Fallos del tipo CWE-327

413 resultados

Uso de algoritmo criptográfico fraco ou quebrado

É quando o código utiliza algoritmos de criptografia que foram comprometidos, obsoletos ou nunca foram seguros (como MD5, DES, SHA-1 em contextos sensíveis). Esses algoritmos permitem que um atacante recupere dados criptografados com esforço computacional viável, invalidando a proteção que deveriam oferecer.

Ejemplo

Uma aplicação bancária que criptografa senhas usando MD5 ou MD5(senha + salt), ou que negocia conexão HTTPS com suporte a TLS 1.0. Em ambos os casos, ferramentas públicas conseguem quebrar a proteção em horas ou minutos.

Cómo mitigar

Use algoritmos atuais: SHA-256+ (ou bcrypt/scrypt) para hashing de senhas, AES-256 para dados em repouso, e TLS 1.2+ (idealmente 1.3) para trânsito. Revise regularmente o padrão NIST ou recomendações do OWASP e retire suporte a algoritmos deprecados das suas dependências e configurações.

CVE-2024-28972MEDIUMDell InsightIQ, Verion 5.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. An unauthenticated remote attacker EPSS 0.3%CVE-2024-21670MEDIUMCL-Signatures Revocation Scheme in Ursa has flaws that allow a holder to demonstrate non-revocation of a revoked credentialEPSS 0.3%CVE-2025-8260LOWVaelsys VaelsysV4 Web interface vgrid_server.php weak hashEPSS 0.3%CVE-2024-4765HIGHWeb application manifests were stored by using an insecure MD5 hash which allowed for a hash collision to overwrite another application's maEPSS 0.3%CVE-2026-30791HIGHRustDesk Client Accepts Pseudo-Encrypted Config Strings Without Cryptographic ValidationEPSS 0.3%CVE-2026-74888HIGHopenssl_encrypt before 1.4.0 Non-Standard PBKDF2 Key DerivationEPSS 0.3%CVE-2020-4874MEDIUMIBM Cognos Controller information disclosureEPSS 0.3%CVE-2023-40696MEDIUMIBM Cognos Controller information disclosureEPSS 0.3%CVE-2024-52366MEDIUMIBM Concert Software information disclosureEPSS 0.3%CVE-2024-43189MEDIUMIBM Concert Software information disclosureEPSS 0.3%CVE-2026-27871LOWTL280EPSS 0.3%CVE-2026-29129HIGHApache Tomcat: TLS cipher order is not preservedEPSS 0.3%CVE-2026-3598HIGHRustDesk Server Generates Config Strings Using Reversible Encoding (Base64 + Reverse) Instead of EncryptionEPSS 0.3%CVE-2024-27255MEDIUMIBM MQ Container information disclosureEPSS 0.3%CVE-2024-29175MEDIUMDell PowerProtect Data Domain, versions prior to 7.13.0.0, LTS 7.7.5.40, LTS 7.10.1.30 contain an weak cryptographic algorithm vulnerabilityEPSS 0.3%CVE-2018-5382—Bouncy Castle BKS-V1 keystore files vulnerable to trivial hash collisionsEPSS 0.3%CVE-2026-44699CRITICALLibJWT: Algorithm confusion allows JWT forgery with RSA JWK as empty-key HMACEPSS 0.3%CVE-2026-9221HIGHSetracker2 Children's Smartwatch Ecosystem Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.3%CVE-2025-49196MEDIUMDeprecated TLS version supportedEPSS 0.3%CVE-2026-11929HIGHSecurity vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.3%