Weaknesses of type CWE-328

90 results

Uso de função hash fraca ou desatualizada

É o uso de algoritmos de hash criptográfico obsoletos ou com colisões conhecidas (como MD5 ou SHA-1) em contextos de segurança críticos, como autenticação, integridade de dados ou assinatura. Atacantes conseguem forjar hashes ou encontrar colisões, comprometendo a confidencialidade ou autenticidade da operação.

Example

Uma aplicação usa MD5 para armazenar senhas de usuários. Um atacante obtém a base de dados e, em minutos, reverte os hashes usando rainbow tables públicas ou força bruta, porque MD5 é extremamente rápido de calcular e tem colisões documentadas.

How to mitigate

Substitua MD5 e SHA-1 por SHA-256, SHA-3 ou bcrypt/scrypt/Argon2 conforme o caso (hash simples vs. derivação de senha). Para código legado, migrate gradualmente: comece a usar algoritmos fortes para novos registros e force re-hash na próxima autenticação do usuário.

CVE-2026-14738MEDIUMexo-explore exo Vision Feature Cache vision.py _image_cache_key weak hashEPSS 0.2%CVE-2026-44582LOWNext.js: Cache poisoning via collisions in React Server Component cache-bustingEPSS 0.2%CVE-2024-47182MEDIUMDozzle uses unsafe hash for passwordsEPSS 0.2%CVE-2026-41879HIGHWeak password hashing in R-SOFT DMSEPSS 0.2%CVE-2024-38341MEDIUMIBM Sterling Secure Proxy information disclosureEPSS 0.2%CVE-2026-36182CRITICALGNCC GP5 v7.1.76 was discovered to utilize a weak hashing algorithm to protect the root password, possibly allowing attackers to obtain rootEPSS 0.2%CVE-2026-13482MEDIUMskypilot-org skypilot User ID server.py username.encode weak hashEPSS 0.2%CVE-2026-7103MEDIUMcode-projects Chat System MD5 Hash update_user.php weak hashEPSS 0.2%CVE-2026-8803MEDIUMopensourcepos Open Source Point of Sale Employee Login Employee.php login weak hashEPSS 0.2%CVE-2026-48488LOWphpMyFAQ has Weak Cryptography - SHA1 for Password HashingEPSS 0.2%CVE-2025-54535MEDIUMIn JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithmsEPSS 0.2%CVE-2024-8452HIGHPLANET Technology switch devices - Insecure hash functions used for SNMPv3 credentialsEPSS 0.2%CVE-2022-29835MEDIUMWD Discovery's Use of Weak Hashing Algorithm for Code SigningEPSS 0.2%CVE-2026-14742LOWlangchain-ai langgraph Task Result Cache _cache.py _freeze weak hashEPSS 0.2%CVE-2026-14630LOWForceInjection AI-fundermentals Memory Recall smart_customer_service.py get_conversation_history weak hashEPSS 0.2%CVE-2026-11479LOWyoanbernabeu grepai Qdrant Backend chunker.go weak hashEPSS 0.2%CVE-2025-59354MEDIUMDragonfly has weak integrity checks for downloaded filesEPSS 0.2%CVE-2026-15605LOWwandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hashEPSS 0.2%CVE-2025-11650LOWTomofun Furbo 360/Furbo Mini Password shadow weak hashEPSS 0.1%CVE-2025-9078MEDIUMWeak cache keys lead to post IDOR and link preview poisoningEPSS 0.1%