Fallos del tipo CWE-327

413 resultados

Uso de algoritmo criptográfico fraco ou quebrado

É quando o código utiliza algoritmos de criptografia que foram comprometidos, obsoletos ou nunca foram seguros (como MD5, DES, SHA-1 em contextos sensíveis). Esses algoritmos permitem que um atacante recupere dados criptografados com esforço computacional viável, invalidando a proteção que deveriam oferecer.

Ejemplo

Uma aplicação bancária que criptografa senhas usando MD5 ou MD5(senha + salt), ou que negocia conexão HTTPS com suporte a TLS 1.0. Em ambos os casos, ferramentas públicas conseguem quebrar a proteção em horas ou minutos.

Cómo mitigar

Use algoritmos atuais: SHA-256+ (ou bcrypt/scrypt) para hashing de senhas, AES-256 para dados em repouso, e TLS 1.2+ (idealmente 1.3) para trânsito. Revise regularmente o padrão NIST ou recomendações do OWASP e retire suporte a algoritmos deprecados das suas dependências e configurações.

CVE-2020-7514—A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could EPSS 0.2%CVE-2025-36161MEDIUMIBM Concert Software Information DisclosureEPSS 0.2%CVE-2026-28252CRITICALUse of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer ConciergeEPSS 0.2%CVE-2025-66017HIGHCGGMP21 presignatures can be used in the way that significantly reduces securityEPSS 0.2%CVE-2024-52331HIGHECOVACS lawnmowers and vacuums deterministic firmware encryption keyEPSS 0.2%CVE-2026-26219CRITICALnewbee-mall Unsalted MD5 Password Hashing Enables Offline Credential CrackingEPSS 0.2%CVE-2022-43851MEDIUMIBM Aspera Console information disclosureEPSS 0.2%CVE-2026-56454MEDIUMHCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1.EPSS 0.2%CVE-2025-65849CRITICALA cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-WoEPSS 0.2%CVE-2024-45643MEDIUMIBM QRadar EDR information disclosureEPSS 0.2%CVE-2026-15638CRITICALCryptographic Padding OracleEPSS 0.2%CVE-2026-47775MEDIUMEnvoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie DecryptionEPSS 0.2%CVE-2025-49756LOWOffice Developer Platform Security Feature Bypass VulnerabilityEPSS 0.2%CVE-2025-55112HIGHBMC Control-M/Agent hardcoded Blowfish keysEPSS 0.2%CVE-2024-55912MEDIUMIBM Concert Software information disclosureEPSS 0.2%CVE-2024-27256MEDIUMIBM MQ Operator information disclosureEPSS 0.2%CVE-2024-51556HIGHSensitive Information Disclosure Vulnerability in Wave 2.0EPSS 0.2%CVE-2025-33147MEDIUMIBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilitiesEPSS 0.2%CVE-2024-41775MEDIUMIBM Cognos Controller information disclosureEPSS 0.2%CVE-2025-65831HIGHThe application uses an insecure hashing algorithm (MD5) to hash passwords. If an attacker obtained a copy of these hashes, either through eEPSS 0.2%