Falhas do tipo CWE-327

413 resultados

Uso de algoritmo criptográfico quebrado ou inseguro

A aplicação usa um algoritmo de criptografia que já foi criptanaliticamente quebrado ou é considerado inseguro para o caso de uso. Isso expõe dados sensíveis a decriptação não autorizada, mesmo que o código implemente corretamente a biblioteca criptográfica escolhida.

Exemplo

Um sistema de autenticação usa MD5 ou SHA1 para hash de senhas, ou uma API de pagamento trafega dados com DES ou RC4 em vez de AES. Um atacante consegue recuperar a senha original via força bruta ou quebra criptanalítica em tempo viável.

Como mitigar

Use apenas algoritmos criptográficos modernos e bem mantidos: SHA-256+ para hash, AES-256 para cifra simétrica, RSA-2048+ ou ECDP-256+ para assimétrica. Audite regularmente o stack criptográfico e mantenha dependências atualizadas; remova suporte a algoritmos legados em produção.

CVE-2025-13916MEDIUMMultiple vulnerabilities have been addressed in IBM Aspera SharesEPSS 0.2%CVE-2026-27519HIGHBinardat 10G08-0800GSM Network Switch Hard-coded RC4 Encryption KeyEPSS 0.2%CVE-2025-14761MEDIUMMissing cryptographic key commitment in the AWS SDK for PHP may allow a user with write access to the S3 bucket to introduce a new EDK that EPSS 0.2%CVE-2025-27508HIGHEmissary Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.2%CVE-2025-33084MEDIUMIBM Concert Software information disclosureEPSS 0.2%CVE-2026-32959HIGHSD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a use of a broken or risky cryptographic algorithm. InformEPSS 0.2%CVE-2025-43891MEDIUMDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 releasEPSS 0.2%CVE-2026-28479HIGHOpenClaw < 2026.2.15 - Cache Poisoning via Deprecated SHA-1 Hash in Sandbox ConfigurationEPSS 0.2%CVE-2024-3264MEDIUMBroken or Risky Cryptographic Algorithm in Mia Technology's Mia-Med Health AplicationEPSS 0.2%CVE-2025-14762MEDIUMMissing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3 bucket to introduce a new EDK thatEPSS 0.2%CVE-2024-32852MEDIUMDell PowerScale OneFS versions 8.2.2.x through 9.7.0.0 contain use of a broken or risky cryptographic algorithm vulnerability. An unprivilegEPSS 0.2%CVE-2024-41763MEDIUMIBM Engineering Lifecycle Optimization - Publishing information disclosureEPSS 0.2%CVE-2025-27458MEDIUMCVE-2025-27458EPSS 0.2%CVE-2022-45858LOWA use of a weak cryptographic algorithm vulnerability [CWE-327] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.0 all versions, 8.8.0 all EPSS 0.2%CVE-2023-52236MEDIUMA vulnerability has been identified in RUGGEDCOM i800 (All versions), RUGGEDCOM i801 (All versions), RUGGEDCOM i802 (All versions), RUGGEDCOEPSS 0.2%CVE-2024-31896MEDIUMIBM SPSS Statistics information disclosureEPSS 0.2%CVE-2026-27804CRITICALParse Server: Account takeover via JWT algorithm confusion in Google auth adapterEPSS 0.2%CVE-2024-28780MEDIUMIBM Cognos Controller information disclosureEPSS 0.2%CVE-2026-21907HIGHJunos Space: TLS/SSL server supports use of static key ciphers (ssl-static-key-ciphers)EPSS 0.2%CVE-2024-10405MEDIUMWeak TLS Ciphers on Brocade SANnav port 443 & 18082EPSS 0.2%