CWE-916 · Use of Password Hash With Insufficient Computational Effort (page 2)
Page 2 of 2 — CVEs classified under CWE-916, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-19735 | Critical | 9.1 | 2019-12-30 | class.userpeer.php in MFScripts YetiShare 3.5.2 through 4.5.3 uses an insecure method of creating password reset hashes (based only on microtime), which allows… |
CVE-2019-20138 | High | 7.5 | 2019-12-30 | The HTTP Authentication library before 2019-12-27 for Nim has weak password hashing because the default algorithm for libsodium's crypto_pwhash_str is not used. |
CVE-2019-19766 | High | 7.5 | 2019-12-12 | The Bitwarden server through 1.32.0 has a potentially unwanted KDF. |
CVE-2014-0083 | Medium | 5.5 | 2019-11-21 | The Ruby net-ldap gem before 0.11 uses a weak salt when generating SSHA passwords. |
CVE-2010-2450 | High | 7.5 | 2019-11-07 | The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key… |
CVE-2019-17216 | Critical | 9.8 | 2019-10-06 | An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. Password authentication uses MD5 to hash passwords. Cracking… |
CVE-2019-12737 | Medium | 5.3 | 2019-10-02 | UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing user credentials. |
CVE-2019-6563 | Critical | 9.8 | 2019-03-05 | Moxa IKS and EDS generate a predictable cookie calculated with an MD5 hash, allowing an attacker to capture the administrator's password, which could lead to a… |
CVE-2019-7649 | High | 7.5 | 2019-02-17 | global.encryptPassword in bootstrap/global.js in CMSWing 1.3.7 relies on multiple MD5 operations for password hashing. |
CVE-2019-3907 | High | 7.5 | 2019-01-18 | Premisys Identicard version 3.1.190 stores user credentials and other sensitive information with a known weak encryption method (MD5 hash of a salt and passwor… |
CVE-2019-0030 | High | 7.2 | 2019-01-15 | Juniper ATP uses DES and a hardcoded salt for password hashing, allowing for trivial de-hashing of the password file contents. This issue affects Juniper ATP 5… |
CVE-2018-13811 | Medium | 5.5 | 2018-12-13 | A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) (All Versions < V15.1). Password hashes with insufficient computational effort could allow a… |
CVE-2018-15717 | Medium | 5.3 | 2018-12-12 | Open Dental before version 18.4 stores user passwords as base64 encoded MD5 hashes. |
CVE-2018-15681 | Critical | 9.8 | 2018-09-05 | An issue was discovered in BTITeam XBTIT 2.5.4. When a user logs in, their password hash is rehashed using a predictable salt and stored in the "pass" cookie… |
CVE-2018-15680 | Critical | 9.8 | 2018-09-05 | An issue was discovered in BTITeam XBTIT 2.5.4. The hashed passwords stored in the xbtit_users table are stored as unsalted MD5 hashes, which makes it easier f… |
CVE-2018-10618 | Critical | 9.8 | 2018-08-01 | Davolink DVW-3200N all version prior to Version 1.00.06. The device generates a weak password hash that is easily cracked, allowing a remote attacker to obtain… |
CVE-2017-3962 | Medium | 5.6 | 2018-06-12 | Password recovery exploitation vulnerability in the non-certificate-based authentication mechanism in McAfee Network Security Management (NSM) before 8.2.7.42… |
CVE-2018-9233 | High | 7.8 | 2018-04-05 | Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xml, which makes it e… |
CVE-2018-1447 | Medium | 5.1 | 2018-04-04 | The GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6) CMS KDB logic fails to salt the hash function resultin… |
CVE-2017-11131 | Medium | 5.9 | 2017-08-01 | An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. For authentication, the… |
CVE-2014-2354 | | 2014-05-30 | Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords vi… | |
CVE-2008-1526 | High | 7.5 | 2008-03-26 | ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(PE9) and 3.40(AGD.2) through 3.40(AHQ.3), do not use a salt when calculatin… |
CVE-2006-1058 | Medium | 5.5 | 2006-04-04 | BusyBox 1.1.1 does not use a salt when generating passwords, which makes it easier for local users to guess passwords from a stolen password file using techniq… |
CVE-2005-0408 | Critical | 9.8 | 2005-02-14 | CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the id_hash cookie, which allows remote attackers to bypass authenticat… |
CVE-2002-1657 | High | 7.5 | 2002-12-31 | PostgreSQL uses the username for a salt when generating passwords, which makes it easier for remote attackers to guess passwords via a brute force attack. |
CVE-2001-0967 | Critical | 9.8 | 2001-08-31 | Knox Arkeia server 4.2, and possibly other versions, uses a constant salt when encrypting passwords using the crypt() function, which makes it easier for an at… |