Fallos del tipo CWE-327

401 resultados

Uso de algoritmo criptográfico fraco ou quebrado

É quando o código utiliza algoritmos de criptografia que foram comprometidos, obsoletos ou nunca foram seguros (como MD5, DES, SHA-1 em contextos sensíveis). Esses algoritmos permitem que um atacante recupere dados criptografados com esforço computacional viável, invalidando a proteção que deveriam oferecer.

Ejemplo

Uma aplicação bancária que criptografa senhas usando MD5 ou MD5(senha + salt), ou que negocia conexão HTTPS com suporte a TLS 1.0. Em ambos os casos, ferramentas públicas conseguem quebrar a proteção em horas ou minutos.

Cómo mitigar

Use algoritmos atuais: SHA-256+ (ou bcrypt/scrypt) para hashing de senhas, AES-256 para dados em repouso, e TLS 1.2+ (idealmente 1.3) para trânsito. Revise regularmente o padrão NIST ou recomendações do OWASP e retire suporte a algoritmos deprecados das suas dependências e configurações.

CVE-2022-43917MEDIUMIBM WebSphere Application Server information disclosureEPSS 0.5%CVE-2022-36937CRITICALHHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS1.0 has numerouEPSS 0.5%CVE-2025-9146HIGHLinksys E5600 Firmware checkFw.sh verify_gemtek_header risky encryptionEPSS 0.5%CVE-2023-51838HIGHYlianst MeshCentral 1.1.16 suffers from Use of a Broken or Risky Cryptographic Algorithm.EPSS 0.5%CVE-2022-21800MEDIUMAirspan Networks Mimosa Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.5%CVE-2022-34320MEDIUMIBM CICS TX information disclosureEPSS 0.5%CVE-2022-34319MEDIUMIBM CICS TX information disclosureEPSS 0.5%CVE-2023-32043MEDIUMWindows Remote Desktop Security Feature Bypass VulnerabilityEPSS 0.5%CVE-2020-11916MEDIUMAn issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. The password for the root user is hashed using an old and deprecated hashEPSS 0.5%CVE-2021-31562MEDIUMFresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithmEPSS 0.5%CVE-2022-34309MEDIUMIBM CICS TX information disclosureEPSS 0.5%CVE-2022-34310MEDIUMIBM CICS TX information disclosureEPSS 0.5%CVE-2022-43934MEDIUMWeak Key-exchange algorithmsEPSS 0.5%CVE-2022-23539MEDIUMjsonwebtoken unrestricted key type could lead to legacy keys usageEPSS 0.5%CVE-2022-22462LOWIBM Security Verify Governance, Identity Manager virtual appliance component information disclosureEPSS 0.5%CVE-2023-38371MEDIUMIBM Security Access Manager Docker information disclosureEPSS 0.5%CVE-2021-27913LOWUse of a Broken or Risky Cryptographic AlgorithmEPSS 0.5%CVE-2022-22564MEDIUMDell EMC Unity versions before 5.2.0.0.5.173 , use(es) broken cryptographic algorithm. A remote unauthenticated attacker could potentially eEPSS 0.5%CVE-2019-15795MEDIUMpython-apt uses MD5 for validationEPSS 0.5%CVE-2022-45170MEDIUMAn issue was discovered in LIVEBOX Collaboration vDesk through v018. A Cryptographic Issue can occur under the /api/v1/vencrypt/decrypt/fileEPSS 0.4%