Fallos del tipo CWE-327

401 resultados

Uso de algoritmo criptográfico fraco ou quebrado

É quando o código utiliza algoritmos de criptografia que foram comprometidos, obsoletos ou nunca foram seguros (como MD5, DES, SHA-1 em contextos sensíveis). Esses algoritmos permitem que um atacante recupere dados criptografados com esforço computacional viável, invalidando a proteção que deveriam oferecer.

Ejemplo

Uma aplicação bancária que criptografa senhas usando MD5 ou MD5(senha + salt), ou que negocia conexão HTTPS com suporte a TLS 1.0. Em ambos os casos, ferramentas públicas conseguem quebrar a proteção em horas ou minutos.

Cómo mitigar

Use algoritmos atuais: SHA-256+ (ou bcrypt/scrypt) para hashing de senhas, AES-256 para dados em repouso, e TLS 1.2+ (idealmente 1.3) para trânsito. Revise regularmente o padrão NIST ou recomendações do OWASP e retire suporte a algoritmos deprecados das suas dependências e configurações.

CVE-2026-56454MEDIUMHCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1.EPSS 0.2%CVE-2023-30994MEDIUMIBM QRadar SIEM information disclosureEPSS 0.2%CVE-2025-65849CRITICALA cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-WoEPSS 0.2%CVE-2020-7514—A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could EPSS 0.2%CVE-2026-47775MEDIUMEnvoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie DecryptionEPSS 0.2%CVE-2021-43550MEDIUMPhilips Patient Information Center iX (PIC iX) and Efficia CM Series Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.2%CVE-2022-43851MEDIUMIBM Aspera Console information disclosureEPSS 0.2%CVE-2025-55112HIGHBMC Control-M/Agent hardcoded Blowfish keysEPSS 0.2%CVE-2024-52331HIGHECOVACS lawnmowers and vacuums deterministic firmware encryption keyEPSS 0.2%CVE-2026-28252CRITICALUse of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer ConciergeEPSS 0.2%CVE-2024-45643MEDIUMIBM QRadar EDR information disclosureEPSS 0.2%CVE-2024-51556HIGHSensitive Information Disclosure Vulnerability in Wave 2.0EPSS 0.2%CVE-2024-41775MEDIUMIBM Cognos Controller information disclosureEPSS 0.2%CVE-2025-65831HIGHThe application uses an insecure hashing algorithm (MD5) to hash passwords. If an attacker obtained a copy of these hashes, either through eEPSS 0.2%CVE-2025-33147MEDIUMIBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilitiesEPSS 0.2%CVE-2024-27256MEDIUMIBM MQ Operator information disclosureEPSS 0.2%CVE-2025-14761MEDIUMMissing cryptographic key commitment in the AWS SDK for PHP may allow a user with write access to the S3 bucket to introduce a new EDK that EPSS 0.2%CVE-2025-36161MEDIUMIBM Concert Software Information DisclosureEPSS 0.2%CVE-2025-43891MEDIUMDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 releasEPSS 0.2%CVE-2025-33084MEDIUMIBM Concert Software information disclosureEPSS 0.2%