Fallos del tipo CWE-327

413 resultados

Uso de algoritmo criptográfico fraco ou quebrado

É quando o código utiliza algoritmos de criptografia que foram comprometidos, obsoletos ou nunca foram seguros (como MD5, DES, SHA-1 em contextos sensíveis). Esses algoritmos permitem que um atacante recupere dados criptografados com esforço computacional viável, invalidando a proteção que deveriam oferecer.

Ejemplo

Uma aplicação bancária que criptografa senhas usando MD5 ou MD5(senha + salt), ou que negocia conexão HTTPS com suporte a TLS 1.0. Em ambos os casos, ferramentas públicas conseguem quebrar a proteção em horas ou minutos.

Cómo mitigar

Use algoritmos atuais: SHA-256+ (ou bcrypt/scrypt) para hashing de senhas, AES-256 para dados em repouso, e TLS 1.2+ (idealmente 1.3) para trânsito. Revise regularmente o padrão NIST ou recomendações do OWASP e retire suporte a algoritmos deprecados das suas dependências e configurações.

CVE-2025-37127HIGHAuthenticated Replay Attack contains Cryptographic VulnerabilityEPSS 0.1%CVE-2023-41928MEDIUMRemote server offers deprecated TLS protocol in Kiloview P1/P2 devicesEPSS 0.1%CVE-2025-3838MEDIUMImproper Authorization in the installer for the EOL OVA based connect componentEPSS 0.1%CVE-2025-2920LOWNetis WF-2404 passwd weak hashEPSS 0.1%CVE-2023-41927MEDIUMWeak TLS Cipher Suites Supported in Kiloview P1/P2 devicesEPSS 0.1%CVE-2024-22458LOWDell Secure Connect Gateway, 5.18, contains an Inadequate Encryption Strength Vulnerability. An unauthenticated network attacker could potenEPSS 0.1%CVE-2025-26708MEDIUMZTELink has a configuration defect vulnerabilityEPSS 0.1%CVE-2022-24403MEDIUMDe-anonymization attack in TETRAEPSS 0.1%CVE-2026-40996MEDIUMInbound WS-Security allows RSA PKCS#1 v1.5 key transport by defaultEPSS 0.1%CVE-2026-108015CRITICALeMudhra Compromised Certificate vulnerability impacts HCL Notes ClientEPSS 0.1%CVE-2026-108014CRITICALeMudhra Compromised Certificate vulnerability impacts HCL Domino ServerEPSS 0.1%CVE-2025-65951HIGHInside Track / Entropy Derby Timelock Encryption Bypassed via Pre-Computed VDF Output LeakageEPSS 0.1%CVE-2023-40371MEDIUMIBM AIX information disclosureEPSS 0.1%CVE-2025-59484HIGHAutomationDirect CLICK PLUS Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.1%CVE-2023-35890MEDIUMIBM WebSphere Application Server information disclosureEPSS 0.1%CVE-2025-26486MEDIUMBroken or Risky Cryptographic Algorithm, Use of Password Hash With Insufficient Computational Effort, Use of Weak Hash, Use of a One-Way HEPSS 0.1%CVE-2022-35720LOWIBM Sterling External Authentication Server information disclosureEPSS 0.1%CVE-2025-64429MEDIUMDuckDB Encryption Crypto implementation is vulnerableEPSS 0.1%CVE-2025-14763MEDIUMMissing cryptographic key commitment in the Amazon S3 Encryption Client for Java may allow a user with write access to the S3 bucket to intrEPSS 0.1%CVE-2024-1040MEDIUMUse of a Broken or Risky Cryptographic Algorithm in Gessler GmbH WEB-MASTEREPSS 0.1%