Falhas do tipo CWE-326

208 resultados

Criptografia com força inadequada

Ocorre quando um desenvolvedor implementa criptografia, mas usa algoritmos, tamanhos de chave ou modos de operação insuficientes para proteger dados sensíveis contra força bruta ou criptoanálise. Um exemplo clássico é usar DES em vez de AES, ou chaves RSA de 512 bits quando o padrão mínimo aceitável é 2048 bits.

Exemplo

Uma aplicação que armazena senhas usando MD5 ou SHA-1 sem salt, ou que criptografa dados de cartão de crédito com AES-128 quando deveria ser AES-256. Um atacante consegue quebrar essas chaves com recursos computacionais modernos em tempo viável.

Como mitigar

Use algoritmos criptográficos modernos e fortes: AES-256 para simetria, RSA-2048 (ou superiores) para assimetria, bcrypt/Argon2 para hashing de senhas, e sempre com salt ou IV aleatório. Siga as recomendações de órgãos como NIST ou BSI para tamanhos mínimos de chave.

CVE-2021-27457—A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected products utilize a weak encrypEPSS 0.5%CVE-2020-1982MEDIUMPAN-OS: TLS 1.0 usage for certain communications with Palo Alto Networks cloud delivered servicesEPSS 0.4%CVE-2018-5461—An Inadequate Encryption Strength issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS ClassEPSS 0.4%CVE-2024-32758CRITICALexacqVision - Key exchangesEPSS 0.4%CVE-2024-23656HIGHDex 2.37.0 is discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphersEPSS 0.4%CVE-2018-25272CRITICALELBA5 5.8.0 Remote Code Execution via Database AccessEPSS 0.4%CVE-2001-1546HIGHPathways Homecare 6.5 uses weak encryption for user names and passwords, which allows local users to gain privileges by recovering the passwEPSS 0.4%CVE-2021-32945HIGHMDT AutoSave Inadequate Encryption StrengthEPSS 0.4%CVE-2022-2758MEDIUMUpdateEPSS 0.4%CVE-2024-28755MEDIUMAn issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum EPSS 0.4%CVE-2021-36337MEDIUMDell Wyse Management Suite version 3.3.1 and prior support insecure Transport Security Protocols TLS 1.0 and TLS 1.1 which are susceptible tEPSS 0.4%CVE-2021-21387HIGHPartial secret key disclosure, improper safety number calculation, & inadequate encryption strengthEPSS 0.4%CVE-2022-24318—A CWE-326: Inadequate Encryption Strength vulnerability exists that could cause non-encrypted communication with the server when outdated veEPSS 0.4%CVE-2026-86670MEDIUMaircheng-org iWebShop-5 Authentication Storage admin.php weak password hashEPSS 0.4%CVE-2021-37209MEDIUMA vulnerability has been identified in RUGGEDCOM i800 (All versions < V4.3.8), RUGGEDCOM i801 (All versions < V4.3.8), RUGGEDCOM i802 (All vEPSS 0.4%CVE-2026-9201HIGHLangflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handlingEPSS 0.4%CVE-2026-45363CRITICAL`jwt` (Ruby gem) - empty-key HMAC bypassEPSS 0.4%CVE-2020-4099MEDIUMHCL Verse for Android is susceptible to an APK signing key check vulnerabilityEPSS 0.4%CVE-2026-65777MEDIUMActive Directory Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2026-74889CRITICALopenssl_encrypt before 1.4.0 Weak Key Derivation via HKDFEPSS 0.3%