Fallos del tipo CWE-328

91 resultados

Uso de função hash fraca

A fraqueza ocorre quando o desenvolvedor escolhe um algoritmo hash (como MD5 ou SHA-1) que já foi criptanaliticamente quebrado ou deprecado para fins de segurança. Isso permite que um atacante inverta o hash, encontre colisões ou comprometaa integridade de dados sensíveis (senhas, tokens, assinaturas).

Ejemplo

Um sistema armazena senhas de usuários usando MD5 direto, sem salt. Um atacante que rouba o banco de dados pode usar tabelas pré-computadas (rainbow tables) para recuperar as senhas em minutos, pois MD5 é vulnerável a colisões e extremamente rápido de brutar.

Cómo mitigar

Use algoritmos modernos e lentos: bcrypt, scrypt, Argon2 para senhas; SHA-256, SHA-3 ou BLAKE2 para integridade de dados. Sempre combine com salt aleatório e, quando possível, aumente o fator de custo computacional para dificultar ataques por força bruta.

CVE-2026-11479LOWyoanbernabeu grepai Qdrant Backend chunker.go weak hashEPSS 0.2%CVE-2025-11650LOWTomofun Furbo 360/Furbo Mini Password shadow weak hashEPSS 0.2%CVE-2025-9078MEDIUMWeak cache keys lead to post IDOR and link preview poisoningEPSS 0.2%CVE-2026-7845LOWchatchat-space Langchain-Chatchat Vision Chat Paste Image dialogue.py PIL.Image.tobytes weak hashEPSS 0.1%CVE-2025-2920LOWNetis WF-2404 passwd weak hashEPSS 0.1%CVE-2026-54266HIGHAngular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State PoisoningEPSS 0.1%CVE-2025-41256HIGHCyberduck and Mountain Duck - Weak Hash Algorithm for Certificate FingerprintEPSS 0.1%CVE-2025-26486MEDIUMBroken or Risky Cryptographic Algorithm, Use of Password Hash With Insufficient Computational Effort, Use of Weak Hash, Use of a One-Way HEPSS 0.1%CVE-2023-43635HIGHVault Key Sealed With SHA1 PCRsEPSS 0.1%CVE-2026-27754MEDIUMSODOLA SL902-SWTGW124AS <= 200.1.20 MD5 Session Token GenerationEPSS 0.1%CVE-2023-43630HIGHConfig Partition Not Measured From 2 FrontsEPSS 0.1%CVE-2026-53692MEDIUMWeak hashing algorithm in Redeight CMSEPSS 0.1%CVE-2024-56414MEDIUMWeb installer integrity check used weak hash algorithm. The following products are affected: Acronis Cyber Protect 16 (Windows) before buildEPSS 0.1%CVE-2026-10540MEDIUMWeak password hash protection in Control-M/Entreprise ManagerEPSS 0.1%CVE-2026-10783LOWgradio-app gradio Audio Cache Key save_audio_to_cache weak hashEPSS 0.1%CVE-2026-10803LOWMLflow Dataset Digest Computation digest_utils.py mlflow.data.digest_utils weak hashEPSS 0.1%CVE-2025-9383LOWFNKvision Y215 CCTV Camera passwd crypt weak hashEPSS 0.1%CVE-2025-48931LOWThe TeleMessage service through 2025-05-05 relies on MD5 for password hashing, which opens up various attack possibilities (including rainboEPSS 0.1%CVE-2026-34527LOWSandboxie-Plus EditPassword hash entropy reduced from 160 bits to 80 bits due to incorrect nibble extractionEPSS 0.1%CVE-2026-10814LOWmilvus-io milvus Grantee ID Hash kv_catalog.go weak hashEPSS 0.1%