Fallos del tipo CWE-326

208 resultados

Força de criptografia inadequada

A aplicação usa algoritmos ou tamanhos de chave criptográficos abaixo do padrão de segurança esperado para o contexto, deixando dados sensíveis vulneráveis a força bruta ou ataques criptanalíticos. Mesmo que o código implemente criptografia, uma chave pequena ou algoritmo fraco torna a proteção ineficaz.

Ejemplo

Um sistema bancário que salva senhas criptografadas com DES de 56 bits em vez de AES-256, ou que usa chaves RSA de 512 bits para certificados HTTPS. Um atacante com recursos moderados quebra essas chaves em horas ou dias.

Cómo mitigar

Use algoritmos modernos e reconhecidos (AES-256 para simétrico, RSA-2048+ ou curvas elípticas para assimétrico). Valide e atualize periodicamente o tamanho de chaves conforme recomendações de órgãos como NIST. Em Java/Python/.NET, prefira bibliotecas padrão (javax.crypto, cryptography, System.Security.Cryptography) e evite implementações caseiras.

CVE-2014-2381—Schneider Electric Wonderware Inadequate Encryption StrengthEPSS 0.1%CVE-2026-0510LOWObsolete Encryption Algorithm Used in NW AS Java UME User MappingEPSS 0.1%CVE-2025-2516CRITICALUse of a weak cryptographic key in the signature verification process in WPS OfficeEPSS 0.1%CVE-2022-40745MEDIUMIBM Aspera Faspex information disclosureEPSS 0.1%CVE-2026-121109—Inadequate encryption strength in SSL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin polEPSS 0.1%CVE-2024-25102HIGHInformation Disclosure Vulnerability in CDAC AppSamvid SoftwareEPSS 0.1%CVE-2025-68703HIGHJervis has a Salt for PBKDF2 derived from passwordEPSS 0.1%CVE-2024-13026MEDIUMInadequate Encryption Strength Vulnerability in Roche Algo EdgeEPSS 0.1%CVE-2026-79084MEDIUMInadequate encryption strength in Notifications in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging sEPSS 0.1%CVE-2022-38659MEDIUMHCL BigFix Platform is affected by insecure credential storageEPSS 0.1%CVE-2026-50044HIGHInadequate Encryption Strength in Panduit IntraVUE by PronetiqsEPSS 0.1%CVE-2022-34385MEDIUM SupportAssist for Home PCs (version 3.11.4 and prior) and  SupportAssist for Business PCs (version 3.2.0 and prior) contain cryptographic wEPSS 0.1%CVE-2024-28974HIGHDell Data Protection Advisor, version(s) 19.9, contain(s) an Inadequate Encryption Strength vulnerability. A low privileged attacker with reEPSS 0.1%CVE-2025-1241MEDIUMEncryption vulnerable to brute-force decryption in GoAnywhere MFTEPSS 0.1%CVE-2023-21109HIGHIn multiple places of AccessibilityService, there is a possible way to hide the app from the user due to a logic error in the code. This couEPSS 0.1%CVE-2023-4333—Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by serverEPSS 0.1%CVE-2024-1224HIGHInformation Disclosure Vulnerability in CDAC USB PratirodhEPSS 0.1%CVE-2026-105193MEDIUMBooking Calendar < 11.8 - Unauthenticated Booking Information Disclosure and Modification via Predictable Booking HashEPSS 0.1%CVE-2026-35088HIGHInadequate Encryption Strength in Slican telephone exchangesEPSS 0.1%CVE-2026-43134HIGHBluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQEPSS 0.1%