CWE-916: Use of Password Hash With Insufficient Computational Effort
The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
A kind of CWE-328 Use of Weak Hash.
From the CWE List. © The MITRE Corporation.
Newest
- ibm security key lifecycle manager, security guardium key lifecycle manager +1 moreIBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses a one-way cryptographic hash...4.4 Medium
- enrocrypt project enrocryptUse of Password Hash With Insufficient Computational Effort and Use of a Broken or Risky Cryptographic Algorithm and Reversible One-Way Hash in hashing.py7.5 High
- digi realport, 6350-sr firmware, cm firmware +16 more +18 moreIn Digi RealPort through 4.8.488.0, authentication relies on a challenge-response mechanism that...9.8 Critical
- boston scientific zoom latitude, bostonscientific zoom latitude pogrammer\/recorder\/monitor 3120 firmware +1 moreUse of Password Hash with Insufficient Computational Effort for Boston Scientific Zoom Latitude6.9 Medium
- bosch rexroth indramotion mlc firmware, rexroth indramotion xlc firmware, rexroth indramotion mlc indramotion xlc +2 moreInformation disclosure8.6 High
- redux.io gutenberg template library & redux framework, redux gutenberg template library \& redux framework +1 moreGutenberg Template Library & Redux Framework <= 4.2.11 Sensitive Information Disclosure5.3 Medium
- deltaww diaenergieDelta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to retrieve passwords...5.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2021.2.16363, system user passwords were hashed with SHA-256.5.3 Medium
- fortinet fortiportalA use of one-way hash with a predictable salt vulnerability in the password storing mechanism of...6.0 Medium
- schneider-electric evlink city evc1s22p4 firmware, evlink city evc1s7p4 firmware, evlink parking ev.2 firmware +3 more +5 moreA CWE-759: Use of a One-Way Hash without a Salt vulnerability exists in EVlink City (EVC1S22P4 /...7.5 High
- dell storage manager, qsan sanos, xevo +2 moreQSAN Storage Manager, XEVO, SANOS - Use of Password Hash With Insufficient Computational Effort9.8 Critical
- enphase envoy firmwareAn issue was discovered on Enphase Envoy R3.x and D4.x devices. There is a custom PAM module for...7.5 High
- schneider-electric clearscada, ecostruxure geo scada expert 2019, ecostruxure geo scada expert 2020 +2 moreUse of Password Hash with Insufficient Computational Effort vulnerability exists in ClearSCADA ...6.7 Medium
- koelImproper rate limiting in Koel7.5 High
- sannce smart hd wifi security camera ean 2 950004 595317 firmwareAn issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. A...7.8 High
- rockwellautomation factorytalk services platformIn Rockwell Automation FactoryTalk Services Platform Versions 6.10.00 and 6.11.00, there is an...10.0 Critical
- fluxbbFluxbb 1.5.11 is affected by a denial of service (DoS) vulnerability by sending an extremely long...7.5 High
- epikurAn issue was discovered in Epikur before 20.1.1. It stores the secret passwords of the users as...5.5 Medium
- bosch fsm-2500, fsm-5000, fsm-2500 firmware +1 more +3 morePassword Hash With Insufficient Computational Effort in the Database of Bosch FSM-2500 Server and Bosch FSM-5000 Server4.4 Medium
- dbijaya onlinevotingsystemUse of a One-Way Hash without a Salt in OnlineVotingSystem5.8 Medium
- keycloakImproper privilege management in Keycloak8.1 High
- trend micro interscan messaging security virtual appliance (imsva), trendmicro interscan messaging security virtual appliance +1 moreTrend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 stores administrative...4.4 Medium
- domainmodDomainMOD before 4.14.0 uses MD5 without a salt for password storage.7.5 High
- actions-micro ezcast pro ii firmwareIn EZCast Pro II, the administrator password md5 hash is provided upon a web request. This hash...6.5 Medium
- secomea gatemanager, gatemanager 8250 firmware +1 moreUSE OF PASSWORD HASH WITH INSUFFICIENT COMPUTATIONAL EFFORT CWE-9168.1 High
- siemens sicam t, siemens ag sicam mmu, sicam sgu +3 more +5 moreA vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions)...5.5 Medium
- mattermost serverMattermost Server uses weak hashing for OAuth, email verification tokens and invitations7.5 High
- intel converged security management engine firmwareReversible one-way hash in Intel(R) CSME versions before 11.8.76, 11.12.77 and 11.22.77 may allow...6.7 Medium
- google androidAn issue was discovered on Samsung mobile devices with P(9.0) software. The WPA3 handshake...5.4 Medium
- google gizmo5The SIP implementation on the Gizmo5 software phone provides hashed credentials in a response to...7.5 High
- phoner phonerliteThe PhonerLite phone before 2.15 provides hashed credentials in a response to an invalid...7.5 High
- mfscripts yetishareMFScripts YetiShare v3.5.2 through v4.5.4 might allow an attacker to reset a password by using a...9.8 Critical
- mfscripts yetishareclass.userpeer.php in MFScripts YetiShare 3.5.2 through 4.5.3 uses an insecure method of creating...9.1 Critical
- http authentication library project authentication libraryThe HTTP Authentication library before 2019-12-27 for Nim has weak password hashing because the...7.5 High
- bitwarden serverThe Bitwarden server through 1.32.0 has a potentially unwanted KDF.7.5 High
- net-ldap project net-ldap, debian linux, ruby-net-ldap +2 morenet-ldap has weak salt when generating passwords5.5 Medium
- debian linux, shibboleth service provider +1 moreThe keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses...7.5 High
- vzug combi-stream mslq firmwareAn issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05...9.8 Critical
- jetbrains ktorUserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a...5.3 Medium
- ics-cert moxa iks, eds, moxa eds-405a firmware, eds-408a firmware +2 more +4 moreMoxa IKS and EDS generate a predictable cookie calculated with an MD5 hash, allowing an attacker...9.8 Critical
- cmswingglobal.encryptPassword in bootstrap/global.js in CMSWing 1.3.7 relies on multiple MD5 operations...7.5 High
- identicard premisys idPremisys Identicard version 3.1.190 stores user credentials and other sensitive information with...7.5 High
- juniper networks atp, juniper advanced threat prevention firmware +1 moreJuniper ATP: Password hashing uses DES and a hardcoded salt6.7 Medium
- siemens simatic step 7 (tia portal), simatic step 7 \(tia portal\) +1 moreA vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) (All Versions < V15.1)....5.5 Medium
- open dental dental, opendental +1 moreOpen Dental before version 18.4 stores user passwords as base64 encoded MD5 hashes.5.3 Medium
- btiteam xbtitAn issue was discovered in BTITeam XBTIT 2.5.4. When a user logs in, their password hash is...9.8 Critical
- btiteam xbtitAn issue was discovered in BTITeam XBTIT 2.5.4. The hashed passwords stored in the xbtit_users...9.8 Critical
- davolink dvw-3200n, dvw-3200n firmware +1 moreDavolink DVW-3200N all version prior to Version 1.00.06. The device generates a weak password...9.8 Critical
- mcafee network security management (nsm), network security manager +1 moreMcAfee Network Security Management (NSM) - Password recovery exploitation vulnerability5.6 Medium
- sophos endpoint protectionSophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%...7.8 High
- Show moreLoading…