Weaknesses of type CWE-327

401 results

Uso de algoritmo criptográfico fraco ou quebrado

A aplicação usa algoritmos de criptografia que já foram quebrados ou são reconhecidamente fracos (como MD5, SHA-1, DES, RC4), deixando dados sensíveis vulneráveis a ataques práticos. Mesmo que o algoritmo ainda funcione tecnicamente, um adversário pode recuperar a mensagem ou falsificar assinaturas com esforço computacional viável.

Example

Um sistema armazena senhas de usuários com hash MD5, ou usa SHA-1 para assinar tokens JWT, ou criptografa dados financeiros com DES. Em todos esses casos, há ferramentas públicas que conseguem quebrar a proteção em horas ou dias.

How to mitigate

Substitua por algoritmos modernos: SHA-256 ou melhor para hash (ou Argon2/bcrypt para senhas), AES-256 para criptografia simétrica, ECDSA ou RSA-2048+ para assinaturas. Revise periodicamente o acervo de dependências e remova bibliotecas que só ofereçam primitivas fracas.

CVE-2022-45170MEDIUMAn issue was discovered in LIVEBOX Collaboration vDesk through v018. A Cryptographic Issue can occur under the /api/v1/vencrypt/decrypt/fileEPSS 0.4%CVE-2026-69382MEDIUMMicrosoft Exchange Server Information Disclosure VulnerabilityEPSS 0.4%CVE-2024-25968MEDIUMDell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unaEPSS 0.4%CVE-2022-31157HIGHUse of a Broken or Risky Cryptographic Algorithm in packbackbooks/lti-1-3-php-libraryEPSS 0.4%CVE-2025-34208HIGHVasion Print (formerly PrinterLogic) Insecure Password HashingEPSS 0.4%CVE-2022-22313MEDIUMIBM QRadar Data Synchronization App information disclosureEPSS 0.4%CVE-2019-14852—A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol. An attacker could target traffic using this weaker protocol EPSS 0.4%CVE-2026-22585CRITICALUse of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, PrEPSS 0.4%CVE-2024-40465HIGHAn issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go fileEPSS 0.4%CVE-2022-34444MEDIUM Dell PowerScale OneFS, versions 9.2.0.x through 9.4.0.x contain an information vulnerability. A remote unauthenticated attacker may potentiEPSS 0.4%CVE-2026-21718CRITICALCopeland XWEB and XWEB Pro Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.4%CVE-2025-69929CRITICALAn issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate privileges via the password hashing on the cEPSS 0.4%CVE-2023-38361MEDIUMIBM CICS TX Advanced information disclosureEPSS 0.4%CVE-2023-23695MEDIUM Dell Secure Connect Gateway (SCG) version 5.14.00.12 contains a broken cryptographic algorithm vulnerability. A remote unauthenticated attaEPSS 0.4%CVE-2023-39252MEDIUM Dell SCG Policy Manager 5.16.00.14 contains a broken cryptographic algorithm vulnerability. A remote unauthenticated attacker may potentiaEPSS 0.4%CVE-2023-28076MEDIUM CloudLink 7.1.2 and all prior versions contain a broken or risky cryptographic algorithm vulnerability. An unauthenticated remote attacker EPSS 0.4%CVE-2022-43843MEDIUMIBM Spectrum Scale information disclosureEPSS 0.4%CVE-2022-29161MEDIUMCrypto script service uses hashing algorithm SHA1 with RSA for certificate signature in xwiki-platformEPSS 0.4%CVE-2024-52801MEDIUMBrute force takeover of OpenID Connect session cookies in sftpgoEPSS 0.4%CVE-2023-28053MEDIUM Dell NetWorker Virtual Edition versions 19.8 and below contain the use of deprecated cryptographic algorithms in the SSH component. A remotEPSS 0.4%