CWE-759: Use of a One-Way Hash without a Salt
The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.
A kind of CWE-916 Use of Password Hash With Insufficient Computational Effort.
From the CWE List. © The MITRE Corporation.
Newest
- No product listed CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes 7.5 High
- sfturing hosp order sfturing hosp_order User Password MD5.java MD5.getMD5 hash without salt 2.3 Low
- pik online software solutions inc. online portal Information Disclosure in Pik Online Software's Portal 6.3 Medium
- ibm integrated analytics system IBM Integrated Analytics System (IIAS) is affected by a predictable salt vulnerability in Magneto component 5.9 Medium
- siemens logo! soft comfort A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). The project... 7.0 High
- tp link systems inc. omada access points, tp-link omada ds1008x firmware, omada ds1016g firmware +110 more +112 more Weak Credential Storage in TP-Link Omada Devices 5.7 Medium
- tp-link omada, tp link systems inc. omada access points, omada app +116 more +118 more Weak Credential Protection During TP-Link Omada Device Adoption 6.9 Medium
- labredescefetrj wegia WeGIA: Use of Weak Password Hashing Algorithm (SHA-256, no salt) in html/login.php 5.9 Medium
- ulisesbocchio jasypt-spring-boot ulisesbocchio jasypt-spring-boot Password Hash SimpleGCMConfig.java getSecretKeySaltGenerator hash predictable salt 6.3 Medium
- electerm electerm's encrypt method not safe enough 6.0 Medium
- ibm concert Multiple Vulnerabilities in IBM Concert Software. 5.9 Medium
- vasion virtual appliance host, print application, print virtual appliance host +1 more +3 more Vasion Print (formerly PrinterLogic) Insecure Password Hashing 8.2 High
- abb flxeon Predictable Salt and Weak Hashing Algorithm 8.7 High
- suse neuvector NeuVector has an insecure password storage vulnerable to rainbow attack 5.3 Medium
- tsplus remote access Retrievable password hash protecting TSplus admin console 4.8 Medium
- mnfst manifest Manifest Uses a One-Way Hash without a Salt 4.8 Medium
- ibm security verify governance IBM Security Verify Governance information disclosure 4.4 Medium
- planet gs-4210-24p2s firmware, gs-4210-24pl4c firmware, planet technology gs-4210-24p2s hardware 3.0 +1 more +3 more PLANET Technology switch devices - Weak hash for users' passwords 4.9 Medium
- swissphone dical-red An issue was discovered on Swissphone DiCal-RED 4009 devices. An attacker with access to the file... 6.8 Medium
- wpmanageninja fluentcrm, techjewel fluentcrm – email newsletter, automation, email marketing, email campaigns, optins, leads, and crm solution +1 more FluentCRM - Marketing Automation For WordPress <= 2.8.01 - Insufficient Use of Hash as Authorization Control 6.5 Medium
- b. braun melsungen ag data module compactplus, spacecom, battery pack with wi-fi +1 more +3 more B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus 6.5 Medium
- dbijaya onlinevotingsystem Use of a One-Way Hash without a Salt in OnlineVotingSystem 5.8 Medium
- ge asset performance management classic GE Digital APM Classic, Versions 4.4 and prior. Salt is not used for hash calculation of... 7.2 High