Falhas do tipo CWE-327

413 resultados

Uso de algoritmo criptográfico quebrado ou inseguro

A aplicação usa um algoritmo de criptografia que já foi criptanaliticamente quebrado ou é considerado inseguro para o caso de uso. Isso expõe dados sensíveis a decriptação não autorizada, mesmo que o código implemente corretamente a biblioteca criptográfica escolhida.

Exemplo

Um sistema de autenticação usa MD5 ou SHA1 para hash de senhas, ou uma API de pagamento trafega dados com DES ou RC4 em vez de AES. Um atacante consegue recuperar a senha original via força bruta ou quebra criptanalítica em tempo viável.

Como mitigar

Use apenas algoritmos criptográficos modernos e bem mantidos: SHA-256+ para hash, AES-256 para cifra simétrica, RSA-2048+ ou ECDP-256+ para assimétrica. Audite regularmente o stack criptográfico e mantenha dependências atualizadas; remova suporte a algoritmos legados em produção.

CVE-2026-81822HIGHAVEVA Pipeline Integrity Monitor Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.1%CVE-2025-14859HIGHSemtech LR11xx Secure Boot BypassEPSS 0.1%CVE-2026-44405LOWIn Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.EPSS 0.1%CVE-2024-55539LOWWeak algorithm used to sign RPM package. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux) before build 39185, EPSS 0.1%CVE-2025-51726HIGHCyberGhostVPNSetup.exe (Windows installer) is signed using the weak cryptographic hash algorithm SHA-1, which is vulnerable to collision attEPSS 0.1%CVE-2026-8470HIGHLangflow is affected by weaknesses in secret handling and sensitive configuration accessEPSS 0.1%CVE-2025-7214LOWFNKvision FNK-GU2 MD5 shadow risky encryptionEPSS 0.1%CVE-2026-6412LOWContinued acceptance of SHA-1/MD5 digests in certificate processingEPSS 0.1%CVE-2026-81859MEDIUMMultiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.EPSS 0.1%CVE-2025-14764MEDIUMMissing cryptographic key commitment in the Amazon S3 Encryption Client for Go may allow a user with write access to the S3 bucket to introdEPSS 0.1%CVE-2023-23347MEDIUMUse of a broken cryptographic algorithm affects HCL DRYiCE iAutomateEPSS 0.1%CVE-2025-14759MEDIUMMissing cryptographic key commitment in the Amazon S3 Encryption Client for .NET may allow a user with write access to the S3 bucket to intrEPSS 0.1%CVE-2019-3700LOWyast: Fallback to DES without configuration in /etc/login.defEPSS 0.1%CVE-2026-49323MEDIUMIndian Scout Bobber 2025 WCM-to-ECM weak authenticationEPSS 0.1%CVE-2026-10783LOWgradio-app gradio Audio Cache Key save_audio_to_cache weak hashEPSS 0.1%CVE-2025-9383LOWFNKvision Y215 CCTV Camera passwd crypt weak hashEPSS 0.1%CVE-2023-23346MEDIUMUse of a broken cryptographic algorithm affects HCL DRYiCE MyCloud EPSS 0.1%CVE-2025-36591MEDIUMDell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contains an Use of a Broken or Risky CryptographiEPSS 0.1%CVE-2026-10803LOWMLflow Dataset Digest Computation digest_utils.py mlflow.data.digest_utils weak hashEPSS 0.1%CVE-2026-49322MEDIUMIndian Scout Bobber 2025 Infotainment-to-WCM weak authentication allows recovery of user PIN from observed exchangeEPSS 0.1%