Falhas do tipo CWE-327

413 resultados

Uso de algoritmo criptográfico quebrado ou inseguro

A aplicação usa um algoritmo de criptografia que já foi criptanaliticamente quebrado ou é considerado inseguro para o caso de uso. Isso expõe dados sensíveis a decriptação não autorizada, mesmo que o código implemente corretamente a biblioteca criptográfica escolhida.

Exemplo

Um sistema de autenticação usa MD5 ou SHA1 para hash de senhas, ou uma API de pagamento trafega dados com DES ou RC4 em vez de AES. Um atacante consegue recuperar a senha original via força bruta ou quebra criptanalítica em tempo viável.

Como mitigar

Use apenas algoritmos criptográficos modernos e bem mantidos: SHA-256+ para hash, AES-256 para cifra simétrica, RSA-2048+ ou ECDP-256+ para assimétrica. Audite regularmente o stack criptográfico e mantenha dependências atualizadas; remova suporte a algoritmos legados em produção.

CVE-2026-54147MEDIUMhttp4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URIEPSS 0.3%CVE-2024-24559LOWVyper SHA3 code generation bugEPSS 0.3%CVE-2026-114820CRITICALVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). EPSS 0.3%CVE-2023-30994MEDIUMIBM QRadar SIEM information disclosureEPSS 0.3%CVE-2024-56344MEDIUMIBM Cognos Analytics 12.0.4 and 12.1.3 versions are affected by security vulnerabilitiesEPSS 0.3%CVE-2024-49797MEDIUMIBM ApplinX Information DisclosureEPSS 0.3%CVE-2025-59408HIGHFlock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 ships with Secure Boot disabled. This allows an attacker to flash modifEPSS 0.3%CVE-2026-34950CRITICALfast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public KeyEPSS 0.3%CVE-2019-18340MEDIUMA vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0), Control Center Server (CCS) (All versions >= V1.EPSS 0.3%CVE-2025-59745MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.3%CVE-2026-57997MEDIUMStrapi users-permissions - JWT Algorithm Confusion via Missing Algorithm ConfigurationEPSS 0.2%CVE-2022-46140HIGHAffected devices use a weak encryption scheme to encrypt the debug zip file. This could allow an authenticated attacker to decrypt the conteEPSS 0.2%CVE-2025-48946LOWliboqs affected by theoretical design flaw in HQCEPSS 0.2%CVE-2024-37068MEDIUMIBM Maximo Application Suite information disclosureEPSS 0.2%CVE-2026-65309HIGHStorage of passwords in a reversible formatEPSS 0.2%CVE-2021-27795MEDIUMLicense forgery in Brocade Fabric OS (FOS) hardware platforms running any version of Brocade Fabric OS software, EPSS 0.2%CVE-2026-33512HIGHAVideo has an unauthenticated decrypt oracle leaking any ciphertextEPSS 0.2%CVE-2023-50351HIGHInsecure key rotation affects MyXalyticsEPSS 0.2%CVE-2025-30477MEDIUMDell PowerScale OneFS, versions prior to 9.11.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. A high privileEPSS 0.2%CVE-2025-68701HIGHJervis has Deterministic AES IV Derivation from PassphraseEPSS 0.2%