Fallos del tipo CWE-327

413 resultados

Uso de algoritmo criptográfico fraco ou quebrado

É quando o código utiliza algoritmos de criptografia que foram comprometidos, obsoletos ou nunca foram seguros (como MD5, DES, SHA-1 em contextos sensíveis). Esses algoritmos permitem que um atacante recupere dados criptografados com esforço computacional viável, invalidando a proteção que deveriam oferecer.

Ejemplo

Uma aplicação bancária que criptografa senhas usando MD5 ou MD5(senha + salt), ou que negocia conexão HTTPS com suporte a TLS 1.0. Em ambos os casos, ferramentas públicas conseguem quebrar a proteção em horas ou minutos.

Cómo mitigar

Use algoritmos atuais: SHA-256+ (ou bcrypt/scrypt) para hashing de senhas, AES-256 para dados em repouso, e TLS 1.2+ (idealmente 1.3) para trânsito. Revise regularmente o padrão NIST ou recomendações do OWASP e retire suporte a algoritmos deprecados das suas dependências e configurações.

CVE-2026-56609MEDIUMHCL iControl is affected by multiple security vulnerabilities(CVE-2026-56608 and CVE-2026-56609).EPSS 0.2%CVE-2023-50350HIGHA broken cryptographic algorithm impacts MyXalyticsEPSS 0.2%CVE-2024-47921HIGHSmadar SPS – CWE-327: Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.2%CVE-2026-81438LOWDell OpenManage Server Administrator, versions prior to 11.1.0.3, contains Use of a Broken or Risky Cryptographic Algorithm vulnerability. AEPSS 0.2%CVE-2026-6930LOWIBM Concert Software Risky Cryptographic AlgorithmEPSS 0.2%CVE-2026-8072CRITICALInsecure generation of SAT access credentials in Ingecon EMS BoardEPSS 0.2%CVE-2026-18153MEDIUMIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.1%CVE-2025-34500HIGHShuffle Master Deck Mate 2 Insecure Update ChainEPSS 0.1%CVE-2021-3446—A flaw was found in libtpms in versions before 0.8.2. The commonly used integration of libtpms with OpenSSL contained a vulnerability relateEPSS 0.1%CVE-2026-82356HIGHImprivata EAM: Unrotatable X.509 RSA Key Pair in ProductionEPSS 0.1%CVE-2026-28490HIGHAuthlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding OracleEPSS 0.1%CVE-2025-63912MEDIUMCohesity TranZman Migration Appliance Release 4.0 Build 14614 was discovered to use a weak cryptography algorithm for data encryption, allowEPSS 0.1%CVE-2026-25834MEDIUMMbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade.EPSS 0.1%CVE-2026-102824MEDIUMRussh: Missing X25519 zero-point validation in hybrid ML-KEM key exchangeEPSS 0.1%CVE-2026-7845LOWchatchat-space Langchain-Chatchat Vision Chat Paste Image dialogue.py PIL.Image.tobytes weak hashEPSS 0.1%CVE-2026-24785HIGHClatter has a PSK Validity Rule Violation issueEPSS 0.1%CVE-2025-68698HIGHJervis has an RSA PKCS#1 v1.5 Padding VulnerabilityEPSS 0.1%CVE-2024-41986MEDIUMA vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >=EPSS 0.1%CVE-2025-41223MEDIUMA vulnerability has been identified in RUGGEDCOM i800 (All versions), RUGGEDCOM i801 (All versions), RUGGEDCOM i802 (All versions), RUGGEDCOEPSS 0.1%CVE-2024-49784MEDIUMIBM OpenPages with Watson information disclosureEPSS 0.1%