-6987—In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the affected products use a weak cEPSS 1.0%CVE-2005-4900MEDIUMSHA-1 is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attaEPSS 0.9%CVE-2016-5431—The PHP JOSE Library by Gree Inc. before version 2.2.1 is vulnerable to key confusion/algorithm substitution in the JWS component resulting EPSS 0.9%CVE-2020-10927HIGHThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 EPSS 0.9%CVE-2020-7511—A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which coEPSS 0.9%CVE-2021-36298HIGHDell EMC InsightIQ, versions prior to 4.1.4, contain risky cryptographic algorithms in the SSH component. A remote unauthenticated attacker EPSS 0.8%CVE-2020-27653HIGHAlgorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to sEPSS 0.8%CVE-2020-27652HIGHAlgorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackEPSS 0.8%CVE-2020-25232—A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Due to the usage of an insecure random numbEPSS 0.8%CVE-2026-48386HIGHColdFusion | Use of a Broken or Risky Cryptographic Algorithm (CWE-327)EPSS 0.8%CVE-2020-11035HIGHweak CSRF tokens in GLPIEPSS 0.8%CVE-2021-41168MEDIUMHash-Collision Denial-of-Service Vulnerability in snudownEPSS 0.8%CVE-2024-36823HIGHThe encrypt() function of Ninja Core v7.0.0 was discovered to use a weak cryptographic algorithm, leading to a possible leakage of sensitiveEPSS 0.8%CVE-2026-5588MEDIUMPKIX draft CompositeVerifier accepts empty signature sequence as valid.EPSS 0.8%CVE-2022-26854HIGHDell PowerScale OneFS, versions 8.2.x-9.2.x, contain risky cryptographic algorithms. A remote unprivileged malicious attacker could potentiaEPSS 0.7%CVE-2022-29249HIGHReversible One-Way Hash and Use of a Broken or Risky Cryptographic Algorithm in io.github.javaezlib.JavaEZEPSS 0.7%CVE-2024-28834MEDIUMGnutls: vulnerable to minerva side-channel information leakEPSS 0.7%CVE-2023-37464HIGHIncorrect Authentication Tag length usage in AES GCM decryption in OpenIDC/cjoseEPSS 0.7%CVE-2019-1828MEDIUMCisco Small Business RV320 and RV325 Routers Weak Credential Encryption VulnerabilityEPSS 0.7%CVE-2021-41096HIGHUse of a Broken or Risky Cryptographic Algorithm in com.mayank.ruckyEPSS 0.7%