Fallos del tipo CWE-326

195 resultados

Força de criptografia inadequada

A aplicação usa algoritmos ou tamanhos de chave criptográficos abaixo do padrão de segurança esperado para o contexto, deixando dados sensíveis vulneráveis a força bruta ou ataques criptanalíticos. Mesmo que o código implemente criptografia, uma chave pequena ou algoritmo fraco torna a proteção ineficaz.

Ejemplo

Um sistema bancário que salva senhas criptografadas com DES de 56 bits em vez de AES-256, ou que usa chaves RSA de 512 bits para certificados HTTPS. Um atacante com recursos moderados quebra essas chaves em horas ou dias.

Cómo mitigar

Use algoritmos modernos e reconhecidos (AES-256 para simétrico, RSA-2048+ ou curvas elípticas para assimétrico). Valide e atualize periodicamente o tamanho de chaves conforme recomendações de órgãos como NIST. Em Java/Python/.NET, prefira bibliotecas padrão (javax.crypto, cryptography, System.Security.Cryptography) e evite implementações caseiras.

CVE-2024-29950HIGHBrocade SANnav before v2.3.1, v2.3.0a uses weak encryptionEPSS 0.3%CVE-2020-7565HIGHA CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker EPSS 0.3%CVE-2024-23564CRITICALHCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from thEPSS 0.3%CVE-2025-7789MEDIUMXuxueli xxl-job Token Generation IndexController.java makeToken weak password hashEPSS 0.3%CVE-2020-4099MEDIUMHCL Verse for Android is susceptible to an APK signing key check vulnerabilityEPSS 0.3%CVE-2024-29969HIGHTLS/SSL weak message authentication code ciphers are added by default for port 18082EPSS 0.3%CVE-2026-65777MEDIUMActive Directory Security Feature Bypass VulnerabilityEPSS 0.3%CVE-2024-21881HIGHUpload of encrypted packages allows authenticated command execution in Enphase IQ Gateway v4.x and v5.xEPSS 0.3%CVE-2026-7830HIGHUltraVNC MS-Logon II uses 64-bit Diffie-Hellman and seeded libc rand() enabling credential interceptionEPSS 0.3%CVE-2024-33662HIGHPortainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function.EPSS 0.3%CVE-2020-10636MEDIUMICSA-20-140-02 Emerson OpenEnterpriseEPSS 0.3%CVE-2024-41594HIGHAn issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the VigoEPSS 0.3%CVE-2025-63579HIGHUnauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. The security measure that enEPSS 0.3%CVE-2022-48193MEDIUMWeak ciphers vulnerability in Softing smartLink SW-HTEPSS 0.3%CVE-2026-45363CRITICAL`jwt` (Ruby gem) - empty-key HMAC bypassEPSS 0.3%CVE-2025-46833MEDIUMPrograms/P73_SimplePythonEncryption.py has weak cryptographic keyEPSS 0.3%CVE-2025-4894MEDIUMcalmkart Django-sso-server crypto.py gen_rsa_keys inadequate encryptionEPSS 0.3%CVE-2023-29054MEDIUMA vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE EPSS 0.3%CVE-2022-2640HIGHThe Config-files of Horner Automation’s RCC 972 with firmware version 15.40 are encrypted with weak XOR encryption vulnerable to reverse engEPSS 0.3%CVE-2024-5800HIGHDiffie-Hellman groups with insufficient strength used in SSL/TLS stack of B&R Automation RuntimeEPSS 0.3%