Weaknesses of type CWE-327

401 results

Uso de algoritmo criptográfico fraco ou quebrado

A aplicação usa algoritmos de criptografia que já foram quebrados ou são reconhecidamente fracos (como MD5, SHA-1, DES, RC4), deixando dados sensíveis vulneráveis a ataques práticos. Mesmo que o algoritmo ainda funcione tecnicamente, um adversário pode recuperar a mensagem ou falsificar assinaturas com esforço computacional viável.

Example

Um sistema armazena senhas de usuários com hash MD5, ou usa SHA-1 para assinar tokens JWT, ou criptografa dados financeiros com DES. Em todos esses casos, há ferramentas públicas que conseguem quebrar a proteção em horas ou dias.

How to mitigate

Substitua por algoritmos modernos: SHA-256 ou melhor para hash (ou Argon2/bcrypt para senhas), AES-256 para criptografia simétrica, ECDSA ou RSA-2048+ para assinaturas. Revise periodicamente o acervo de dependências e remova bibliotecas que só ofereçam primitivas fracas.

CVE-2023-28053MEDIUM Dell NetWorker Virtual Edition versions 19.8 and below contain the use of deprecated cryptographic algorithms in the SSH component. A remotEPSS 0.4%CVE-2023-4326—Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that supports obsolete SHA1-based ciphersuitesEPSS 0.4%CVE-2026-76133CRITICALEbyte NA111-M Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.4%CVE-2021-38933MEDIUMIBM Sterling Connect:Express for UNIX information disclosureEPSS 0.4%CVE-2023-26276MEDIUMIBM QRadar information disclosureEPSS 0.4%CVE-2022-34361MEDIUMIBM Sterling Secure Proxy information disclosureEPSS 0.4%CVE-2023-38730MEDIUMIBM Spectrum Copy Data Management information disclosureEPSS 0.4%CVE-2023-51839CRITICALDeviceFarmer stf v3.6.6 suffers from Use of a Broken or Risky Cryptographic Algorithm.EPSS 0.4%CVE-2024-51478CRITICALUse of a Broken or Risky Cryptographic Algorithm in YesWikiEPSS 0.4%CVE-2024-10128MEDIUMTopdata Inner Rep Plus WebServer td.js.gz risky encryptionEPSS 0.4%CVE-2021-46900HIGHSympa before 6.2.62 relies on a cookie parameter for certain security objectives, but does not ensure that this parameter exists and has an EPSS 0.4%CVE-2023-27557MEDIUMIBM Safter Payments information disclosureEPSS 0.4%CVE-2023-47640MEDIUMInsecure Use of HMAC-SHA1 For Session Signing in datahubEPSS 0.4%CVE-2023-23040HIGHTP-Link router TL-WR940N V6 3.19.1 Build 180119 uses a deprecated MD5 algorithm to hash the admin password used for basic authentication.EPSS 0.4%CVE-2022-43949MEDIUMA use of a broken or risky cryptographic algorithm [CWE-327] in Fortinet FortiSIEM before 6.7.1 allows a remote unauthenticated attacker toEPSS 0.4%CVE-2026-2618MEDIUMBeetel 777VR1 SSH Service risky encryptionEPSS 0.4%CVE-2025-3200CRITICALCom-Server Exposed via Weak TLSEPSS 0.4%CVE-2023-4331—Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that support obsolete and vulnerable TLS protocolsEPSS 0.4%CVE-2024-55885MEDIUMBeego Vulnerable to Collision Hazards of MD5 in Cache Key FilenamesEPSS 0.3%CVE-2020-8911MEDIUMCBC padding oracle in AWS S3 Crypto SDK for GoLangEPSS 0.3%