Falhas do tipo CWE-327

413 resultados

Uso de algoritmo criptográfico quebrado ou inseguro

A aplicação usa um algoritmo de criptografia que já foi criptanaliticamente quebrado ou é considerado inseguro para o caso de uso. Isso expõe dados sensíveis a decriptação não autorizada, mesmo que o código implemente corretamente a biblioteca criptográfica escolhida.

Exemplo

Um sistema de autenticação usa MD5 ou SHA1 para hash de senhas, ou uma API de pagamento trafega dados com DES ou RC4 em vez de AES. Um atacante consegue recuperar a senha original via força bruta ou quebra criptanalítica em tempo viável.

Como mitigar

Use apenas algoritmos criptográficos modernos e bem mantidos: SHA-256+ para hash, AES-256 para cifra simétrica, RSA-2048+ ou ECDP-256+ para assimétrica. Audite regularmente o stack criptográfico e mantenha dependências atualizadas; remova suporte a algoritmos legados em produção.

CVE-2022-31230HIGHDell PowerScale OneFS, versions 8.2.x-9.2.x, contain broken or risky cryptographic algorithm. A remote unprivileged malicious attacker couldEPSS 0.7%CVE-2021-41096HIGHUse of a Broken or Risky Cryptographic Algorithm in com.mayank.ruckyEPSS 0.7%CVE-2019-3818LOWThe kube-rbac-proxy container before version 0.4.1 as used in Red Hat OpenShift Container Platform does not honor TLS configurations, allowiEPSS 0.7%CVE-2022-45195MEDIUMSimpleXMQ before 3.4.0, as used in SimpleX Chat before 4.2, does not apply a key derivation function to intended data, which can interfere wEPSS 0.6%CVE-2021-22738—Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior that could cEPSS 0.6%CVE-2020-5229HIGHOpencast stores passwords using outdated MD5 hash algorithmEPSS 0.6%CVE-2024-31510CRITICALAn issue in Open Quantum Safe liboqs v.10.0 allows a remote attacker to escalate privileges via the crypto_sign_signature parameter in the /EPSS 0.6%CVE-2023-30441HIGHIBM Java information disclosureEPSS 0.6%CVE-2021-3979—A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectly passed in an encrypEPSS 0.6%CVE-2024-53845MEDIUMAES/CBC Constant IV Vulnerability in ESPTouch v2EPSS 0.6%CVE-2022-22559HIGHDell PowerScale OneFS, version 9.3.0, contains a use of a broken or risky cryptographic algorithm. An unprivileged network attacker could exEPSS 0.6%CVE-2023-50312MEDIUMIBM WebSphere Application Server Liberty information disclosureEPSS 0.6%CVE-2024-22318MEDIUMIBM i Access Client Solutions information disclosureEPSS 0.6%CVE-2013-20003—Z-Wave devices from Sierra Designs (circa 2013) and Silicon Labs (using S0 security) may use a known, shared network key of all zeros, allowEPSS 0.6%CVE-2021-33018HIGHPhilips Vue PACS Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.6%CVE-2021-39182HIGHUse of Password Hash With Insufficient Computational Effort and Use of a Broken or Risky Cryptographic Algorithm and Reversible One-Way Hash in hashing.pyEPSS 0.6%CVE-2025-9146HIGHLinksys E5600 Firmware checkFw.sh verify_gemtek_header risky encryptionEPSS 0.6%CVE-2024-28980MEDIUMDell RecoverPoint for VMs, version(s) 6.0.x contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the SSH. An unautEPSS 0.6%CVE-2022-34320MEDIUMIBM CICS TX information disclosureEPSS 0.5%CVE-2022-1252HIGHUse of a Broken or Risky Cryptographic Algorithm in gnuboard/gnuboard5EPSS 0.5%