Fallos del tipo CWE-327

413 resultados

Uso de algoritmo criptográfico fraco ou quebrado

É quando o código utiliza algoritmos de criptografia que foram comprometidos, obsoletos ou nunca foram seguros (como MD5, DES, SHA-1 em contextos sensíveis). Esses algoritmos permitem que um atacante recupere dados criptografados com esforço computacional viável, invalidando a proteção que deveriam oferecer.

Ejemplo

Uma aplicação bancária que criptografa senhas usando MD5 ou MD5(senha + salt), ou que negocia conexão HTTPS com suporte a TLS 1.0. Em ambos os casos, ferramentas públicas conseguem quebrar a proteção em horas ou minutos.

Cómo mitigar

Use algoritmos atuais: SHA-256+ (ou bcrypt/scrypt) para hashing de senhas, AES-256 para dados em repouso, e TLS 1.2+ (idealmente 1.3) para trânsito. Revise regularmente o padrão NIST ou recomendações do OWASP e retire suporte a algoritmos deprecados das suas dependências e configurações.

CVE-2023-41097MEDIUMPotential Timing vulnerability in CBC PKCS7 padding calculationsEPSS 0.3%CVE-2024-45193MEDIUMAn issue was discovered in Matrix libolm through 3.2.16. There is Ed25519 signature malleability due to lack of validation criteria (does noEPSS 0.3%CVE-2025-14175MEDIUMWeak Algorithm Support in SSH Server on TL-WR820NEPSS 0.3%CVE-2026-46395CRITICALHAX CMS Vulnerable to Private Key Disclosure via Broken HMAC ImplementationEPSS 0.3%CVE-2024-39583HIGHDell PowerScale InsightIQ, versions 5.0 through 5.1, contains a Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthentEPSS 0.3%CVE-2022-38391MEDIUMIBM Spectrum Control information disclosureEPSS 0.3%CVE-2023-36749HIGHA vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEEPSS 0.3%CVE-2024-36440MEDIUMAn issue was discovered on Swissphone DiCal-RED 4009 devices. An attacker with access to the file /etc/deviceconfig may recover the administEPSS 0.3%CVE-2026-50086CRITICALAqara unauthenticated AES oracleEPSS 0.3%CVE-2024-4282HIGHWeak TLS Ciphers on Brocade SANnav OVA SSH port 22EPSS 0.3%CVE-2025-14636MEDIUMTenda AX9 httpd image_check weak hashEPSS 0.3%CVE-2023-3350HIGHCryptographic Issues on IBERMATICA RPSEPSS 0.3%CVE-2024-53441CRITICALAn issue in the index.js decryptCookie function of cookie-encrypter v1.0.1 allows attackers to execute a bit flipping attack.EPSS 0.3%CVE-2026-39944HIGHCeph: CephX AES Authentication errorEPSS 0.3%CVE-2026-13482MEDIUMskypilot-org skypilot User ID server.py username.encode weak hashEPSS 0.3%CVE-2024-22463HIGHDell PowerScale OneFS 8.2.x through 9.6.0.x contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unprivilegedEPSS 0.3%CVE-2023-28509HIGHWeak encryption in UniRPC protocolEPSS 0.3%CVE-2024-39731MEDIUMIBM Datacap Navigator information disclosureEPSS 0.3%CVE-2026-63761MEDIUMSurrealDB before 3.1.0 Algorithm Downgrade via ES512EPSS 0.3%CVE-2026-17467HIGHVulnerabilities exists in IBM Cloud Pak for Data SystemEPSS 0.3%