Falhas do tipo CWE-327

413 resultados

Uso de algoritmo criptográfico quebrado ou inseguro

A aplicação usa um algoritmo de criptografia que já foi criptanaliticamente quebrado ou é considerado inseguro para o caso de uso. Isso expõe dados sensíveis a decriptação não autorizada, mesmo que o código implemente corretamente a biblioteca criptográfica escolhida.

Exemplo

Um sistema de autenticação usa MD5 ou SHA1 para hash de senhas, ou uma API de pagamento trafega dados com DES ou RC4 em vez de AES. Um atacante consegue recuperar a senha original via força bruta ou quebra criptanalítica em tempo viável.

Como mitigar

Use apenas algoritmos criptográficos modernos e bem mantidos: SHA-256+ para hash, AES-256 para cifra simétrica, RSA-2048+ ou ECDP-256+ para assimétrica. Audite regularmente o stack criptográfico e mantenha dependências atualizadas; remova suporte a algoritmos legados em produção.

CVE-2023-50350HIGHA broken cryptographic algorithm impacts MyXalyticsEPSS 0.2%CVE-2026-56609MEDIUMHCL iControl is affected by multiple security vulnerabilities(CVE-2026-56608 and CVE-2026-56609).EPSS 0.2%CVE-2024-47921HIGHSmadar SPS – CWE-327: Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.2%CVE-2026-81438LOWDell OpenManage Server Administrator, versions prior to 11.1.0.3, contains Use of a Broken or Risky Cryptographic Algorithm vulnerability. AEPSS 0.2%CVE-2026-6930LOWIBM Concert Software Risky Cryptographic AlgorithmEPSS 0.2%CVE-2026-8072CRITICALInsecure generation of SAT access credentials in Ingecon EMS BoardEPSS 0.2%CVE-2026-18153MEDIUMIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.1%CVE-2025-34500HIGHShuffle Master Deck Mate 2 Insecure Update ChainEPSS 0.1%CVE-2021-3446—A flaw was found in libtpms in versions before 0.8.2. The commonly used integration of libtpms with OpenSSL contained a vulnerability relateEPSS 0.1%CVE-2026-82356HIGHImprivata EAM: Unrotatable X.509 RSA Key Pair in ProductionEPSS 0.1%CVE-2026-28490HIGHAuthlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding OracleEPSS 0.1%CVE-2025-63912MEDIUMCohesity TranZman Migration Appliance Release 4.0 Build 14614 was discovered to use a weak cryptography algorithm for data encryption, allowEPSS 0.1%CVE-2026-25834MEDIUMMbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade.EPSS 0.1%CVE-2026-102824MEDIUMRussh: Missing X25519 zero-point validation in hybrid ML-KEM key exchangeEPSS 0.1%CVE-2026-7845LOWchatchat-space Langchain-Chatchat Vision Chat Paste Image dialogue.py PIL.Image.tobytes weak hashEPSS 0.1%CVE-2026-24785HIGHClatter has a PSK Validity Rule Violation issueEPSS 0.1%CVE-2025-68698HIGHJervis has an RSA PKCS#1 v1.5 Padding VulnerabilityEPSS 0.1%CVE-2025-41223MEDIUMA vulnerability has been identified in RUGGEDCOM i800 (All versions), RUGGEDCOM i801 (All versions), RUGGEDCOM i802 (All versions), RUGGEDCOEPSS 0.1%CVE-2024-41986MEDIUMA vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >=EPSS 0.1%CVE-2025-37127HIGHAuthenticated Replay Attack contains Cryptographic VulnerabilityEPSS 0.1%