Fallos del tipo CWE-327

401 resultados

Uso de algoritmo criptográfico fraco ou quebrado

É quando o código utiliza algoritmos de criptografia que foram comprometidos, obsoletos ou nunca foram seguros (como MD5, DES, SHA-1 em contextos sensíveis). Esses algoritmos permitem que um atacante recupere dados criptografados com esforço computacional viável, invalidando a proteção que deveriam oferecer.

Ejemplo

Uma aplicação bancária que criptografa senhas usando MD5 ou MD5(senha + salt), ou que negocia conexão HTTPS com suporte a TLS 1.0. Em ambos os casos, ferramentas públicas conseguem quebrar a proteção em horas ou minutos.

Cómo mitigar

Use algoritmos atuais: SHA-256+ (ou bcrypt/scrypt) para hashing de senhas, AES-256 para dados em repouso, e TLS 1.2+ (idealmente 1.3) para trânsito. Revise regularmente o padrão NIST ou recomendações do OWASP e retire suporte a algoritmos deprecados das suas dependências e configurações.

CVE-2022-45170MEDIUMAn issue was discovered in LIVEBOX Collaboration vDesk through v018. A Cryptographic Issue can occur under the /api/v1/vencrypt/decrypt/fileEPSS 0.4%CVE-2026-69382MEDIUMMicrosoft Exchange Server Information Disclosure VulnerabilityEPSS 0.4%CVE-2024-25968MEDIUMDell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unaEPSS 0.4%CVE-2022-31157HIGHUse of a Broken or Risky Cryptographic Algorithm in packbackbooks/lti-1-3-php-libraryEPSS 0.4%CVE-2025-34208HIGHVasion Print (formerly PrinterLogic) Insecure Password HashingEPSS 0.4%CVE-2022-22313MEDIUMIBM QRadar Data Synchronization App information disclosureEPSS 0.4%CVE-2019-14852—A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol. An attacker could target traffic using this weaker protocol EPSS 0.4%CVE-2026-22585CRITICALUse of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, PrEPSS 0.4%CVE-2024-40465HIGHAn issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go fileEPSS 0.4%CVE-2022-34444MEDIUM Dell PowerScale OneFS, versions 9.2.0.x through 9.4.0.x contain an information vulnerability. A remote unauthenticated attacker may potentiEPSS 0.4%CVE-2026-21718CRITICALCopeland XWEB and XWEB Pro Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.4%CVE-2025-69929CRITICALAn issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate privileges via the password hashing on the cEPSS 0.4%CVE-2023-38361MEDIUMIBM CICS TX Advanced information disclosureEPSS 0.4%CVE-2023-23695MEDIUM Dell Secure Connect Gateway (SCG) version 5.14.00.12 contains a broken cryptographic algorithm vulnerability. A remote unauthenticated attaEPSS 0.4%CVE-2023-39252MEDIUM Dell SCG Policy Manager 5.16.00.14 contains a broken cryptographic algorithm vulnerability. A remote unauthenticated attacker may potentiaEPSS 0.4%CVE-2023-28076MEDIUM CloudLink 7.1.2 and all prior versions contain a broken or risky cryptographic algorithm vulnerability. An unauthenticated remote attacker EPSS 0.4%CVE-2022-43843MEDIUMIBM Spectrum Scale information disclosureEPSS 0.4%CVE-2022-29161MEDIUMCrypto script service uses hashing algorithm SHA1 with RSA for certificate signature in xwiki-platformEPSS 0.4%CVE-2024-52801MEDIUMBrute force takeover of OpenID Connect session cookies in sftpgoEPSS 0.4%CVE-2023-28053MEDIUM Dell NetWorker Virtual Edition versions 19.8 and below contain the use of deprecated cryptographic algorithms in the SSH component. A remotEPSS 0.4%