Fallos del tipo CWE-327

401 resultados

Uso de algoritmo criptográfico fraco ou quebrado

É quando o código utiliza algoritmos de criptografia que foram comprometidos, obsoletos ou nunca foram seguros (como MD5, DES, SHA-1 em contextos sensíveis). Esses algoritmos permitem que um atacante recupere dados criptografados com esforço computacional viável, invalidando a proteção que deveriam oferecer.

Ejemplo

Uma aplicação bancária que criptografa senhas usando MD5 ou MD5(senha + salt), ou que negocia conexão HTTPS com suporte a TLS 1.0. Em ambos os casos, ferramentas públicas conseguem quebrar a proteção em horas ou minutos.

Cómo mitigar

Use algoritmos atuais: SHA-256+ (ou bcrypt/scrypt) para hashing de senhas, AES-256 para dados em repouso, e TLS 1.2+ (idealmente 1.3) para trânsito. Revise regularmente o padrão NIST ou recomendações do OWASP e retire suporte a algoritmos deprecados das suas dependências e configurações.

CVE-2025-48946LOWliboqs affected by theoretical design flaw in HQCEPSS 0.2%CVE-2026-54780LOWCoreWCF: WS-Security Reference DigestMethod Algorithm-Suite BypassEPSS 0.2%CVE-2025-68701HIGHJervis has Deterministic AES IV Derivation from PassphraseEPSS 0.2%CVE-2021-47712MEDIUMKentico Xperience <= 12.0.102 URL Hashing Cryptography VulnerabilityEPSS 0.2%CVE-2024-4563MEDIUMThe Progress MOVEit Automation Configuration Export Function Uses a Cryptographic Method with Insufficient Bit LengthEPSS 0.2%CVE-2026-34950CRITICALfast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public KeyEPSS 0.2%CVE-2026-33512HIGHAVideo has an unauthenticated decrypt oracle leaking any ciphertextEPSS 0.2%CVE-2022-46140HIGHAffected devices use a weak encryption scheme to encrypt the debug zip file. This could allow an authenticated attacker to decrypt the conteEPSS 0.2%CVE-2026-14630LOWForceInjection AI-fundermentals Memory Recall smart_customer_service.py get_conversation_history weak hashEPSS 0.2%CVE-2026-15605LOWwandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hashEPSS 0.2%CVE-2026-14742LOWlangchain-ai langgraph Task Result Cache _cache.py _freeze weak hashEPSS 0.2%CVE-2026-45701MEDIUMSulu: Weak Cryptographical usage for API Key generation and Reset TokensEPSS 0.2%CVE-2023-26024MEDIUMIBM Planning Analytics on Cloud Pak for Data information disclosureEPSS 0.2%CVE-2025-8260LOWVaelsys VaelsysV4 Web interface vgrid_server.php weak hashEPSS 0.2%CVE-2020-8912LOWIn-band key negotiation issue in AWS S3 Crypto SDK for GoLangEPSS 0.2%CVE-2023-36608MEDIUM The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm.EPSS 0.2%CVE-2024-38320MEDIUMIBM Storage Protect for Virtual Environments: Data Protection for VMware information disclosureEPSS 0.2%CVE-2024-22314MEDIUMIBM Storage Defender - Resiliency Service information disclosureEPSS 0.2%CVE-2026-3598HIGHRustDesk Server Generates Config Strings Using Reversible Encoding (Base64 + Reverse) Instead of EncryptionEPSS 0.2%CVE-2024-30152MEDIUMHCL SX is affected by usage of a weak cryptographic algorithmEPSS 0.2%