Falhas do tipo CWE-326

208 resultados

Criptografia com força inadequada

Ocorre quando um desenvolvedor implementa criptografia, mas usa algoritmos, tamanhos de chave ou modos de operação insuficientes para proteger dados sensíveis contra força bruta ou criptoanálise. Um exemplo clássico é usar DES em vez de AES, ou chaves RSA de 512 bits quando o padrão mínimo aceitável é 2048 bits.

Exemplo

Uma aplicação que armazena senhas usando MD5 ou SHA-1 sem salt, ou que criptografa dados de cartão de crédito com AES-128 quando deveria ser AES-256. Um atacante consegue quebrar essas chaves com recursos computacionais modernos em tempo viável.

Como mitigar

Use algoritmos criptográficos modernos e fortes: AES-256 para simetria, RSA-2048 (ou superiores) para assimetria, bcrypt/Argon2 para hashing de senhas, e sempre com salt ou IV aleatório. Siga as recomendações de órgãos como NIST ou BSI para tamanhos mínimos de chave.

CVE-2024-40761MEDIUMApache Answer: Avatar URL leaked user email addressesEPSS 0.7%CVE-2025-55248MEDIUM.NET, .NET Framework, and Visual Studio Information Disclosure VulnerabilityEPSS 0.7%CVE-2024-22894MEDIUMAn issue fixed in AIT-Deutschland Alpha Innotec Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later and Novelan Heatpumps V2.88.3EPSS 0.7%CVE-2025-48823MEDIUMWindows Cryptographic Services Information Disclosure VulnerabilityEPSS 0.7%CVE-2019-19097MEDIUMABB eSOMS: SSL medium strength Cipher SuitesEPSS 0.7%CVE-2020-14517—Protocol encryption can be easily broken for CodeMeter (All versions prior to 6.90 are affected, including Version 6.90 or newer only if CodEPSS 0.7%CVE-2023-3243HIGH ** UNSUPPORTED WHEN ASSIGNED ** [An attacker can capture an authenticating hash and utilize it to create new sessions. The hash is also a pEPSS 0.6%CVE-2020-26197HIGHDell PowerScale OneFS 8.1.0 - 9.1.0 contains an LDAP Provider inability to connect over TLSv1.2 vulnerability. It may make it easier to eaveEPSS 0.6%CVE-2024-39928HIGHApache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerabilityEPSS 0.6%CVE-2018-4839—A vulnerability has been identified in DIGSI 4 (All versions < V4.92), EN100 Ethernet module DNP3 variant (All versions < V1.05.00), EN100 EEPSS 0.6%CVE-2021-35226MEDIUMHashed Credential Exposure VulnerabilityEPSS 0.6%CVE-2019-19101MEDIUMIncomplete communication encryption and validation in B&R Automation Studio upgrade serviceEPSS 0.5%CVE-2023-27389HIGHInadequate encryption strength vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker with an administrativeEPSS 0.5%CVE-2021-20406LOWIBM Security Verify Information Queue information disclosureEPSS 0.5%CVE-2023-35332MEDIUMWindows Remote Desktop Protocol Security Feature BypassEPSS 0.5%CVE-2022-47931MEDIUMIO FinNet tss-lib before 2.0.0 allows a collision of hash values.EPSS 0.5%CVE-2023-41305—Vulnerability of 5G messages being sent without being encrypted in a VPN environment in the SMS message module. Successful exploitation of tEPSS 0.5%CVE-2023-33982MEDIUMBramble Handshake Protocol (BHP) in Briar before 1.5.3 is not forward secure: eavesdroppers can decrypt network traffic between two accountsEPSS 0.5%CVE-2025-20667MEDIUMIn Modem, there is a possible information disclosure due to incorrect error handling. This could lead to remote information disclosure, if aEPSS 0.5%CVE-2022-45141CRITICALSince the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assuEPSS 0.5%