CWE-916 · Use of Password Hash With Insufficient Computational Effort (page 2)
Page 2 of 2 — CVEs classified under CWE-916, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-14516 | Critical | 10.0 | 2021-03-18 | In Rockwell Automation FactoryTalk Services Platform Versions 6.10.00 and 6.11.00, there is an issue with the implementation of the SHA-256 hashing algorithm w… |
CVE-2020-28873 | High | 7.5 | 2021-03-17 | Fluxbb 1.5.11 is affected by a denial of service (DoS) vulnerability by sending an extremely long password via the user login form. When a long password is sen… |
CVE-2020-10538 | Medium | 5.5 | 2021-02-05 | An issue was discovered in Epikur before 20.1.1. It stores the secret passwords of the users as MD5 hashes in the database. MD5 can be brute-forced efficiently… |
CVE-2020-6780 | Medium | 4.4 | 2021-01-26 | Use of Password Hash With Insufficient Computational Effort in the database of Bosch FSM-2500 server and Bosch FSM-5000 server up to and including version 5.2… |
CVE-2021-21253 | Medium | 5.8 | 2021-01-21 | OnlineVotingSystem is an open source project hosted on GitHub. OnlineVotingSystem before version 1.1.2 hashes user passwords without a salt, which is vulnerabl… |
CVE-2020-14389 | High | 8.1 | 2020-11-17 | It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account console, allowing a… |
CVE-2020-27693 | Medium | 4.4 | 2020-11-09 | Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 stores administrative passwords using a hash that is considered outdated. |
CVE-2019-9080 | High | 7.5 | 2020-10-20 | DomainMOD before 4.14.0 uses MD5 without a salt for password storage. |
CVE-2020-14512 | High | 8.1 | 2020-08-25 | GateManager versions prior to 9.2c, The affected product uses a weak hash type, which may allow an attacker to view user passwords. |
CVE-2020-10040 | Medium | 5.5 | 2020-07-14 | A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). An attacker with local acces… |
CVE-2017-18917 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification token… |
CVE-2019-20575 | Medium | 5.4 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) software. The WPA3 handshake feature allows a downgrade or dictionary attack. The Samsung ID is S… |
CVE-2014-2560 | High | 7.5 | 2020-02-12 | The PhonerLite phone before 2.15 provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for remote attackers t… |
CVE-2009-5139 | High | 7.5 | 2020-02-12 | The SIP implementation on the Gizmo5 software phone provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for… |
CVE-2019-19735 | Critical | 9.1 | 2019-12-30 | class.userpeer.php in MFScripts YetiShare 3.5.2 through 4.5.3 uses an insecure method of creating password reset hashes (based only on microtime), which allows… |
CVE-2019-20138 | High | 7.5 | 2019-12-30 | The HTTP Authentication library before 2019-12-27 for Nim has weak password hashing because the default algorithm for libsodium's crypto_pwhash_str is not used. |
CVE-2019-19766 | High | 7.5 | 2019-12-12 | The Bitwarden server through 1.32.0 has a potentially unwanted KDF. |
CVE-2014-0083 | Medium | 5.5 | 2019-11-21 | The Ruby net-ldap gem before 0.11 uses a weak salt when generating SSHA passwords. |
CVE-2010-2450 | High | 7.5 | 2019-11-07 | The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key… |
CVE-2019-17216 | Critical | 9.8 | 2019-10-06 | An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. Password authentication uses MD5 to hash passwords. Cracking… |
CVE-2019-12737 | Medium | 5.3 | 2019-10-02 | UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing user credentials. |
CVE-2019-6563 | Critical | 9.8 | 2019-03-05 | Moxa IKS and EDS generate a predictable cookie calculated with an MD5 hash, allowing an attacker to capture the administrator's password, which could lead to a… |
CVE-2019-7649 | High | 7.5 | 2019-02-17 | global.encryptPassword in bootstrap/global.js in CMSWing 1.3.7 relies on multiple MD5 operations for password hashing. |
CVE-2019-3907 | High | 7.5 | 2019-01-18 | Premisys Identicard version 3.1.190 stores user credentials and other sensitive information with a known weak encryption method (MD5 hash of a salt and passwor… |
CVE-2019-0030 | High | 7.2 | 2019-01-15 | Juniper ATP uses DES and a hardcoded salt for password hashing, allowing for trivial de-hashing of the password file contents. This issue affects Juniper ATP 5… |
CVE-2018-13811 | Medium | 5.5 | 2018-12-13 | A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) (All Versions < V15.1). Password hashes with insufficient computational effort could allow a… |
CVE-2018-15717 | Medium | 5.3 | 2018-12-12 | Open Dental before version 18.4 stores user passwords as base64 encoded MD5 hashes. |
CVE-2018-15681 | Critical | 9.8 | 2018-09-05 | An issue was discovered in BTITeam XBTIT 2.5.4. When a user logs in, their password hash is rehashed using a predictable salt and stored in the "pass" cookie… |
CVE-2018-15680 | Critical | 9.8 | 2018-09-05 | An issue was discovered in BTITeam XBTIT 2.5.4. The hashed passwords stored in the xbtit_users table are stored as unsalted MD5 hashes, which makes it easier f… |
CVE-2018-10618 | Critical | 9.8 | 2018-08-01 | Davolink DVW-3200N all version prior to Version 1.00.06. The device generates a weak password hash that is easily cracked, allowing a remote attacker to obtain… |
CVE-2017-3962 | Medium | 5.6 | 2018-06-12 | Password recovery exploitation vulnerability in the non-certificate-based authentication mechanism in McAfee Network Security Management (NSM) before 8.2.7.42… |
CVE-2018-9233 | High | 7.8 | 2018-04-05 | Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xml, which makes it e… |
CVE-2018-1447 | Medium | 5.1 | 2018-04-04 | The GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6) CMS KDB logic fails to salt the hash function resultin… |
CVE-2017-11131 | Medium | 5.9 | 2017-08-01 | An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. For authentication, the… |
CVE-2014-2354 | | 2014-05-30 | Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords vi… | |
CVE-2008-1526 | High | 7.5 | 2008-03-26 | ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(PE9) and 3.40(AGD.2) through 3.40(AHQ.3), do not use a salt when calculatin… |
CVE-2006-1058 | Medium | 5.5 | 2006-04-04 | BusyBox 1.1.1 does not use a salt when generating passwords, which makes it easier for local users to guess passwords from a stolen password file using techniq… |
CVE-2005-0408 | Critical | 9.8 | 2005-02-14 | CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the id_hash cookie, which allows remote attackers to bypass authenticat… |
CVE-2002-1657 | High | 7.5 | 2002-12-31 | PostgreSQL uses the username for a salt when generating passwords, which makes it easier for remote attackers to guess passwords via a brute force attack. |
CVE-2001-0967 | Critical | 9.8 | 2001-08-31 | Knox Arkeia server 4.2, and possibly other versions, uses a constant salt when encrypting passwords using the crypt() function, which makes it easier for an at… |