Fallos del tipo CWE-327

401 resultados

Uso de algoritmo criptográfico fraco ou quebrado

É quando o código utiliza algoritmos de criptografia que foram comprometidos, obsoletos ou nunca foram seguros (como MD5, DES, SHA-1 em contextos sensíveis). Esses algoritmos permitem que um atacante recupere dados criptografados com esforço computacional viável, invalidando a proteção que deveriam oferecer.

Ejemplo

Uma aplicação bancária que criptografa senhas usando MD5 ou MD5(senha + salt), ou que negocia conexão HTTPS com suporte a TLS 1.0. Em ambos os casos, ferramentas públicas conseguem quebrar a proteção em horas ou minutos.

Cómo mitigar

Use algoritmos atuais: SHA-256+ (ou bcrypt/scrypt) para hashing de senhas, AES-256 para dados em repouso, e TLS 1.2+ (idealmente 1.3) para trânsito. Revise regularmente o padrão NIST ou recomendações do OWASP e retire suporte a algoritmos deprecados das suas dependências e configurações.

CVE-2026-32959HIGHSD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a use of a broken or risky cryptographic algorithm. InformEPSS 0.2%CVE-2024-3264MEDIUMBroken or Risky Cryptographic Algorithm in Mia Technology's Mia-Med Health AplicationEPSS 0.2%CVE-2025-66017HIGHCGGMP21 presignatures can be used in the way that significantly reduces securityEPSS 0.2%CVE-2026-44699CRITICALLibJWT: Algorithm confusion allows JWT forgery with RSA JWK as empty-key HMACEPSS 0.2%CVE-2025-14762MEDIUMMissing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3 bucket to introduce a new EDK thatEPSS 0.2%CVE-2025-30477MEDIUMDell PowerScale OneFS, versions prior to 9.11.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. A high privileEPSS 0.2%CVE-2025-27508HIGHEmissary Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.2%CVE-2024-32852MEDIUMDell PowerScale OneFS versions 8.2.2.x through 9.7.0.0 contain use of a broken or risky cryptographic algorithm vulnerability. An unprivilegEPSS 0.2%CVE-2022-45858LOWA use of a weak cryptographic algorithm vulnerability [CWE-327] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.0 all versions, 8.8.0 all EPSS 0.2%CVE-2026-21907HIGHJunos Space: TLS/SSL server supports use of static key ciphers (ssl-static-key-ciphers)EPSS 0.2%CVE-2021-27784MEDIUMHCL Launch container images may contain non-unique https certificates and database encryption keyEPSS 0.2%CVE-2024-55912MEDIUMIBM Concert Software information disclosureEPSS 0.2%CVE-2025-13916MEDIUMMultiple vulnerabilities have been addressed in IBM Aspera SharesEPSS 0.2%CVE-2024-41763MEDIUMIBM Engineering Lifecycle Optimization - Publishing information disclosureEPSS 0.2%CVE-2026-15638CRITICALCryptographic Padding OracleEPSS 0.2%CVE-2024-28780MEDIUMIBM Cognos Controller information disclosureEPSS 0.2%CVE-2025-68931HIGHJervis has AES CBC Mode Without AuthenticationEPSS 0.2%CVE-2024-10405MEDIUMWeak TLS Ciphers on Brocade SANnav port 443 & 18082EPSS 0.2%CVE-2026-1627MEDIUMAn attacker may exploit the use of outdated and weak MAC algorithms in the device’s SSH service to potentially compromise the integrity of tEPSS 0.2%CVE-2026-1626MEDIUMAn attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to potentially observe or manipulate parts of thEPSS 0.2%