Fallos del tipo CWE-326

208 resultados

Força de criptografia inadequada

A aplicação usa algoritmos ou tamanhos de chave criptográficos abaixo do padrão de segurança esperado para o contexto, deixando dados sensíveis vulneráveis a força bruta ou ataques criptanalíticos. Mesmo que o código implemente criptografia, uma chave pequena ou algoritmo fraco torna a proteção ineficaz.

Ejemplo

Um sistema bancário que salva senhas criptografadas com DES de 56 bits em vez de AES-256, ou que usa chaves RSA de 512 bits para certificados HTTPS. Um atacante com recursos moderados quebra essas chaves em horas ou dias.

Cómo mitigar

Use algoritmos modernos e reconhecidos (AES-256 para simétrico, RSA-2048+ ou curvas elípticas para assimétrico). Valide e atualize periodicamente o tamanho de chaves conforme recomendações de órgãos como NIST. Em Java/Python/.NET, prefira bibliotecas padrão (javax.crypto, cryptography, System.Security.Cryptography) e evite implementações caseiras.

CVE-2021-27457—A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected products utilize a weak encrypEPSS 0.5%CVE-2020-1982MEDIUMPAN-OS: TLS 1.0 usage for certain communications with Palo Alto Networks cloud delivered servicesEPSS 0.4%CVE-2018-5461—An Inadequate Encryption Strength issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS ClassEPSS 0.4%CVE-2024-32758CRITICALexacqVision - Key exchangesEPSS 0.4%CVE-2024-23656HIGHDex 2.37.0 is discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphersEPSS 0.4%CVE-2018-25272CRITICALELBA5 5.8.0 Remote Code Execution via Database AccessEPSS 0.4%CVE-2001-1546HIGHPathways Homecare 6.5 uses weak encryption for user names and passwords, which allows local users to gain privileges by recovering the passwEPSS 0.4%CVE-2021-32945HIGHMDT AutoSave Inadequate Encryption StrengthEPSS 0.4%CVE-2022-2758MEDIUMUpdateEPSS 0.4%CVE-2024-28755MEDIUMAn issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum EPSS 0.4%CVE-2021-36337MEDIUMDell Wyse Management Suite version 3.3.1 and prior support insecure Transport Security Protocols TLS 1.0 and TLS 1.1 which are susceptible tEPSS 0.4%CVE-2021-21387HIGHPartial secret key disclosure, improper safety number calculation, & inadequate encryption strengthEPSS 0.4%CVE-2022-24318—A CWE-326: Inadequate Encryption Strength vulnerability exists that could cause non-encrypted communication with the server when outdated veEPSS 0.4%CVE-2026-86670MEDIUMaircheng-org iWebShop-5 Authentication Storage admin.php weak password hashEPSS 0.4%CVE-2021-37209MEDIUMA vulnerability has been identified in RUGGEDCOM i800 (All versions < V4.3.8), RUGGEDCOM i801 (All versions < V4.3.8), RUGGEDCOM i802 (All vEPSS 0.4%CVE-2026-9201HIGHLangflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handlingEPSS 0.4%CVE-2026-45363CRITICAL`jwt` (Ruby gem) - empty-key HMAC bypassEPSS 0.4%CVE-2020-4099MEDIUMHCL Verse for Android is susceptible to an APK signing key check vulnerabilityEPSS 0.4%CVE-2026-65777MEDIUMActive Directory Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2026-74889CRITICALopenssl_encrypt before 1.4.0 Weak Key Derivation via HKDFEPSS 0.3%