Fallos del tipo CWE-326

208 resultados

Força de criptografia inadequada

A aplicação usa algoritmos ou tamanhos de chave criptográficos abaixo do padrão de segurança esperado para o contexto, deixando dados sensíveis vulneráveis a força bruta ou ataques criptanalíticos. Mesmo que o código implemente criptografia, uma chave pequena ou algoritmo fraco torna a proteção ineficaz.

Ejemplo

Um sistema bancário que salva senhas criptografadas com DES de 56 bits em vez de AES-256, ou que usa chaves RSA de 512 bits para certificados HTTPS. Um atacante com recursos moderados quebra essas chaves em horas ou dias.

Cómo mitigar

Use algoritmos modernos e reconhecidos (AES-256 para simétrico, RSA-2048+ ou curvas elípticas para assimétrico). Valide e atualize periodicamente o tamanho de chaves conforme recomendações de órgãos como NIST. Em Java/Python/.NET, prefira bibliotecas padrão (javax.crypto, cryptography, System.Security.Cryptography) e evite implementações caseiras.

CVE-2026-39349LOWOrangeHRM Uses AES-ECB for Sensitive Data Encryption Enables Pattern DisclosureEPSS 0.1%CVE-2023-33283MEDIUMMarval MSM through 14.19.0.12476 uses a static encryption key for secrets. An attacker that gains access to encrypted secrets can decrypt thEPSS 0.1%CVE-2026-5889MEDIUMCryptographic Flaw in PDFium in Google Chrome prior to 147.0.7727.55 allowed an attacker to read potentially sensitive information from encrEPSS 0.1%CVE-2026-45787MEDIUMelecterm's encrypt method not safe enoughEPSS 0.1%CVE-2023-34971HIGHQTS, QuTS heroEPSS 0.1%CVE-2020-16235LOWEmerson OpenEnterprise - Inadequate Encryption StrengthEPSS 0.1%CVE-2022-1318MEDIUMHills ComNav Inadequate Encryption StrengthEPSS 0.1%CVE-2025-39889HIGHBluetooth: l2cap: Check encryption key size on incoming connectionEPSS 0.1%CVE-2023-21145—In updatePictureInPictureMode of ActivityRecord.java, there is a possible bypass of background launch restrictions due to a logic error in tEPSS 0.1%CVE-2026-5363MEDIUMUse of weak cryptographic key in TP-Link Archer C7EPSS 0.1%CVE-2025-22446MEDIUMInadequate encryption strength for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to poteEPSS 0.1%CVE-2021-40341HIGHWeak DES encryptionEPSS 0.1%CVE-2023-2197LOWVault Enterprise Vulnerable to Padding Oracle Attacks When Using a CBC-based Encryption Mechanism with a HSMEPSS 0.1%CVE-2025-32874HIGHAn issue was discovered in Kaseya Rapid Fire Tools Network Detective through 2.0.16.0. A vulnerability exists in the EncryptionUtil class beEPSS 0.1%CVE-2022-4048HIGHCODESYS V3 prone to Inadequate Encryption StregthEPSS 0.1%CVE-2024-13454MEDIUMWeak encryption algorithm in Easy-RSA version 3.0.5 through 3.1.7 allows a local attacker to more easily bruteforce the private CA key when EPSS 0.1%CVE-2023-28124MEDIUMImproper usage of symmetric encryption in UI Desktop for Windows (Version 0.59.1.71 and earlier) could allow users with access to UI DesktopEPSS 0.1%CVE-2025-48960MEDIUMWeak server key used for TLS encryption. The following products are affected: Acronis Cyber Protect 16 (Linux, macOS, Windows) before build EPSS 0.1%CVE-2026-112029LOWdiem-project diem SHA1 PluginDmUser.class.php weak password hashEPSS 0.1%CVE-2023-37397LOWIBM Aspera Faspex data manipulationEPSS 0.1%