Fallos del tipo CWE-328

91 resultados

Uso de função hash fraca

A fraqueza ocorre quando o desenvolvedor escolhe um algoritmo hash (como MD5 ou SHA-1) que já foi criptanaliticamente quebrado ou deprecado para fins de segurança. Isso permite que um atacante inverta o hash, encontre colisões ou comprometaa integridade de dados sensíveis (senhas, tokens, assinaturas).

Ejemplo

Um sistema armazena senhas de usuários usando MD5 direto, sem salt. Um atacante que rouba o banco de dados pode usar tabelas pré-computadas (rainbow tables) para recuperar as senhas em minutos, pois MD5 é vulnerável a colisões e extremamente rápido de brutar.

Cómo mitigar

Use algoritmos modernos e lentos: bcrypt, scrypt, Argon2 para senhas; SHA-256, SHA-3 ou BLAKE2 para integridade de dados. Sempre combine com salt aleatório e, quando possível, aumente o fator de custo computacional para dificultar ataques por força bruta.

CVE-2026-15605LOWwandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hashEPSS 0.2%CVE-2026-14630LOWForceInjection AI-fundermentals Memory Recall smart_customer_service.py get_conversation_history weak hashEPSS 0.2%CVE-2026-14742LOWlangchain-ai langgraph Task Result Cache _cache.py _freeze weak hashEPSS 0.2%CVE-2025-8260LOWVaelsys VaelsysV4 Web interface vgrid_server.php weak hashEPSS 0.2%CVE-2024-47829MEDIUMpnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwritingEPSS 0.2%CVE-2024-10026MEDIUMImproved Seeding and Hashing In gVisorEPSS 0.2%CVE-2024-38341MEDIUMIBM Sterling Secure Proxy information disclosureEPSS 0.2%CVE-2026-32129HIGHPoseidon V1 variable-length input collision via implicit zero-paddingEPSS 0.2%CVE-2026-44582LOWNext.js: Cache poisoning via collisions in React Server Component cache-bustingEPSS 0.2%CVE-2024-47182MEDIUMDozzle uses unsafe hash for passwordsEPSS 0.2%CVE-2022-29835MEDIUMWD Discovery's Use of Weak Hashing Algorithm for Code SigningEPSS 0.2%CVE-2026-36182CRITICALGNCC GP5 v7.1.76 was discovered to utilize a weak hashing algorithm to protect the root password, possibly allowing attackers to obtain rootEPSS 0.2%CVE-2026-7103MEDIUMcode-projects Chat System MD5 Hash update_user.php weak hashEPSS 0.2%CVE-2026-13455MEDIUMPostgreSQL Anonymizer: Unrestricted function can leak the secret saltEPSS 0.2%CVE-2026-8803MEDIUMopensourcepos Open Source Point of Sale Employee Login Employee.php login weak hashEPSS 0.2%CVE-2026-48488LOWphpMyFAQ has Weak Cryptography - SHA1 for Password HashingEPSS 0.2%CVE-2025-54535MEDIUMIn JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithmsEPSS 0.2%CVE-2024-8452HIGHPLANET Technology switch devices - Insecure hash functions used for SNMPv3 credentialsEPSS 0.2%CVE-2024-23589MEDIUMHCL Glovius Cloud is susceptible to an Outdated Hash Algorithm vulnerabilityEPSS 0.2%CVE-2025-59354MEDIUMDragonfly has weak integrity checks for downloaded filesEPSS 0.2%