Fallos del tipo CWE-326

208 resultados

Força de criptografia inadequada

A aplicação usa algoritmos ou tamanhos de chave criptográficos abaixo do padrão de segurança esperado para o contexto, deixando dados sensíveis vulneráveis a força bruta ou ataques criptanalíticos. Mesmo que o código implemente criptografia, uma chave pequena ou algoritmo fraco torna a proteção ineficaz.

Ejemplo

Um sistema bancário que salva senhas criptografadas com DES de 56 bits em vez de AES-256, ou que usa chaves RSA de 512 bits para certificados HTTPS. Um atacante com recursos moderados quebra essas chaves em horas ou dias.

Cómo mitigar

Use algoritmos modernos e reconhecidos (AES-256 para simétrico, RSA-2048+ ou curvas elípticas para assimétrico). Valide e atualize periodicamente o tamanho de chaves conforme recomendações de órgãos como NIST. Em Java/Python/.NET, prefira bibliotecas padrão (javax.crypto, cryptography, System.Security.Cryptography) e evite implementações caseiras.

CVE-2025-11935MEDIUMForward Secrecy Violation in WolfSSL TLS 1.3EPSS 0.2%CVE-2024-45259MEDIUMAn issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP reqEPSS 0.2%CVE-2025-36106MEDIUMIBM Cognos Analytics Mobile (iOS) information disclosureEPSS 0.2%CVE-2026-83885MEDIUMWindows Virtualization-Based Security (VBS) Enclave Spoofing VulnerabilityEPSS 0.2%CVE-2026-116054LOWSH3 Módulo de Gestão/Módulo de Arrecadação weak password hashEPSS 0.2%CVE-2024-38867HIGHA vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.64), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 EPSS 0.2%CVE-2023-4129MEDIUM Dell Data Protection Central, version 19.9, contains an Inadequate Encryption Strength Vulnerability. An unauthenticated network attacker cEPSS 0.2%CVE-2025-55039MEDIUMApache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacksEPSS 0.2%CVE-2021-27450—SSH server configuration file does not implement some best practices. This could lead to a weakening of the SSH protocol strength, which couEPSS 0.2%CVE-2024-54089HIGHA vulnerability has been identified in APOGEE PXC Series (BACnet) (All versions), APOGEE PXC Series (P2 Ethernet) (All versions), TALON TC SEPSS 0.2%CVE-2026-112026MEDIUMlight0011 cms UserModel.class.php sha1 weak password hashEPSS 0.2%CVE-2025-9239MEDIUMelunez eladmin DES Key EncryptUtils.java EncryptUtils inadequate encryptionEPSS 0.2%CVE-2023-54356CRITICALKyverno before 1.9.5 Sweet32 Medium Strength Cipher SuitesEPSS 0.2%CVE-2023-34337HIGHInadequate Encryption StrengthEPSS 0.2%CVE-2024-30119LOWHCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security HeaderEPSS 0.2%CVE-2026-59651HIGHBKS keystore accepts legacy version with 16-bit integrity MAC keyEPSS 0.2%CVE-2019-18263—An issue was found in Philips Veradius Unity, Pulsera, and Endura Dual WAN Router, Veradius Unity (718132) with wireless option (shipped betEPSS 0.2%CVE-2023-21444HIGHImproper cryptographic implementation in Samsung Flow for PC 4.9.14.0 allows adjacent attackers to decrypt encrypted messages or inject commEPSS 0.2%CVE-2023-21443HIGHImproper cryptographic implementation in Samsung Flow for Android prior to version 4.9.04 allows adjacent attackers to decrypt encrypted mesEPSS 0.2%CVE-2026-35146MEDIUMHCL DFXServer is affected by an Unencrypted Communication vulnerability.EPSS 0.2%