Fallos del tipo CWE-327

413 resultados

Uso de algoritmo criptográfico fraco ou quebrado

É quando o código utiliza algoritmos de criptografia que foram comprometidos, obsoletos ou nunca foram seguros (como MD5, DES, SHA-1 em contextos sensíveis). Esses algoritmos permitem que um atacante recupere dados criptografados com esforço computacional viável, invalidando a proteção que deveriam oferecer.

Ejemplo

Uma aplicação bancária que criptografa senhas usando MD5 ou MD5(senha + salt), ou que negocia conexão HTTPS com suporte a TLS 1.0. Em ambos os casos, ferramentas públicas conseguem quebrar a proteção em horas ou minutos.

Cómo mitigar

Use algoritmos atuais: SHA-256+ (ou bcrypt/scrypt) para hashing de senhas, AES-256 para dados em repouso, e TLS 1.2+ (idealmente 1.3) para trânsito. Revise regularmente o padrão NIST ou recomendações do OWASP e retire suporte a algoritmos deprecados das suas dependências e configurações.

CVE-2022-43917MEDIUMIBM WebSphere Application Server information disclosureEPSS 0.5%CVE-2022-34319MEDIUMIBM CICS TX information disclosureEPSS 0.5%CVE-2019-0030MEDIUMJuniper ATP: Password hashing uses DES and a hardcoded saltEPSS 0.5%CVE-2026-20833MEDIUMWindows Kerberos Information Disclosure VulnerabilityEPSS 0.5%CVE-2022-36937CRITICALHHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS1.0 has numerouEPSS 0.5%CVE-2023-51838HIGHYlianst MeshCentral 1.1.16 suffers from Use of a Broken or Risky Cryptographic Algorithm.EPSS 0.5%CVE-2022-23539MEDIUMjsonwebtoken unrestricted key type could lead to legacy keys usageEPSS 0.5%CVE-2022-21800MEDIUMAirspan Networks Mimosa Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.5%CVE-2023-32043MEDIUMWindows Remote Desktop Security Feature Bypass VulnerabilityEPSS 0.5%CVE-2017-5243—The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key excEPSS 0.5%CVE-2020-25230—A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Due to the usage of an outdated cipher modeEPSS 0.5%CVE-2020-11916MEDIUMAn issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. The password for the root user is hashed using an old and deprecated hashEPSS 0.5%CVE-2022-22462LOWIBM Security Verify Governance, Identity Manager virtual appliance component information disclosureEPSS 0.5%CVE-2023-38361MEDIUMIBM CICS TX Advanced information disclosureEPSS 0.5%CVE-2021-31562MEDIUMFresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithmEPSS 0.5%CVE-2022-34309MEDIUMIBM CICS TX information disclosureEPSS 0.5%CVE-2022-34310MEDIUMIBM CICS TX information disclosureEPSS 0.5%CVE-2022-43934MEDIUMWeak Key-exchange algorithmsEPSS 0.5%CVE-2026-69382MEDIUMMicrosoft Exchange Server Information Disclosure VulnerabilityEPSS 0.5%CVE-2023-38371MEDIUMIBM Security Access Manager Docker information disclosureEPSS 0.5%