Fallos del tipo CWE-326

195 resultados

Força de criptografia inadequada

A aplicação usa algoritmos ou tamanhos de chave criptográficos abaixo do padrão de segurança esperado para o contexto, deixando dados sensíveis vulneráveis a força bruta ou ataques criptanalíticos. Mesmo que o código implemente criptografia, uma chave pequena ou algoritmo fraco torna a proteção ineficaz.

Ejemplo

Um sistema bancário que salva senhas criptografadas com DES de 56 bits em vez de AES-256, ou que usa chaves RSA de 512 bits para certificados HTTPS. Um atacante com recursos moderados quebra essas chaves em horas ou dias.

Cómo mitigar

Use algoritmos modernos e reconhecidos (AES-256 para simétrico, RSA-2048+ ou curvas elípticas para assimétrico). Valide e atualize periodicamente o tamanho de chaves conforme recomendações de órgãos como NIST. Em Java/Python/.NET, prefira bibliotecas padrão (javax.crypto, cryptography, System.Security.Cryptography) e evite implementações caseiras.

CVE-2025-1241MEDIUMEncryption vulnerable to brute-force decryption in GoAnywhere MFTEPSS 0.1%CVE-2022-38659MEDIUMHCL BigFix Platform is affected by insecure credential storageEPSS 0.1%CVE-2023-4333—Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by serverEPSS 0.1%CVE-2026-44523CRITICALNote Mark: JWT Secret Weakness allows Full Account Takeover via token forgeryEPSS 0.1%CVE-2025-45770HIGHjwt v5.4.3 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be seEPSS 0.1%CVE-2026-17520MEDIUMNewsletters < 4.17 - Unauthenticated API Access via Predictable API KeyEPSS 0.1%CVE-2024-1224HIGHInformation Disclosure Vulnerability in CDAC USB PratirodhEPSS 0.1%CVE-2026-4648MEDIUMInsufficient Encryption Level in CasfID Servicios Tecnológicos NFC WristbandsEPSS 0.1%CVE-2026-39349LOWOrangeHRM Uses AES-ECB for Sensitive Data Encryption Enables Pattern DisclosureEPSS 0.1%CVE-2023-33283MEDIUMMarval MSM through 14.19.0.12476 uses a static encryption key for secrets. An attacker that gains access to encrypted secrets can decrypt thEPSS 0.1%CVE-2026-45787MEDIUMelecterm's encrypt method not safe enoughEPSS 0.1%CVE-2023-34971HIGHQTS, QuTS heroEPSS 0.1%CVE-2026-5889MEDIUMCryptographic Flaw in PDFium in Google Chrome prior to 147.0.7727.55 allowed an attacker to read potentially sensitive information from encrEPSS 0.1%CVE-2022-1318MEDIUMHills ComNav Inadequate Encryption StrengthEPSS 0.1%CVE-2020-16235LOWEmerson OpenEnterprise - Inadequate Encryption StrengthEPSS 0.1%CVE-2026-86824MEDIUMNewsletter < 9.3.8 - Unauthenticated Subscriber PII Disclosure and Modification via Predictable Tracking Signature KeyEPSS 0.1%CVE-2025-39889HIGHBluetooth: l2cap: Check encryption key size on incoming connectionEPSS 0.1%CVE-2026-5363MEDIUMUse of weak cryptographic key in TP-Link Archer C7EPSS 0.1%CVE-2023-21145—In updatePictureInPictureMode of ActivityRecord.java, there is a possible bypass of background launch restrictions due to a logic error in tEPSS 0.1%CVE-2023-2197LOWVault Enterprise Vulnerable to Padding Oracle Attacks When Using a CBC-based Encryption Mechanism with a HSMEPSS 0.1%