Weaknesses of type CWE-328

95 results

Uso de função hash fraca ou desatualizada

É o uso de algoritmos de hash criptográfico obsoletos ou com colisões conhecidas (como MD5 ou SHA-1) em contextos de segurança críticos, como autenticação, integridade de dados ou assinatura. Atacantes conseguem forjar hashes ou encontrar colisões, comprometendo a confidencialidade ou autenticidade da operação.

Example

Uma aplicação usa MD5 para armazenar senhas de usuários. Um atacante obtém a base de dados e, em minutos, reverte os hashes usando rainbow tables públicas ou força bruta, porque MD5 é extremamente rápido de calcular e tem colisões documentadas.

How to mitigate

Substitua MD5 e SHA-1 por SHA-256, SHA-3 ou bcrypt/scrypt/Argon2 conforme o caso (hash simples vs. derivação de senha). Para código legado, migrate gradualmente: comece a usar algoritmos fortes para novos registros e force re-hash na próxima autenticação do usuário.

CVE-2025-59354MEDIUMDragonfly has weak integrity checks for downloaded filesEPSS 0.2%CVE-2025-11650LOWTomofun Furbo 360/Furbo Mini Password shadow weak hashEPSS 0.2%CVE-2026-11479LOWyoanbernabeu grepai Qdrant Backend chunker.go weak hashEPSS 0.2%CVE-2025-9078MEDIUMWeak cache keys lead to post IDOR and link preview poisoningEPSS 0.2%CVE-2024-23589MEDIUMHCL Glovius Cloud is susceptible to an Outdated Hash Algorithm vulnerabilityEPSS 0.2%CVE-2026-65104HIGHNVIDIA Megatron-LM for all platforms contains a vulnerability in inference, where an attacker could cause hash collisions in the cache used EPSS 0.1%CVE-2026-7845LOWchatchat-space Langchain-Chatchat Vision Chat Paste Image dialogue.py PIL.Image.tobytes weak hashEPSS 0.1%CVE-2026-27754MEDIUMSODOLA SL902-SWTGW124AS <= 200.1.20 MD5 Session Token GenerationEPSS 0.1%CVE-2025-2920LOWNetis WF-2404 passwd weak hashEPSS 0.1%CVE-2025-41256HIGHCyberduck and Mountain Duck - Weak Hash Algorithm for Certificate FingerprintEPSS 0.1%CVE-2026-54266HIGHAngular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State PoisoningEPSS 0.1%CVE-2025-26486MEDIUMBroken or Risky Cryptographic Algorithm, Use of Password Hash With Insufficient Computational Effort, Use of Weak Hash, Use of a One-Way HEPSS 0.1%CVE-2026-97469MEDIUMPostgreSQL Anonymizer: RESTRICTED functions are reachable through a subLinkEPSS 0.1%CVE-2023-43635HIGHVault Key Sealed With SHA1 PCRsEPSS 0.1%CVE-2023-43630HIGHConfig Partition Not Measured From 2 FrontsEPSS 0.1%CVE-2026-53692MEDIUMWeak hashing algorithm in Redeight CMSEPSS 0.1%CVE-2024-56414MEDIUMWeb installer integrity check used weak hash algorithm. The following products are affected: Acronis Cyber Protect 16 (Windows) before buildEPSS 0.1%CVE-2026-10540MEDIUMWeak password hash protection in Control-M/Entreprise ManagerEPSS 0.1%CVE-2026-10783LOWgradio-app gradio Audio Cache Key save_audio_to_cache weak hashEPSS 0.1%CVE-2025-9383LOWFNKvision Y215 CCTV Camera passwd crypt weak hashEPSS 0.1%