Fallos del tipo CWE-327

413 resultados

Uso de algoritmo criptográfico fraco ou quebrado

É quando o código utiliza algoritmos de criptografia que foram comprometidos, obsoletos ou nunca foram seguros (como MD5, DES, SHA-1 em contextos sensíveis). Esses algoritmos permitem que um atacante recupere dados criptografados com esforço computacional viável, invalidando a proteção que deveriam oferecer.

Ejemplo

Uma aplicação bancária que criptografa senhas usando MD5 ou MD5(senha + salt), ou que negocia conexão HTTPS com suporte a TLS 1.0. Em ambos os casos, ferramentas públicas conseguem quebrar a proteção em horas ou minutos.

Cómo mitigar

Use algoritmos atuais: SHA-256+ (ou bcrypt/scrypt) para hashing de senhas, AES-256 para dados em repouso, e TLS 1.2+ (idealmente 1.3) para trânsito. Revise regularmente o padrão NIST ou recomendações do OWASP e retire suporte a algoritmos deprecados das suas dependências e configurações.

CVE-2026-59116MEDIUMWindows Remote Desktop Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2023-28053MEDIUM Dell NetWorker Virtual Edition versions 19.8 and below contain the use of deprecated cryptographic algorithms in the SSH component. A remotEPSS 0.4%CVE-2022-34361MEDIUMIBM Sterling Secure Proxy information disclosureEPSS 0.4%CVE-2023-4326—Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that supports obsolete SHA1-based ciphersuitesEPSS 0.4%CVE-2026-76133CRITICALEbyte NA111-M Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.4%CVE-2026-2618MEDIUMBeetel 777VR1 SSH Service risky encryptionEPSS 0.4%CVE-2023-26276MEDIUMIBM QRadar information disclosureEPSS 0.4%CVE-2021-38933MEDIUMIBM Sterling Connect:Express for UNIX information disclosureEPSS 0.4%CVE-2023-38730MEDIUMIBM Spectrum Copy Data Management information disclosureEPSS 0.4%CVE-2023-51839CRITICALDeviceFarmer stf v3.6.6 suffers from Use of a Broken or Risky Cryptographic Algorithm.EPSS 0.4%CVE-2026-91403CRITICALVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). EPSS 0.4%CVE-2023-5627HIGHIncorrect Implementation of Authentication Algorithm VulnerabilityEPSS 0.4%CVE-2024-51478CRITICALUse of a Broken or Risky Cryptographic Algorithm in YesWikiEPSS 0.4%CVE-2024-10128MEDIUMTopdata Inner Rep Plus WebServer td.js.gz risky encryptionEPSS 0.4%CVE-2023-27557MEDIUMIBM Safter Payments information disclosureEPSS 0.4%CVE-2021-46900HIGHSympa before 6.2.62 relies on a cookie parameter for certain security objectives, but does not ensure that this parameter exists and has an EPSS 0.4%CVE-2025-54426CRITICALPolkadot Frontier contains silent failure in Curve25519 arithmetic precompiles with malformed pointsEPSS 0.4%CVE-2026-77151MEDIUMlin-snow Ech0 crypto.go MD5Encrypt risky encryptionEPSS 0.4%CVE-2025-3200CRITICALCom-Server Exposed via Weak TLSEPSS 0.4%CVE-2023-47640MEDIUMInsecure Use of HMAC-SHA1 For Session Signing in datahubEPSS 0.4%