Falhas do tipo CWE-327

413 resultados

Uso de algoritmo criptográfico quebrado ou inseguro

A aplicação usa um algoritmo de criptografia que já foi criptanaliticamente quebrado ou é considerado inseguro para o caso de uso. Isso expõe dados sensíveis a decriptação não autorizada, mesmo que o código implemente corretamente a biblioteca criptográfica escolhida.

Exemplo

Um sistema de autenticação usa MD5 ou SHA1 para hash de senhas, ou uma API de pagamento trafega dados com DES ou RC4 em vez de AES. Um atacante consegue recuperar a senha original via força bruta ou quebra criptanalítica em tempo viável.

Como mitigar

Use apenas algoritmos criptográficos modernos e bem mantidos: SHA-256+ para hash, AES-256 para cifra simétrica, RSA-2048+ ou ECDP-256+ para assimétrica. Audite regularmente o stack criptográfico e mantenha dependências atualizadas; remova suporte a algoritmos legados em produção.

CVE-2021-27913LOWUse of a Broken or Risky Cryptographic AlgorithmEPSS 0.5%CVE-2022-31157HIGHUse of a Broken or Risky Cryptographic Algorithm in packbackbooks/lti-1-3-php-libraryEPSS 0.5%CVE-2019-15795MEDIUMpython-apt uses MD5 for validationEPSS 0.5%CVE-2022-22564MEDIUMDell EMC Unity versions before 5.2.0.0.5.173 , use(es) broken cryptographic algorithm. A remote unauthenticated attacker could potentially eEPSS 0.5%CVE-2025-69929CRITICALAn issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate privileges via the password hashing on the cEPSS 0.4%CVE-2022-45170MEDIUMAn issue was discovered in LIVEBOX Collaboration vDesk through v018. A Cryptographic Issue can occur under the /api/v1/vencrypt/decrypt/fileEPSS 0.4%CVE-2024-25968MEDIUMDell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unaEPSS 0.4%CVE-2025-34208HIGHVasion Print (formerly PrinterLogic) Insecure Password HashingEPSS 0.4%CVE-2022-22313MEDIUMIBM QRadar Data Synchronization App information disclosureEPSS 0.4%CVE-2019-14852—A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol. An attacker could target traffic using this weaker protocol EPSS 0.4%CVE-2022-34444MEDIUM Dell PowerScale OneFS, versions 9.2.0.x through 9.4.0.x contain an information vulnerability. A remote unauthenticated attacker may potentiEPSS 0.4%CVE-2022-22461MEDIUMIBM Security Verify Governance, Identity Manager information disclosure EPSS 0.4%CVE-2024-40465HIGHAn issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go fileEPSS 0.4%CVE-2026-22585CRITICALUse of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, PrEPSS 0.4%CVE-2023-39252MEDIUM Dell SCG Policy Manager 5.16.00.14 contains a broken cryptographic algorithm vulnerability. A remote unauthenticated attacker may potentiaEPSS 0.4%CVE-2023-28076MEDIUM CloudLink 7.1.2 and all prior versions contain a broken or risky cryptographic algorithm vulnerability. An unauthenticated remote attacker EPSS 0.4%CVE-2023-23695MEDIUM Dell Secure Connect Gateway (SCG) version 5.14.00.12 contains a broken cryptographic algorithm vulnerability. A remote unauthenticated attaEPSS 0.4%CVE-2022-29161MEDIUMCrypto script service uses hashing algorithm SHA1 with RSA for certificate signature in xwiki-platformEPSS 0.4%CVE-2022-43843MEDIUMIBM Spectrum Scale information disclosureEPSS 0.4%CVE-2024-52801MEDIUMBrute force takeover of OpenID Connect session cookies in sftpgoEPSS 0.4%