Fallos del tipo CWE-326

186 resultados

Força de criptografia inadequada

A aplicação usa algoritmos ou tamanhos de chave criptográficos abaixo do padrão de segurança esperado para o contexto, deixando dados sensíveis vulneráveis a força bruta ou ataques criptanalíticos. Mesmo que o código implemente criptografia, uma chave pequena ou algoritmo fraco torna a proteção ineficaz.

Ejemplo

Um sistema bancário que salva senhas criptografadas com DES de 56 bits em vez de AES-256, ou que usa chaves RSA de 512 bits para certificados HTTPS. Um atacante com recursos moderados quebra essas chaves em horas ou dias.

Cómo mitigar

Use algoritmos modernos e reconhecidos (AES-256 para simétrico, RSA-2048+ ou curvas elípticas para assimétrico). Valide e atualize periodicamente o tamanho de chaves conforme recomendações de órgãos como NIST. Em Java/Python/.NET, prefira bibliotecas padrão (javax.crypto, cryptography, System.Security.Cryptography) e evite implementações caseiras.

CVE-2024-29950HIGHBrocade SANnav before v2.3.1, v2.3.0a uses weak encryptionEPSS 0.3%CVE-2020-7565HIGHA CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker EPSS 0.3%CVE-2024-29969HIGHTLS/SSL weak message authentication code ciphers are added by default for port 18082EPSS 0.3%CVE-2024-21881HIGHUpload of encrypted packages allows authenticated command execution in Enphase IQ Gateway v4.x and v5.xEPSS 0.3%CVE-2024-33662HIGHPortainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function.EPSS 0.3%CVE-2025-7789MEDIUMXuxueli xxl-job Token Generation IndexController.java makeToken weak password hashEPSS 0.3%CVE-2020-10636MEDIUMICSA-20-140-02 Emerson OpenEnterpriseEPSS 0.3%CVE-2020-4099MEDIUMHCL Verse for Android is susceptible to an APK signing key check vulnerabilityEPSS 0.3%CVE-2024-41594HIGHAn issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the VigoEPSS 0.3%CVE-2022-48193MEDIUMWeak ciphers vulnerability in Softing smartLink SW-HTEPSS 0.3%CVE-2023-29054MEDIUMA vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE EPSS 0.3%CVE-2024-5800HIGHDiffie-Hellman groups with insufficient strength used in SSL/TLS stack of B&R Automation RuntimeEPSS 0.3%CVE-2026-33488HIGHAVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl PluginEPSS 0.3%CVE-2020-10601—VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module allow weak hashing algorithm and insecure permissions which may allow a locaEPSS 0.3%CVE-2024-22892HIGHOpenSlides 4.0.15 was discovered to be using a weak hashing algorithm to store passwords.EPSS 0.2%CVE-2022-2640HIGHThe Config-files of Horner Automation’s RCC 972 with firmware version 15.40 are encrypted with weak XOR encryption vulnerable to reverse engEPSS 0.2%CVE-2023-36748MEDIUMA vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEEPSS 0.2%CVE-2024-38277MEDIUMmoodle: QR login key and auto-login key for the Moodle mobile app should be generated as separate keysEPSS 0.2%CVE-2026-45363CRITICAL`jwt` (Ruby gem) - empty-key HMAC bypassEPSS 0.2%CVE-2017-9645—An Inadequate Encryption Strength issue was discovered in Mirion Technologies DMC 3000 Transmitter Module, iPam Transmitter f/DMC 2000, RDS-EPSS 0.2%