Falhas do tipo CWE-327

401 resultados

Uso de algoritmo criptográfico quebrado ou inseguro

A aplicação usa um algoritmo de criptografia que já foi criptanaliticamente quebrado ou é considerado inseguro para o caso de uso. Isso expõe dados sensíveis a decriptação não autorizada, mesmo que o código implemente corretamente a biblioteca criptográfica escolhida.

Exemplo

Um sistema de autenticação usa MD5 ou SHA1 para hash de senhas, ou uma API de pagamento trafega dados com DES ou RC4 em vez de AES. Um atacante consegue recuperar a senha original via força bruta ou quebra criptanalítica em tempo viável.

Como mitigar

Use apenas algoritmos criptográficos modernos e bem mantidos: SHA-256+ para hash, AES-256 para cifra simétrica, RSA-2048+ ou ECDP-256+ para assimétrica. Audite regularmente o stack criptográfico e mantenha dependências atualizadas; remova suporte a algoritmos legados em produção.

CVE-2022-45170MEDIUMAn issue was discovered in LIVEBOX Collaboration vDesk through v018. A Cryptographic Issue can occur under the /api/v1/vencrypt/decrypt/fileEPSS 0.4%CVE-2026-69382MEDIUMMicrosoft Exchange Server Information Disclosure VulnerabilityEPSS 0.4%CVE-2024-25968MEDIUMDell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unaEPSS 0.4%CVE-2022-31157HIGHUse of a Broken or Risky Cryptographic Algorithm in packbackbooks/lti-1-3-php-libraryEPSS 0.4%CVE-2025-34208HIGHVasion Print (formerly PrinterLogic) Insecure Password HashingEPSS 0.4%CVE-2022-22313MEDIUMIBM QRadar Data Synchronization App information disclosureEPSS 0.4%CVE-2019-14852—A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol. An attacker could target traffic using this weaker protocol EPSS 0.4%CVE-2026-22585CRITICALUse of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, PrEPSS 0.4%CVE-2024-40465HIGHAn issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go fileEPSS 0.4%CVE-2022-34444MEDIUM Dell PowerScale OneFS, versions 9.2.0.x through 9.4.0.x contain an information vulnerability. A remote unauthenticated attacker may potentiEPSS 0.4%CVE-2026-21718CRITICALCopeland XWEB and XWEB Pro Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.4%CVE-2025-69929CRITICALAn issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate privileges via the password hashing on the cEPSS 0.4%CVE-2023-38361MEDIUMIBM CICS TX Advanced information disclosureEPSS 0.4%CVE-2023-23695MEDIUM Dell Secure Connect Gateway (SCG) version 5.14.00.12 contains a broken cryptographic algorithm vulnerability. A remote unauthenticated attaEPSS 0.4%CVE-2023-39252MEDIUM Dell SCG Policy Manager 5.16.00.14 contains a broken cryptographic algorithm vulnerability. A remote unauthenticated attacker may potentiaEPSS 0.4%CVE-2023-28076MEDIUM CloudLink 7.1.2 and all prior versions contain a broken or risky cryptographic algorithm vulnerability. An unauthenticated remote attacker EPSS 0.4%CVE-2022-43843MEDIUMIBM Spectrum Scale information disclosureEPSS 0.4%CVE-2022-29161MEDIUMCrypto script service uses hashing algorithm SHA1 with RSA for certificate signature in xwiki-platformEPSS 0.4%CVE-2024-52801MEDIUMBrute force takeover of OpenID Connect session cookies in sftpgoEPSS 0.4%CVE-2023-28053MEDIUM Dell NetWorker Virtual Edition versions 19.8 and below contain the use of deprecated cryptographic algorithms in the SSH component. A remotEPSS 0.4%