CWE-916 · Use of Password Hash With Insufficient Computational Effort
120 CVEs classified under CWE-916 (Use of Password Hash With Insufficient Computational Effort). Browse by severity and year.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-14516 | Critical | 10.0 | 2021-03-18 | In Rockwell Automation FactoryTalk Services Platform Versions 6.10.00 and 6.11.00, there is an issue with the implementation of the SHA-256 hashing algorithm w… |
CVE-2026-30789 | Critical | 9.8 | 2026-03-05 | Use of Password Hash With Insufficient Computational Effort, Improper Restriction of Excessive Authentication Attempts vulnerability in rustdesk-client RustDes… |
CVE-2024-5743 | Critical | 9.8 | 2025-01-13 | An attacker could exploit the 'Use of Password Hash With Insufficient Computational Effort' vulnerability in EveHome Eve Play to execute arbitrary code. This… |
CVE-2022-37164 | Critical | 9.8 | 2022-09-08 | Inoda OnTrack v3.4 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Ad… |
CVE-2022-37163 | Critical | 9.8 | 2022-09-08 | Bminusl IHateToBudget v1.5.7 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force a… |
CVE-2021-36767 | Critical | 9.8 | 2021-10-08 | In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the server password, making the protection inef… |
CVE-2021-32519 | Critical | 9.8 | 2021-07-07 | Use of password hash with insufficient computational effort vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to recover the plain-tex… |
CVE-2019-17216 | Critical | 9.8 | 2019-10-06 | An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. Password authentication uses MD5 to hash passwords. Cracking… |
CVE-2019-6563 | Critical | 9.8 | 2019-03-05 | Moxa IKS and EDS generate a predictable cookie calculated with an MD5 hash, allowing an attacker to capture the administrator's password, which could lead to a… |
CVE-2018-15681 | Critical | 9.8 | 2018-09-05 | An issue was discovered in BTITeam XBTIT 2.5.4. When a user logs in, their password hash is rehashed using a predictable salt and stored in the "pass" cookie… |
CVE-2018-15680 | Critical | 9.8 | 2018-09-05 | An issue was discovered in BTITeam XBTIT 2.5.4. The hashed passwords stored in the xbtit_users table are stored as unsalted MD5 hashes, which makes it easier f… |
CVE-2018-10618 | Critical | 9.8 | 2018-08-01 | Davolink DVW-3200N all version prior to Version 1.00.06. The device generates a weak password hash that is easily cracked, allowing a remote attacker to obtain… |
CVE-2005-0408 | Critical | 9.8 | 2005-02-14 | CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the id_hash cookie, which allows remote attackers to bypass authenticat… |
CVE-2001-0967 | Critical | 9.8 | 2001-08-31 | Knox Arkeia server 4.2, and possibly other versions, uses a constant salt when encrypting passwords using the crypt() function, which makes it easier for an at… |
CVE-2026-45787 | Critical | 9.1 | 2026-05-28 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.9.5, deterministic AES-192-CBC with a fixed zero IV, const… |
CVE-2023-46233 | Critical | 9.1 | 2023-10-25 | crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at… |
CVE-2023-46133 | Critical | 9.1 | 2023-10-25 | CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript. Prior to version 2.1.0, CryptoES PBKDF2 is 1,000 times weaker than originally… |
CVE-2019-19735 | Critical | 9.1 | 2019-12-30 | class.userpeer.php in MFScripts YetiShare 3.5.2 through 4.5.3 uses an insecure method of creating password reset hashes (based only on microtime), which allows… |
CVE-2026-55069 | High | 8.7 | 2026-06-26 | Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kest… |
CVE-2023-5846 | High | 8.3 | 2023-11-02 | Franklin Fueling System TS-550 versions prior to 1.9.23.8960 are vulnerable to attackers decoding admin credentials, resulting in unauthenticated access to th… |