Fallos del tipo CWE-326

208 resultados

Força de criptografia inadequada

A aplicação usa algoritmos ou tamanhos de chave criptográficos abaixo do padrão de segurança esperado para o contexto, deixando dados sensíveis vulneráveis a força bruta ou ataques criptanalíticos. Mesmo que o código implemente criptografia, uma chave pequena ou algoritmo fraco torna a proteção ineficaz.

Ejemplo

Um sistema bancário que salva senhas criptografadas com DES de 56 bits em vez de AES-256, ou que usa chaves RSA de 512 bits para certificados HTTPS. Um atacante com recursos moderados quebra essas chaves em horas ou dias.

Cómo mitigar

Use algoritmos modernos e reconhecidos (AES-256 para simétrico, RSA-2048+ ou curvas elípticas para assimétrico). Valide e atualize periodicamente o tamanho de chaves conforme recomendações de órgãos como NIST. Em Java/Python/.NET, prefira bibliotecas padrão (javax.crypto, cryptography, System.Security.Cryptography) e evite implementações caseiras.

CVE-2023-37301—An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3. Because it doesn't use EditEntity for undo and restorEPSS 0.3%CVE-2021-38464MEDIUMInHand Networks IR615 RouterEPSS 0.3%CVE-2025-7789MEDIUMXuxueli xxl-job Token Generation IndexController.java makeToken weak password hashEPSS 0.3%CVE-2023-29549MEDIUMUnder certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm. This may have created a vulnEPSS 0.3%CVE-2019-18241—In Philips IntelliBridge EC40 and EC80, IntelliBridge EC40 Hub all versions, and IntelliBridge EC80 Hub all versions, the SSH server runningEPSS 0.3%CVE-2024-42163HIGHPassword ManipulationEPSS 0.3%CVE-2018-16499—In VOS compromised, an attacker at network endpoints can possibly view communications between an unsuspecting user and the service using manEPSS 0.3%CVE-2024-29950HIGHBrocade SANnav before v2.3.1, v2.3.0a uses weak encryptionEPSS 0.3%CVE-2026-114616HIGHAuthlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)EPSS 0.3%CVE-2024-23564CRITICALHCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from thEPSS 0.3%CVE-2020-7565HIGHA CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker EPSS 0.3%CVE-2024-29969HIGHTLS/SSL weak message authentication code ciphers are added by default for port 18082EPSS 0.3%CVE-2024-21881HIGHUpload of encrypted packages allows authenticated command execution in Enphase IQ Gateway v4.x and v5.xEPSS 0.3%CVE-2026-7830HIGHUltraVNC MS-Logon II uses 64-bit Diffie-Hellman and seeded libc rand() enabling credential interceptionEPSS 0.3%CVE-2024-33662HIGHPortainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function.EPSS 0.3%CVE-2026-77405CRITICALRabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI ParserEPSS 0.3%CVE-2020-10636MEDIUMICSA-20-140-02 Emerson OpenEnterpriseEPSS 0.3%CVE-2025-4894MEDIUMcalmkart Django-sso-server crypto.py gen_rsa_keys inadequate encryptionEPSS 0.3%CVE-2024-41594HIGHAn issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the VigoEPSS 0.3%CVE-2022-48193MEDIUMWeak ciphers vulnerability in Softing smartLink SW-HTEPSS 0.3%