Fallos del tipo CWE-327

413 resultados

Uso de algoritmo criptográfico fraco ou quebrado

É quando o código utiliza algoritmos de criptografia que foram comprometidos, obsoletos ou nunca foram seguros (como MD5, DES, SHA-1 em contextos sensíveis). Esses algoritmos permitem que um atacante recupere dados criptografados com esforço computacional viável, invalidando a proteção que deveriam oferecer.

Ejemplo

Uma aplicação bancária que criptografa senhas usando MD5 ou MD5(senha + salt), ou que negocia conexão HTTPS com suporte a TLS 1.0. Em ambos os casos, ferramentas públicas conseguem quebrar a proteção em horas ou minutos.

Cómo mitigar

Use algoritmos atuais: SHA-256+ (ou bcrypt/scrypt) para hashing de senhas, AES-256 para dados em repouso, e TLS 1.2+ (idealmente 1.3) para trânsito. Revise regularmente o padrão NIST ou recomendações do OWASP e retire suporte a algoritmos deprecados das suas dependências e configurações.

CVE-2025-68702HIGHJervis has a SHA-256 Hex String Padding BugEPSS 0.2%CVE-2025-45767HIGHjose v6.0.10 was discovered to contain weak encryption. NOTE: this is disputed by a third party because the claim of "do not meet recommendeEPSS 0.2%CVE-2021-36647MEDIUMUse of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp_mod() in lignum.c in Mbed TLS Mbed TLS all versions before EPSS 0.2%CVE-2026-3161MEDIUMIBM Cloud Pak System Risky Cryptographic AlgorithmEPSS 0.2%CVE-2026-16693MEDIUMIBM i is Affected By Cryptographic Algorithm Weakness in DCM []EPSS 0.2%CVE-2026-6330MEDIUMML-KEM ARM64 NEON ciphertext comparison only compares half of the inputEPSS 0.2%CVE-2025-43913MEDIUMDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 releasEPSS 0.2%CVE-2025-14760MEDIUMMissing cryptographic key commitment in the AWS SDK for C++ may allow a user with write access to the S3 bucket to introduce a new EDK that EPSS 0.2%CVE-2008-3775MEDIUMFolder Lock 5.9.5 and earlier uses weak encryption (ROT-25) for the password, which allows local administrators to obtain sensitive informatEPSS 0.2%CVE-2026-36609HIGHMercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does not change between requests froEPSS 0.2%CVE-2024-48016MEDIUMDell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.24, contains a Use of a Broken or Risky Cryptographic Algorithm vulnerabEPSS 0.2%CVE-2025-36084MEDIUMMultiple Vulnerabilities in IBM Concert SoftwareEPSS 0.2%CVE-2025-11650LOWTomofun Furbo 360/Furbo Mini Password shadow weak hashEPSS 0.2%CVE-2025-43909LOWDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 releasEPSS 0.2%CVE-2026-11479LOWyoanbernabeu grepai Qdrant Backend chunker.go weak hashEPSS 0.2%CVE-2026-6411HIGHMAXHUB Pivot Client Application Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.2%CVE-2024-43178MEDIUMMultiple Vulnerabilities in IBM Concert Software.EPSS 0.2%CVE-2025-45766HIGHpoco v1.14.1-release was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expecteEPSS 0.2%CVE-2024-52884HIGHAn issue was discovered in AudioCodes Mediant Session Border Controller (SBC) before 7.40A.501.841. Due to the use of weak password obfuscatEPSS 0.2%CVE-2026-56582LOWHCL MyCloud was affected with SSL/TLS Protocol Affected with LUCKY13 Vulnerability.EPSS 0.2%