Falhas do tipo CWE-327

413 resultados

Uso de algoritmo criptográfico quebrado ou inseguro

A aplicação usa um algoritmo de criptografia que já foi criptanaliticamente quebrado ou é considerado inseguro para o caso de uso. Isso expõe dados sensíveis a decriptação não autorizada, mesmo que o código implemente corretamente a biblioteca criptográfica escolhida.

Exemplo

Um sistema de autenticação usa MD5 ou SHA1 para hash de senhas, ou uma API de pagamento trafega dados com DES ou RC4 em vez de AES. Um atacante consegue recuperar a senha original via força bruta ou quebra criptanalítica em tempo viável.

Como mitigar

Use apenas algoritmos criptográficos modernos e bem mantidos: SHA-256+ para hash, AES-256 para cifra simétrica, RSA-2048+ ou ECDP-256+ para assimétrica. Audite regularmente o stack criptográfico e mantenha dependências atualizadas; remova suporte a algoritmos legados em produção.

CVE-2025-54981HIGHApache StreamPark: Weak Encryption Algorithm in StreamParkEPSS 0.2%CVE-2026-1627MEDIUMAn attacker may exploit the use of outdated and weak MAC algorithms in the device’s SSH service to potentially compromise the integrity of tEPSS 0.2%CVE-2026-54780LOWCoreWCF: WS-Security Reference DigestMethod Algorithm-Suite BypassEPSS 0.2%CVE-2026-1626MEDIUMAn attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to potentially observe or manipulate parts of thEPSS 0.2%CVE-2026-7103MEDIUMcode-projects Chat System MD5 Hash update_user.php weak hashEPSS 0.2%CVE-2021-47712MEDIUMKentico Xperience <= 12.0.102 URL Hashing Cryptography VulnerabilityEPSS 0.2%CVE-2026-67336CRITICALbetter-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProviderEPSS 0.2%CVE-2024-4563MEDIUMThe Progress MOVEit Automation Configuration Export Function Uses a Cryptographic Method with Insufficient Bit LengthEPSS 0.2%CVE-2021-27784MEDIUMHCL Launch container images may contain non-unique https certificates and database encryption keyEPSS 0.2%CVE-2026-14742LOWlangchain-ai langgraph Task Result Cache _cache.py _freeze weak hashEPSS 0.2%CVE-2026-15605LOWwandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hashEPSS 0.2%CVE-2021-43550MEDIUMPhilips Patient Information Center iX (PIC iX) and Efficia CM Series Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.2%CVE-2026-14630LOWForceInjection AI-fundermentals Memory Recall smart_customer_service.py get_conversation_history weak hashEPSS 0.2%CVE-2026-45701MEDIUMSulu: Weak Cryptographical usage for API Key generation and Reset TokensEPSS 0.2%CVE-2024-22314MEDIUMIBM Storage Defender - Resiliency Service information disclosureEPSS 0.2%CVE-2020-8912LOWIn-band key negotiation issue in AWS S3 Crypto SDK for GoLangEPSS 0.2%CVE-2024-38320MEDIUMIBM Storage Protect for Virtual Environments: Data Protection for VMware information disclosureEPSS 0.2%CVE-2023-26024MEDIUMIBM Planning Analytics on Cloud Pak for Data information disclosureEPSS 0.2%CVE-2023-36608MEDIUM The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm.EPSS 0.2%CVE-2020-7514—A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could EPSS 0.2%