Falhas do tipo CWE-327

413 resultados

Uso de algoritmo criptográfico quebrado ou inseguro

A aplicação usa um algoritmo de criptografia que já foi criptanaliticamente quebrado ou é considerado inseguro para o caso de uso. Isso expõe dados sensíveis a decriptação não autorizada, mesmo que o código implemente corretamente a biblioteca criptográfica escolhida.

Exemplo

Um sistema de autenticação usa MD5 ou SHA1 para hash de senhas, ou uma API de pagamento trafega dados com DES ou RC4 em vez de AES. Um atacante consegue recuperar a senha original via força bruta ou quebra criptanalítica em tempo viável.

Como mitigar

Use apenas algoritmos criptográficos modernos e bem mantidos: SHA-256+ para hash, AES-256 para cifra simétrica, RSA-2048+ ou ECDP-256+ para assimétrica. Audite regularmente o stack criptográfico e mantenha dependências atualizadas; remova suporte a algoritmos legados em produção.

CVE-2020-6987—In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the affected products use a weak cEPSS 1.0%CVE-2026-48386HIGHColdFusion | Use of a Broken or Risky Cryptographic Algorithm (CWE-327)EPSS 1.0%CVE-2016-5431—The PHP JOSE Library by Gree Inc. before version 2.2.1 is vulnerable to key confusion/algorithm substitution in the JWS component resulting EPSS 1.0%CVE-2005-4900MEDIUMSHA-1 is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attaEPSS 0.9%CVE-2020-10927HIGHThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 EPSS 0.9%CVE-2020-11035HIGHweak CSRF tokens in GLPIEPSS 0.9%CVE-2020-7511—A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which coEPSS 0.9%CVE-2021-36298HIGHDell EMC InsightIQ, versions prior to 4.1.4, contain risky cryptographic algorithms in the SSH component. A remote unauthenticated attacker EPSS 0.8%CVE-2020-27652HIGHAlgorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackEPSS 0.8%CVE-2020-27653HIGHAlgorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to sEPSS 0.8%CVE-2020-25232—A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Due to the usage of an insecure random numbEPSS 0.8%CVE-2021-41168MEDIUMHash-Collision Denial-of-Service Vulnerability in snudownEPSS 0.8%CVE-2024-36823HIGHThe encrypt() function of Ninja Core v7.0.0 was discovered to use a weak cryptographic algorithm, leading to a possible leakage of sensitiveEPSS 0.8%CVE-2026-5588MEDIUMPKIX draft CompositeVerifier accepts empty signature sequence as valid.EPSS 0.8%CVE-2022-29249HIGHReversible One-Way Hash and Use of a Broken or Risky Cryptographic Algorithm in io.github.javaezlib.JavaEZEPSS 0.7%CVE-2022-26854HIGHDell PowerScale OneFS, versions 8.2.x-9.2.x, contain risky cryptographic algorithms. A remote unprivileged malicious attacker could potentiaEPSS 0.7%CVE-2024-28834MEDIUMGnutls: vulnerable to minerva side-channel information leakEPSS 0.7%CVE-2023-37464HIGHIncorrect Authentication Tag length usage in AES GCM decryption in OpenIDC/cjoseEPSS 0.7%CVE-2019-1828MEDIUMCisco Small Business RV320 and RV325 Routers Weak Credential Encryption VulnerabilityEPSS 0.7%CVE-2026-21718CRITICALCopeland XWEB and XWEB Pro Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.7%