Fallos del tipo CWE-327

413 resultados

Uso de algoritmo criptográfico fraco ou quebrado

É quando o código utiliza algoritmos de criptografia que foram comprometidos, obsoletos ou nunca foram seguros (como MD5, DES, SHA-1 em contextos sensíveis). Esses algoritmos permitem que um atacante recupere dados criptografados com esforço computacional viável, invalidando a proteção que deveriam oferecer.

Ejemplo

Uma aplicação bancária que criptografa senhas usando MD5 ou MD5(senha + salt), ou que negocia conexão HTTPS com suporte a TLS 1.0. Em ambos os casos, ferramentas públicas conseguem quebrar a proteção em horas ou minutos.

Cómo mitigar

Use algoritmos atuais: SHA-256+ (ou bcrypt/scrypt) para hashing de senhas, AES-256 para dados em repouso, e TLS 1.2+ (idealmente 1.3) para trânsito. Revise regularmente o padrão NIST ou recomendações do OWASP e retire suporte a algoritmos deprecados das suas dependências e configurações.

CVE-2025-14761MEDIUMMissing cryptographic key commitment in the AWS SDK for PHP may allow a user with write access to the S3 bucket to introduce a new EDK that EPSS 0.2%CVE-2026-27519HIGHBinardat 10G08-0800GSM Network Switch Hard-coded RC4 Encryption KeyEPSS 0.2%CVE-2025-13916MEDIUMMultiple vulnerabilities have been addressed in IBM Aspera SharesEPSS 0.2%CVE-2025-33084MEDIUMIBM Concert Software information disclosureEPSS 0.2%CVE-2025-27508HIGHEmissary Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.2%CVE-2026-32959HIGHSD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a use of a broken or risky cryptographic algorithm. InformEPSS 0.2%CVE-2026-28479HIGHOpenClaw < 2026.2.15 - Cache Poisoning via Deprecated SHA-1 Hash in Sandbox ConfigurationEPSS 0.2%CVE-2025-43891MEDIUMDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 releasEPSS 0.2%CVE-2024-3264MEDIUMBroken or Risky Cryptographic Algorithm in Mia Technology's Mia-Med Health AplicationEPSS 0.2%CVE-2025-14762MEDIUMMissing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3 bucket to introduce a new EDK thatEPSS 0.2%CVE-2024-41763MEDIUMIBM Engineering Lifecycle Optimization - Publishing information disclosureEPSS 0.2%CVE-2025-27458MEDIUMCVE-2025-27458EPSS 0.2%CVE-2024-32852MEDIUMDell PowerScale OneFS versions 8.2.2.x through 9.7.0.0 contain use of a broken or risky cryptographic algorithm vulnerability. An unprivilegEPSS 0.2%CVE-2023-52236MEDIUMA vulnerability has been identified in RUGGEDCOM i800 (All versions), RUGGEDCOM i801 (All versions), RUGGEDCOM i802 (All versions), RUGGEDCOEPSS 0.2%CVE-2022-45858LOWA use of a weak cryptographic algorithm vulnerability [CWE-327] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.0 all versions, 8.8.0 all EPSS 0.2%CVE-2024-31896MEDIUMIBM SPSS Statistics information disclosureEPSS 0.2%CVE-2026-21907HIGHJunos Space: TLS/SSL server supports use of static key ciphers (ssl-static-key-ciphers)EPSS 0.2%CVE-2024-28780MEDIUMIBM Cognos Controller information disclosureEPSS 0.2%CVE-2026-27804CRITICALParse Server: Account takeover via JWT algorithm confusion in Google auth adapterEPSS 0.2%CVE-2024-10405MEDIUMWeak TLS Ciphers on Brocade SANnav port 443 & 18082EPSS 0.2%