CWE-916: Use of Password Hash With Insufficient Computational Effort
The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
A kind of CWE-328 Use of Weak Hash.
From the CWE List. © The MITRE Corporation.
Newest
- ibm spectrum protect, spectrum protect snapshot, spectrum protect for space management +1 more +3 moreThe GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and...5.1 Medium
- stashcat heinekingmediaAn issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for...5.9 Medium
- cogent datahub, cogentdatahub cogent datahub +1 moreCogent DataHub Use of Password Hash With Insufficient Computational Effort6.0
- apache derbyUse of Password Hash With Insufficient Computational Effort in Apache Derby2.1 Low
- zyxel p-660h-61 firmware, p-660h-63 firmware, p-660h-67 firmware +16 more +18 moreZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(PE9) and 3.40...7.5 High
- busybox, avaya aura application enablement services, aura sip enablement services +2 more +4 moreBusyBox 1.1.1 does not use a salt when generating passwords, which makes it easier for local...5.5 Medium
- citrusdbCitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the...9.8 Critical
- postgresqlPostgreSQL uses the username for a salt when generating passwords, which makes it easier for...7.5 High
- arkeiaKnox Arkeia server 4.2, and possibly other versions, uses a constant salt when encrypting...9.8 Critical