Falhas do tipo CWE-327

413 resultados

Uso de algoritmo criptográfico quebrado ou inseguro

A aplicação usa um algoritmo de criptografia que já foi criptanaliticamente quebrado ou é considerado inseguro para o caso de uso. Isso expõe dados sensíveis a decriptação não autorizada, mesmo que o código implemente corretamente a biblioteca criptográfica escolhida.

Exemplo

Um sistema de autenticação usa MD5 ou SHA1 para hash de senhas, ou uma API de pagamento trafega dados com DES ou RC4 em vez de AES. Um atacante consegue recuperar a senha original via força bruta ou quebra criptanalítica em tempo viável.

Como mitigar

Use apenas algoritmos criptográficos modernos e bem mantidos: SHA-256+ para hash, AES-256 para cifra simétrica, RSA-2048+ ou ECDP-256+ para assimétrica. Audite regularmente o stack criptográfico e mantenha dependências atualizadas; remova suporte a algoritmos legados em produção.

CVE-2025-68702HIGHJervis has a SHA-256 Hex String Padding BugEPSS 0.2%CVE-2025-45767HIGHjose v6.0.10 was discovered to contain weak encryption. NOTE: this is disputed by a third party because the claim of "do not meet recommendeEPSS 0.2%CVE-2021-36647MEDIUMUse of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp_mod() in lignum.c in Mbed TLS Mbed TLS all versions before EPSS 0.2%CVE-2026-3161MEDIUMIBM Cloud Pak System Risky Cryptographic AlgorithmEPSS 0.2%CVE-2026-6330MEDIUMML-KEM ARM64 NEON ciphertext comparison only compares half of the inputEPSS 0.2%CVE-2026-16693MEDIUMIBM i is Affected By Cryptographic Algorithm Weakness in DCM []EPSS 0.2%CVE-2025-43913MEDIUMDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 releasEPSS 0.2%CVE-2025-14760MEDIUMMissing cryptographic key commitment in the AWS SDK for C++ may allow a user with write access to the S3 bucket to introduce a new EDK that EPSS 0.2%CVE-2026-36609HIGHMercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does not change between requests froEPSS 0.2%CVE-2008-3775MEDIUMFolder Lock 5.9.5 and earlier uses weak encryption (ROT-25) for the password, which allows local administrators to obtain sensitive informatEPSS 0.2%CVE-2024-48016MEDIUMDell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.24, contains a Use of a Broken or Risky Cryptographic Algorithm vulnerabEPSS 0.2%CVE-2025-36084MEDIUMMultiple Vulnerabilities in IBM Concert SoftwareEPSS 0.2%CVE-2025-43909LOWDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 releasEPSS 0.2%CVE-2025-11650LOWTomofun Furbo 360/Furbo Mini Password shadow weak hashEPSS 0.2%CVE-2026-11479LOWyoanbernabeu grepai Qdrant Backend chunker.go weak hashEPSS 0.2%CVE-2026-6411HIGHMAXHUB Pivot Client Application Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.2%CVE-2024-43178MEDIUMMultiple Vulnerabilities in IBM Concert Software.EPSS 0.2%CVE-2025-45766HIGHpoco v1.14.1-release was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expecteEPSS 0.2%CVE-2024-52884HIGHAn issue was discovered in AudioCodes Mediant Session Border Controller (SBC) before 7.40A.501.841. Due to the use of weak password obfuscatEPSS 0.2%CVE-2026-56582LOWHCL MyCloud was affected with SSL/TLS Protocol Affected with LUCKY13 Vulnerability.EPSS 0.2%