Falhas do tipo CWE-327

401 resultados

Uso de algoritmo criptográfico quebrado ou inseguro

A aplicação usa um algoritmo de criptografia que já foi criptanaliticamente quebrado ou é considerado inseguro para o caso de uso. Isso expõe dados sensíveis a decriptação não autorizada, mesmo que o código implemente corretamente a biblioteca criptográfica escolhida.

Exemplo

Um sistema de autenticação usa MD5 ou SHA1 para hash de senhas, ou uma API de pagamento trafega dados com DES ou RC4 em vez de AES. Um atacante consegue recuperar a senha original via força bruta ou quebra criptanalítica em tempo viável.

Como mitigar

Use apenas algoritmos criptográficos modernos e bem mantidos: SHA-256+ para hash, AES-256 para cifra simétrica, RSA-2048+ ou ECDP-256+ para assimétrica. Audite regularmente o stack criptográfico e mantenha dependências atualizadas; remova suporte a algoritmos legados em produção.

CVE-2019-3818LOWThe kube-rbac-proxy container before version 0.4.1 as used in Red Hat OpenShift Container Platform does not honor TLS configurations, allowiEPSS 0.7%CVE-2022-31230HIGHDell PowerScale OneFS, versions 8.2.x-9.2.x, contain broken or risky cryptographic algorithm. A remote unprivileged malicious attacker couldEPSS 0.7%CVE-2021-22738—Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior that could cEPSS 0.6%CVE-2020-5229HIGHOpencast stores passwords using outdated MD5 hash algorithmEPSS 0.6%CVE-2022-45195MEDIUMSimpleXMQ before 3.4.0, as used in SimpleX Chat before 4.2, does not apply a key derivation function to intended data, which can interfere wEPSS 0.6%CVE-2024-31510CRITICALAn issue in Open Quantum Safe liboqs v.10.0 allows a remote attacker to escalate privileges via the crypto_sign_signature parameter in the /EPSS 0.6%CVE-2023-30441HIGHIBM Java information disclosureEPSS 0.6%CVE-2024-53845MEDIUMAES/CBC Constant IV Vulnerability in ESPTouch v2EPSS 0.6%CVE-2022-22559HIGHDell PowerScale OneFS, version 9.3.0, contains a use of a broken or risky cryptographic algorithm. An unprivileged network attacker could exEPSS 0.6%CVE-2023-50312MEDIUMIBM WebSphere Application Server Liberty information disclosureEPSS 0.6%CVE-2017-5243—The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key excEPSS 0.6%CVE-2024-22318MEDIUMIBM i Access Client Solutions information disclosureEPSS 0.6%CVE-2013-20003—Z-Wave devices from Sierra Designs (circa 2013) and Silicon Labs (using S0 security) may use a known, shared network key of all zeros, allowEPSS 0.6%CVE-2021-33018HIGHPhilips Vue PACS Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.6%CVE-2021-39182HIGHUse of Password Hash With Insufficient Computational Effort and Use of a Broken or Risky Cryptographic Algorithm and Reversible One-Way Hash in hashing.pyEPSS 0.6%CVE-2021-3979—A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectly passed in an encrypEPSS 0.6%CVE-2024-28980MEDIUMDell RecoverPoint for VMs, version(s) 6.0.x contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the SSH. An unautEPSS 0.6%CVE-2022-1252HIGHUse of a Broken or Risky Cryptographic Algorithm in gnuboard/gnuboard5EPSS 0.5%CVE-2026-20833MEDIUMWindows Kerberos Information Disclosure VulnerabilityEPSS 0.5%CVE-2019-0030MEDIUMJuniper ATP: Password hashing uses DES and a hardcoded saltEPSS 0.5%