Falhas do tipo CWE-327

401 resultados

Uso de algoritmo criptográfico quebrado ou inseguro

A aplicação usa um algoritmo de criptografia que já foi criptanaliticamente quebrado ou é considerado inseguro para o caso de uso. Isso expõe dados sensíveis a decriptação não autorizada, mesmo que o código implemente corretamente a biblioteca criptográfica escolhida.

Exemplo

Um sistema de autenticação usa MD5 ou SHA1 para hash de senhas, ou uma API de pagamento trafega dados com DES ou RC4 em vez de AES. Um atacante consegue recuperar a senha original via força bruta ou quebra criptanalítica em tempo viável.

Como mitigar

Use apenas algoritmos criptográficos modernos e bem mantidos: SHA-256+ para hash, AES-256 para cifra simétrica, RSA-2048+ ou ECDP-256+ para assimétrica. Audite regularmente o stack criptográfico e mantenha dependências atualizadas; remova suporte a algoritmos legados em produção.

CVE-2023-30994MEDIUMIBM QRadar SIEM information disclosureEPSS 0.2%CVE-2026-56454MEDIUMHCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1.EPSS 0.2%CVE-2025-65849CRITICALA cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-WoEPSS 0.2%CVE-2020-7514—A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could EPSS 0.2%CVE-2021-43550MEDIUMPhilips Patient Information Center iX (PIC iX) and Efficia CM Series Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.2%CVE-2026-47775MEDIUMEnvoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie DecryptionEPSS 0.2%CVE-2022-43851MEDIUMIBM Aspera Console information disclosureEPSS 0.2%CVE-2024-52331HIGHECOVACS lawnmowers and vacuums deterministic firmware encryption keyEPSS 0.2%CVE-2025-55112HIGHBMC Control-M/Agent hardcoded Blowfish keysEPSS 0.2%CVE-2026-28252CRITICALUse of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer ConciergeEPSS 0.2%CVE-2024-45643MEDIUMIBM QRadar EDR information disclosureEPSS 0.2%CVE-2024-51556HIGHSensitive Information Disclosure Vulnerability in Wave 2.0EPSS 0.2%CVE-2025-33147MEDIUMIBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilitiesEPSS 0.2%CVE-2025-65831HIGHThe application uses an insecure hashing algorithm (MD5) to hash passwords. If an attacker obtained a copy of these hashes, either through eEPSS 0.2%CVE-2024-41775MEDIUMIBM Cognos Controller information disclosureEPSS 0.2%CVE-2024-27256MEDIUMIBM MQ Operator information disclosureEPSS 0.2%CVE-2025-36161MEDIUMIBM Concert Software Information DisclosureEPSS 0.2%CVE-2025-14761MEDIUMMissing cryptographic key commitment in the AWS SDK for PHP may allow a user with write access to the S3 bucket to introduce a new EDK that EPSS 0.2%CVE-2025-33084MEDIUMIBM Concert Software information disclosureEPSS 0.2%CVE-2025-43891MEDIUMDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 releasEPSS 0.2%