Falhas do tipo CWE-328

95 resultados

Uso de hash criptográfico fraco

É o uso de algoritmos de hash (como MD5 ou SHA-1) que foram quebrados ou enfraquecidos para fins de segurança, como verificação de integridade de dados, armazenamento de senhas ou geração de tokens. Esses algoritmos permitem que um atacante forje valores idênticos (colisões) ou reverta o hash com esforço computacional viável, comprometendo a confiança na proteção.

Exemplo

Um sistema armazena senhas usando MD5 sem salt, ou usa SHA-1 para gerar tokens de sessão. Um atacante usa tabelas pré-computadas (rainbow tables) para recuperar senhas MD5 em minutos, ou explora colisões SHA-1 para falsificar tokens de autenticação.

Como mitigar

Substitua MD5 e SHA-1 por SHA-256, SHA-3 ou bcrypt/Argon2 para senhas. Para fins criptográficos, sempre use algoritmos atuais recomendados por autoridades (NIST, IETF). Se o legacy exigir suporte, combine hash fraco com salt robusto e aumente o custo computacional (iterations/work factor).

CVE-2025-59354MEDIUMDragonfly has weak integrity checks for downloaded filesEPSS 0.2%CVE-2025-11650LOWTomofun Furbo 360/Furbo Mini Password shadow weak hashEPSS 0.2%CVE-2026-11479LOWyoanbernabeu grepai Qdrant Backend chunker.go weak hashEPSS 0.2%CVE-2025-9078MEDIUMWeak cache keys lead to post IDOR and link preview poisoningEPSS 0.2%CVE-2024-23589MEDIUMHCL Glovius Cloud is susceptible to an Outdated Hash Algorithm vulnerabilityEPSS 0.2%CVE-2026-65104HIGHNVIDIA Megatron-LM for all platforms contains a vulnerability in inference, where an attacker could cause hash collisions in the cache used EPSS 0.1%CVE-2026-7845LOWchatchat-space Langchain-Chatchat Vision Chat Paste Image dialogue.py PIL.Image.tobytes weak hashEPSS 0.1%CVE-2026-27754MEDIUMSODOLA SL902-SWTGW124AS <= 200.1.20 MD5 Session Token GenerationEPSS 0.1%CVE-2025-2920LOWNetis WF-2404 passwd weak hashEPSS 0.1%CVE-2025-41256HIGHCyberduck and Mountain Duck - Weak Hash Algorithm for Certificate FingerprintEPSS 0.1%CVE-2026-54266HIGHAngular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State PoisoningEPSS 0.1%CVE-2025-26486MEDIUMBroken or Risky Cryptographic Algorithm, Use of Password Hash With Insufficient Computational Effort, Use of Weak Hash, Use of a One-Way HEPSS 0.1%CVE-2026-97469MEDIUMPostgreSQL Anonymizer: RESTRICTED functions are reachable through a subLinkEPSS 0.1%CVE-2023-43635HIGHVault Key Sealed With SHA1 PCRsEPSS 0.1%CVE-2023-43630HIGHConfig Partition Not Measured From 2 FrontsEPSS 0.1%CVE-2026-53692MEDIUMWeak hashing algorithm in Redeight CMSEPSS 0.1%CVE-2024-56414MEDIUMWeb installer integrity check used weak hash algorithm. The following products are affected: Acronis Cyber Protect 16 (Windows) before buildEPSS 0.1%CVE-2026-10540MEDIUMWeak password hash protection in Control-M/Entreprise ManagerEPSS 0.1%CVE-2026-10783LOWgradio-app gradio Audio Cache Key save_audio_to_cache weak hashEPSS 0.1%CVE-2025-9383LOWFNKvision Y215 CCTV Camera passwd crypt weak hashEPSS 0.1%