CWE-916: Use of Password Hash With Insufficient Computational Effort
The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
A kind of CWE-328 Use of Weak Hash.
From the CWE List. © The MITRE Corporation.
Newest
- wreis dbix::class::encodedcolumnDBIx::Class::EncodedColumn until 0.00032 for Perl uses insecure rand() function for salting password hashes in Crypt/Eksblowfish/Bcrypt.pm4.0 Medium
- wreis dbix::class::encodedcolumnDBIx::Class::EncodedColumn until 0.00032 for Perl uses insecure rand() function for salting password hashes in Digest.pm4.0 Medium
- beta80 life 1stUse of a Broken or Risky Cryptographic Algorithm, Use of Password Hash With Insufficient...6.0 Medium
- iroad dash cam fx2, iroadau fx2 firmware +1 moreIROAD Dash Cam FX2 Password Hash passwd weak password hash2.3 Low
- santesoft sante pacs serverSantesoft Sante PACS Server HTTP.db SHA1 Hash Truncation7.8 High
- ibm security verify governanceIBM Security Verify Governance information disclosure4.4 Medium
- evehome eve playCommand Injection Vulnerability9.8 Critical
- phpgurukul online birth certificate systemPhpgurukul Online Birth Certificate System 1.0 suffers from insufficient password requirements...5.4 Medium
- percona percona-toolkit, toolkit +1 moreMisuse of SHA256 to create an encryption key5.1 Medium
- digitaldruid hoteldruidWeak password hashing using MD5 in funzioni.php in HotelDruid before 1.32 allows an attacker to...7.5 High
- bluditBludit uses SHA1 as Password Hashing Algorithm5.9 Medium
- fortinet fortios, fortiproxy +1 moreA use of password hash with insufficient computational effort vulnerability [CWE-916] affecting...1.7 Low
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +16 more +18 moreFreeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force8.1 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted6.8 Medium
- serverpodImproved security for stored password hashes5.3 Medium
- kirillmakarov musicshelfMusicshelf SHA-1 PinningTrustManager.java weak password hash1.6 Low
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal defaults to a low work factor for the default password hashing algorithm8.1 High
- priva top control suite, topcontrol suite - bacnet, topcontrol suite - blue id +3 more +5 morePredictable SSH credentials in Priva TopControl Suite7.5 High
- franklin fueling system ts-550, franklinfueling ts-550 evo, ts-550 evo firmware +2 moreUse of Password Hash With Insufficient Computational Effort in Franklin Fueling System TS-5508.3 High
- brix crypto-jscrypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard9.1 Critical
- entronad crypto-es, cryptoes +1 morecrypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard9.1 Critical
- ormazabal ekorccp, ekorrci, ekorccp firmware +1 more +3 moreUse of Password Hash With Insufficient Computational Effort in Ormazabal products6.1 Medium
- supcon inplant scadaSupcon InPlant SCADA Project.xml unknown vulnerability2.5 Low
- perrymitchell buttercupButtercup allows attackers to obtain the hash of the master password5.3 Medium
- sick lms5xx, lms500 firmware, lms511 firmware +1 more +3 moreThe LMS5xx uses weak hash generation methods, resulting in the creation of insecure hashs. If an...7.5 High
- piigab m-bus softwarepack, m-bus 900s, m-bus 900s firmware +2 morePiiGAB M-Bus Use of Password Hash With Insufficient Computational Effort7.5 High
- starfaceRedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows...8.1 High
- codeigniter shieldCodeIgniter Shield Password Shucking Vulnerability7.5 High
- fortinet fortisandboxA use of password hash with insufficient computational effort vulnerability [CWE-916] in...5.4 Medium
- phppassword_verify() always returns true for some invalid hashes7.7 High
- ami megarac spx-12, megarac spx-13 +1 moreWeak password hashes for Redfish & API5.3 Medium
- yeastar n412 firmware, n824 firmware +1 moreIn Yeastar N412 and N824 Configuration Panel 42.x and 45.x, an unauthenticated attacker can...7.5 High
- codesys v3 containing the cmpusermgr, control for beaglebone, control for empc-a\/imx6 +62 more +64 moreCODESYS V3 prone to Inadequate Password Hashing7.8 High
ibexa/graphqlPackagistGraphQL queries can expose password hashesNo score- php point of sale point of sale, phppointofsale php point of sale +1 moreAuthenticated sensitive information disclosure in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.4.9 Medium
- ontrack project ontrackInoda OnTrack v3.4 employs a weak password policy which allows attackers to potentially gain...9.8 Critical
- ihatetobudget project ihatetobudgetBminusl IHateToBudget v1.5.7 employs a weak password policy which allows attackers to potentially...9.8 Critical
- drakkan sftpgoRecovery codes abuse in SFTPGo8.3 High
- dpgaspar flask-appbuilderPossible to infer sensitive information through query strings in Flask-AppBuilder2.7 Low
- ict protege gx firmware, protege wx firmware +1 moreAn access control issue in ICT Protege GX/WX 2.08 allows attackers to leak SHA1 password hashes...4.3 Medium
- bentley nevada, a baker hughes subsidiary 3500 rack configuration, part no. 129133-01, 3500 system 1 6.x, part no. 3060/00, 3500 system 1, part no. 3071/xx & 3072/xx +6 more +8 moreBaker Hughes Bently Nevada 3500 - Use of Password Hash with Insufficient Computational Effort8.2 High
- bachmann cpc210 firmware, cs200 firmware, mc205 firmware +37 more +39 moreAll Bachmann M1 System Processor Modules - Use of Password Hash with Insufficient Computational Effort7.2 High
- siemens desigo dxr2, desigo pxc3, desigo pxc4 +5 more +7 moreA vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 ...6.5 Medium
- fortinet fortiwanA use of a one-way hash with a predictable salt vulnerability [CWE-760] in FortiWAN before 4.5.9...6.2 Medium
- livehelperchat livehelperchat/livehelperchat, live helper chat +1 moreWeak secrethash can be brute-forced in livehelperchat/livehelperchat7.5 High
- mitsubishielectric fx5uc-32mr\/ds-ts firmware, fx5uc-32mt\/d firmware, fx5uc-32mt\/ds-ts firmware +13 more +15 moreUse of Password Hash Instead of Password for Authentication vulnerability in Mitsubishi Electric...9.1 Critical
- mitsubishielectric fx5uc-32mr\/ds-ts firmware, fx5uc-32mt\/d firmware, fx5uc-32mt\/ds-ts firmware +13 more +15 moreUse of Weak Hash vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions...8.1 High
- bigantsoft bigant serverBigAnt Software BigAnt Server v5.6.06 was discovered to utilize weak password hashes.5.3 Medium
- palo alto networks pan-os, prisma access +1 morePAN-OS: Use of a Weak Cryptographic Algorithm for Stored Password Hashes4.1 Medium
- myscada mypromySCADA myPRO7.5 High
- Show moreLoading…