Falhas do tipo CWE-328

91 resultados

Uso de hash criptográfico fraco

É o uso de algoritmos de hash (como MD5 ou SHA-1) que foram quebrados ou enfraquecidos para fins de segurança, como verificação de integridade de dados, armazenamento de senhas ou geração de tokens. Esses algoritmos permitem que um atacante forje valores idênticos (colisões) ou reverta o hash com esforço computacional viável, comprometendo a confiança na proteção.

Exemplo

Um sistema armazena senhas usando MD5 sem salt, ou usa SHA-1 para gerar tokens de sessão. Um atacante usa tabelas pré-computadas (rainbow tables) para recuperar senhas MD5 em minutos, ou explora colisões SHA-1 para falsificar tokens de autenticação.

Como mitigar

Substitua MD5 e SHA-1 por SHA-256, SHA-3 ou bcrypt/Argon2 para senhas. Para fins criptográficos, sempre use algoritmos atuais recomendados por autoridades (NIST, IETF). Se o legacy exigir suporte, combine hash fraco com salt robusto e aumente o custo computacional (iterations/work factor).

CVE-2026-15605LOWwandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hashEPSS 0.2%CVE-2026-14630LOWForceInjection AI-fundermentals Memory Recall smart_customer_service.py get_conversation_history weak hashEPSS 0.2%CVE-2026-14742LOWlangchain-ai langgraph Task Result Cache _cache.py _freeze weak hashEPSS 0.2%CVE-2025-8260LOWVaelsys VaelsysV4 Web interface vgrid_server.php weak hashEPSS 0.2%CVE-2024-47829MEDIUMpnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwritingEPSS 0.2%CVE-2024-10026MEDIUMImproved Seeding and Hashing In gVisorEPSS 0.2%CVE-2024-38341MEDIUMIBM Sterling Secure Proxy information disclosureEPSS 0.2%CVE-2026-32129HIGHPoseidon V1 variable-length input collision via implicit zero-paddingEPSS 0.2%CVE-2026-44582LOWNext.js: Cache poisoning via collisions in React Server Component cache-bustingEPSS 0.2%CVE-2024-47182MEDIUMDozzle uses unsafe hash for passwordsEPSS 0.2%CVE-2022-29835MEDIUMWD Discovery's Use of Weak Hashing Algorithm for Code SigningEPSS 0.2%CVE-2026-36182CRITICALGNCC GP5 v7.1.76 was discovered to utilize a weak hashing algorithm to protect the root password, possibly allowing attackers to obtain rootEPSS 0.2%CVE-2026-7103MEDIUMcode-projects Chat System MD5 Hash update_user.php weak hashEPSS 0.2%CVE-2026-13455MEDIUMPostgreSQL Anonymizer: Unrestricted function can leak the secret saltEPSS 0.2%CVE-2026-8803MEDIUMopensourcepos Open Source Point of Sale Employee Login Employee.php login weak hashEPSS 0.2%CVE-2026-48488LOWphpMyFAQ has Weak Cryptography - SHA1 for Password HashingEPSS 0.2%CVE-2025-54535MEDIUMIn JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithmsEPSS 0.2%CVE-2024-8452HIGHPLANET Technology switch devices - Insecure hash functions used for SNMPv3 credentialsEPSS 0.2%CVE-2024-23589MEDIUMHCL Glovius Cloud is susceptible to an Outdated Hash Algorithm vulnerabilityEPSS 0.2%CVE-2025-59354MEDIUMDragonfly has weak integrity checks for downloaded filesEPSS 0.2%