CWE-328: Use of Weak Hash
The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).
A kind of CWE-327 Use of a Broken or Risky Cryptographic Algorithm.
From the CWE List. © The MITRE Corporation.
Newest
- mattermost, mattermost server +1 moreWeak cache keys lead to post IDOR and link preview poisoning4.3 Medium
- baicells nova430e/430i, nova436q, neutrino430, nova846CWE-328: Use of Weak Hash6.5 Medium
- fnkvision y215 cctv cameraFNKvision Y215 CCTV Camera passwd crypt weak hash2.0 Low
- jetbrains teamcityIn JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak...5.8 Medium
- vaelsys, vaelsys vaelsysv4 +1 moreVaelsys VaelsysV4 Web interface vgrid_server.php weak hash2.3 Low
- iterate gmbh cyberduck, mountain duck +1 moreCyberduck and Mountain Duck - Weak Hash Algorithm for Certificate Fingerprint7.4 High
- sick media serverDeprecated TLS version supported6.5 Medium
- hcl software glovius cloudHCL Glovius Cloud is susceptible to an Outdated Hash Algorithm vulnerability6.8 Medium
- ibm sterling secure proxyIBM Sterling Secure Proxy information disclosure5.9 Medium
- smarsh telemessage, telemessage service +1 moreThe TeleMessage service through 2025-05-05 relies on MD5 for password hashing, which opens up...3.2 Low
- weidmueller ie-sw-pl10m-3gt-7tx, ie-sw-pl10mt-3gt-7tx, ie-sw-pl16m-16tx +10 more +12 moreWeidmueller: Authentication Bypass Vulnerability in Industrial Ethernet Switches9.8 Critical
- chewkeanho actualizerActualizer Uses OpenSSL's "-passwd" Function Which Uses SHA512 Under The Hood Instead of Proper Password Hasher like Yescript/Argon2i7.5 High
- pnpmpnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting6.5 Medium
- red hat discovery 2, enterprise linux 10, enterprise linux 6 +26 more +28 moreKrb5: kerberos rc4-hmac-md5 checksum vulnerability enabling message spoofing via md5 collisions5.9 Medium
jj-clicrates.io,jj-libcrates.io +1 moreJujutsu does not have SHA-1 collision detection6.8 Medium- gitoxidelabs gitoxidegitoxide does not detect SHA-1 collision attacks6.8 Medium
- netis wf-2404Netis WF-2404 passwd weak hash1.0 Low
- aws aws/sagemaker-python-sdkMD5 Hash Collision in SageMaker Workflow in aws/sagemaker-python-sdk5.9 Medium
- beta80 life 1stUse of a Broken or Risky Cryptographic Algorithm, Use of Password Hash With Insufficient...6.0 Medium
- sick ag dl100-2xxxxxxxWeak hashing alghrythm9.8 Critical
- google gvisorImproved Seeding and Hashing In gVisor6.3 Medium
- moyangzhan langchain4j-aideepinLangChain4j-AIDeepin Using MD5 to Hash files may cause file upload conflicts6.9 Medium
- acronis cyber protect 16Web installer integrity check used weak hash algorithm. The following products are affected:...5.5 Medium
- rockchinq free-one-apifree-one-api uses md5 for password storage6.9 Medium
- beegoBeego Vulnerable to Collision Hazards of MD5 in Cache Key Filenames6.9 Medium
- openwrt asuopenwrt/asu allows build artifact poisoning via truncated SHA-256 hash and command injection9.3 Critical
- abb matrix series, nexus series, aspect-ent-12 firmware +20 more +22 moreMD5 bypass operation8.8 High
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server has a potential hash collision for background jobs could skip queuing them2.6 Low
- messagepack messagepack-csharpMessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflow8.7 High
- planet gs-4210-24p2s firmware, gs-4210-24pl4c firmware, planet technology gs-4210-24p2s hardware 3.0 +1 more +3 morePLANET Technology switch devices - Weak hash for users' passwords4.9 Medium
- planet gs-4210-24p2s firmware, gs-4210-24pl4c firmware, planet technology gs-4210-24p2s hardware 3.0 +1 more +3 morePLANET Technology switch devices - Insecure hash functions used for SNMPv3 credentials7.5 High
- amir20 dozzleDozzle uses unsafe hash for passwords4.8 Medium
- beegoBeego privilege escalation vulnerability8.8 High
- php-censorPHP Censor uses a weak hashing algorithm for the remember me key5.3 Medium
- logint lomag warehouse management, lomag warehouse management +1 moreAn issue in LOGINT LoMag Inventory Management v1.0.20.120 and before allows a local attacker to...5.5 Medium
- gessler gmbh web-master, gesslergmbh web-master firmware +1 moreUse of a Broken or Risky Cryptographic Algorithm in Gessler GmbH WEB-MASTER4.4 Medium
- moxa iologik e1200 series, iologik e1210 firmware, iologik e1211 firmware +8 more +10 moreioLogik E1200 Series: Weak Cryptographic Algorithm Vulnerability6.5 Medium
- siemens ruggedcom rm1224 lte(4g) eu, ruggedcom rm1224 lte(4g) nam, scalance m804pb +103 more +105 moreA vulnerability has been identified in SCALANCE XB205-3 (SC, PN) (All versions < V4.5), SCALANCE...6.9 Medium
- brix crypto-jscrypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard9.1 Critical
- entronad crypto-es, cryptoes +1 morecrypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard9.1 Critical
- lf-edge, zededa eve os, linuxfoundation edge virtualization engine +1 moreVault Key Sealed With SHA1 PCRs8.8 High
- lf-edge, zededa eve os, linuxfoundation edge virtualization engine +1 moreConfig Partition Not Measured From 2 Fronts8.8 High
- nfine rapid development platformNFine Rapid Development Platform CheckLogin weak hash3.7 Low
- ibm app connect enterprise certified containerIBM App Connect Enterprise Certified Container information disclosure5.3 Medium
- arista networks eosAll versions of Econolite EOS traffic control software are vulnerable to CWE-328: Use of Weak...9.8 Critical
- sambaSince the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by...9.8 Critical
- jenkins script security, jenkins project script security plugin +1 moreWhole-script approval in Jenkins Script Security Plugin vulnerable to SHA-1 collisions7.5 High
- haskell aesonThe aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse...6.5 Medium
- western digital wd discoveryWD Discovery's Use of Weak Hashing Algorithm for Code Signing5.3 Medium
- javaez project javaezReversible One-Way Hash and Use of a Broken or Risky Cryptographic Algorithm in io.github.javaezlib.JavaEZ7.5 High
- Show moreLoading…