Falhas do tipo CWE-327

401 resultados

Uso de algoritmo criptográfico quebrado ou inseguro

A aplicação usa um algoritmo de criptografia que já foi criptanaliticamente quebrado ou é considerado inseguro para o caso de uso. Isso expõe dados sensíveis a decriptação não autorizada, mesmo que o código implemente corretamente a biblioteca criptográfica escolhida.

Exemplo

Um sistema de autenticação usa MD5 ou SHA1 para hash de senhas, ou uma API de pagamento trafega dados com DES ou RC4 em vez de AES. Um atacante consegue recuperar a senha original via força bruta ou quebra criptanalítica em tempo viável.

Como mitigar

Use apenas algoritmos criptográficos modernos e bem mantidos: SHA-256+ para hash, AES-256 para cifra simétrica, RSA-2048+ ou ECDP-256+ para assimétrica. Audite regularmente o stack criptográfico e mantenha dependências atualizadas; remova suporte a algoritmos legados em produção.

CVE-2023-23346MEDIUMUse of a broken cryptographic algorithm affects HCL DRYiCE MyCloud EPSS 0.1%CVE-2026-49322MEDIUMIndian Scout Bobber 2025 Infotainment-to-WCM weak authentication allows recovery of user PIN from observed exchangeEPSS 0.1%CVE-2026-10803LOWMLflow Dataset Digest Computation digest_utils.py mlflow.data.digest_utils weak hashEPSS 0.1%CVE-2024-20070MEDIUMIn modem, there is a possible information disclosure due to using risky cryptographic algorithm during connection establishment negotiation.EPSS 0.1%CVE-2025-51726HIGHCyberGhostVPNSetup.exe (Windows installer) is signed using the weak cryptographic hash algorithm SHA-1, which is vulnerable to collision attEPSS 0.1%CVE-2026-40641MEDIUMDell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthEPSS 0.1%CVE-2025-9317HIGHAVEVA Edge Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.1%CVE-2025-9383LOWFNKvision Y215 CCTV Camera passwd crypt weak hashEPSS 0.1%CVE-2026-56609MEDIUMHCL iControl is affected by multiple security vulnerabilities(CVE-2026-56608 and CVE-2026-56609).EPSS 0.1%CVE-2025-7214LOWFNKvision FNK-GU2 MD5 shadow risky encryptionEPSS 0.1%CVE-2026-78236HIGHInsecure PIN derivation mechanism in Admin By Request (ABR)EPSS 0.1%CVE-2025-30156HIGHCeph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgeryEPSS 0.1%CVE-2026-10814LOWmilvus-io milvus Grantee ID Hash kv_catalog.go weak hashEPSS 0.1%CVE-2025-7383MEDIUMTiming side-channel vulnerability in AES-CBC decryption with PKCS#7 padding in Oberon PSA Crypto libraryEPSS 0.1%CVE-2025-7071MEDIUMTiming side-channel vulnerability in AES-CBC decryption with PKCS#7 padding in ocrypto libraryEPSS 0.1%CVE-2024-45394HIGHSecret encryption vulnerable to brute-force attacksEPSS 0.1%CVE-2025-54340MEDIUMA vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. There is a Broken or Risky CryptEPSS 0.1%CVE-2026-23601MEDIUMFrame Injection via Shared GTK Allows Traffic Spoofing and Client CompromiseEPSS 0.1%CVE-2026-10804LOWStreamlit Palette hashing.py weak hashEPSS 0.1%CVE-2026-81822HIGHAVEVA Pipeline Integrity Monitor Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.1%