CWE-916: Use of Password Hash With Insufficient Computational Effort
The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
A kind of CWE-328 Use of Weak Hash.
From the CWE List. © The MITRE Corporation.
Newest
- ibm api connect Multiple Vulnerabilities in IBM API Connect 5.9 Medium
- No product listed CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key 7.5 High
- No product listed CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes 7.5 High
- appsup-dart jose Weak PBKDF2 parameters for password-encrypted private-key export in jose 7.4 High
- No product listed SH3 Módulo de Gestão/Módulo de Arrecadação weak password hash 2.1 Low
- rotki rotki before 1.44.2 Weak Key Derivation for Premium Cloud Backup Encryption 8.2 High
- cgm clininet Use of Unsalted MD5 Password Hashes in CGM CLININET 8.2 High
- diem-project diem diem-project diem SHA1 PluginDmUser.class.php weak password hash 2.0 Low
- light0011 cms light0011 cms UserModel.class.php sha1 weak password hash 6.3 Medium
- juggleim JuggleIM im-server through 1.8.16 Weak Password Hashing via Unsalted SHA-1 8.2 High
- 201206030 novel novel through 3.5.0 Unsalted MD5 Password Storage 8.2 High
- go-vikunja vikunja Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access 8.1 High
- banq jivejdon Jivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSql 8.2 High
- payloadcms payload Payload: Password hashes use insufficient PBKDF2 iterations 5.7 Medium
- danielberkompas cloak, cloak ecto +1 more Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds 6.3 Medium
- No product listed YzmCMS MD5 system.func.php password weak password hash 6.3 Medium
- carecam hmt.cm2507 firmware CareCam CM2507 Use of Password Hash With Insufficient Computational Effort 9.3 Critical
- cjbi admin3 admin3 through 3.0.0 Weak Password Hashing via Single-Round MD5 6.9 Medium
- cisa malcolm The administrative password is hashed using a comparatively weak, fast algorithm for the... 6.9 Medium
- aircheng-org iwebshop-5 aircheng-org iWebShop-5 Authentication Storage admin.php weak password hash 6.3 Medium
- jahlives openssl encrypt openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus 8.7 High
- jahlives openssl encrypt openssl_encrypt before 1.4.9 Weak Pepper Key Derivation 8.7 High
- frontaccounting FrontAccounting through 2.4.20 Use of Unsalted MD5 for Password Storage 8.2 High
- veracrypt VeraCryp: wolfCrypt backend bypasses VeraCrypt PBKDF2 iteration count (non-default WOLFCRYPT=1 builds) 6.2 Medium
- rockwell automation otto® fleet manager OTTO® Fleet Manager – Weak Password Hashing Configuration 6.9 Medium
- jahlives openssl encrypt openssl_encrypt before 1.4.6 KDF Bypass via Sequential-XOR 6.9 Medium
- zte f689 Root password hash exposure vulnerability in ZTE F689 product 2.4 Low
- jcd windu cms Weak password hashing in Windu CMS 6.3 Medium
- tp-link deco m5 firmware, tp-link systems inc. deco m5 deco m5 v1 +1 more Weak Password Hashing Mechanism in TP-Link Deco M5 7.1 High
- frontaccounting FrontAccounting < 2.4.20 SQL Injection via rep601.php 7.1 High
- kestra Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack 8.7 High
- arodland crypt::pbkdf2 Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations 5.3 Medium
- qloapps QloApps 1.7.0 Weak Password Hashing via MD5 in Tools.php 8.2 High
- danelec macgregor voyage data recorder (vdr) g4e, macgregor interschalt vdr g4e firmware +1 more MacGregor Voyage Data Recorder (VDR) G4e Use of Password Hash With Insufficient Computational Effort 5.9 Medium
- labredescefetrj wegia WeGIA: Use of Weak Password Hashing Algorithm (SHA-256, no salt) in html/login.php 5.9 Medium
- mesalvo meona client, meona server +1 more Cleartext Storage of Sensitive Information in Memory vulnerability in Mesalvo Meona Client... 4.4 Medium
- electerm electerm's encrypt method not safe enough 6.0 Medium
-
litellmPyPI LiteLLM: Password hash exposure and pass-the-hash authentication bypass 8.6 High - flowise Flowise - Insufficient Password Salt Rounds in Bcrypt Hashing 5.6 Medium
- rustdesk, rustdesk-client rustdesk client +1 more RustDesk Encrypts Local Passwords with World-Readable Machine ID and Fixed Zero Nonce (XSalsa20-Poly1305) 8.2 High
- rustdesk, rustdesk-client rustdesk client +1 more RustDesk Auth Proof Uses Server-Controlled Salt/Challenge and Fast Double-SHA256, Enabling Offline Brute-Force 5.7 Medium
- ritecms RiteCMS v3.1.0 was discovered to use insecure encryption to store passwords. 5.3 Medium
- fortra core privileged access manager (boks) Weak Password Hash in Core Privileged Access Manager (BoKS) 6.2 Medium
- phoenix contact fl nat 2008, fl nat 2208, fl nat 2304-2gc-2sfp +134 more +136 more Weak/Predictable root Password 6.8 Medium
- buffalo inc. wsr-1800ax4, wsr-1800ax4-kh, wsr-1800ax4b +1 more +3 more Use of password hash with insufficient computational effort issue exists in BUFFALO Wi-Fi router ... 5.3 Medium
- suse neuvector NeuVector has an insecure password storage vulnerable to rainbow attack 5.3 Medium
- xuxueli xxl-job Xuxueli xxl-job Token Generation IndexController.java makeToken weak password hash 6.3 Medium
-
taylorednpm Taylored webhook validation vulnerabilities No score - tridium niagara, niagara enterprise security, niagara framework +2 more Use of Password Hash with Insufficient Computational Effort 7.7 High
- bosch rexroth ag ctrlx os - device admin A vulnerability in the users configuration file of ctrlX OS may allow a remote authenticated (low... 6.5 Medium
- Show olderLoading…