Use of Password Hash With Insufficient Computational Effort

Every one of the 127 is a mark on the map. Named now: 1 to 26, most at risk first.

1. BigAnt Server 5.6.06 - Improper Access ControlCVE-2022-23348Bigantsoft · 3.3% likely

   Bigantsoft

2. Davolink DVW-3200N all version prior to Version 1.00.06. The device generates a weak password hash that is easily cracked, allowing a remote attacker to obtain the password for th…CVE-2018-10618Davolink · 10.0% likely
3. CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the id_hash cookie, which allows remote attackers to bypass authentication and gain privile…CVE-2005-0408Citrusdb · 4.7% likely

   Citrusdb

4. RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext passw…CVE-2023-33243Starface · CVSS 8.1 · 4.4% likely
5. In Rockwell Automation FactoryTalk Services Platform Versions 6.10.00 and 6.11.00, there is an issue with the implementation of the SHA-256 hashing algorithm with FactoryTalk Serv…CVE-2020-14516Rockwellautomation · 4.2% likely

   Rockwell Automation

6. A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versio…CVE-2024-21754Fortinet · CVSS 1.7 · 3.5% likely

   Fortinet

7. Freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute forceCVE-2024-3183Redhat · CVSS 8.1 · 2.1% likely

   Red Hat

8. Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 stores administrative passwords using a hash that is considered outdated.CVE-2020-27693Trend Micro · 1.8% likely

   Trend Micro

9. The PhonerLite phone before 2.15 provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for remote attackers to obtain access via…CVE-2014-2560Phoner · 1.7% likely
10. Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xml, which makes it easier for attackers…CVE-2018-9233Sophos · 1.7% likely

    Sophos

11. An issue was discovered on Enphase Envoy R3.x and D4.x devices. There is a custom PAM module for user authentication that circumvents traditional user authentication. This module…CVE-2020-25754Enphase · 1.4% likely

    Enphase

12. The Bitwarden server through 1.32.0 has a potentially unwanted KDF.CVE-2019-19766Bitwarden · 1.3% likely

    Bitwarden

13. PostgreSQL uses the username for a salt when generating passwords, which makes it easier for remote attackers to guess passwords via a brute force attack.CVE-2002-1657Postgresql · CVSS 7.5 · 1.3% likely

    Postgresql

14. Knox Arkeia server 4.2, and possibly other versions, uses a constant salt when encrypting passwords using the crypt() function, which makes it easier for an attacker to conduct br…CVE-2001-0967Arkeia · 1.0% likely
15. password_verify() always returns true for some invalid hashesCVE-2023-0567PHP Group · CVSS 7.7 · 0.9% likely

    PHP

16. The GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6) CMS KDB logic fails to salt the hash function resulting in weaker than exp…CVE-2018-1447IBM · CVSS 5.1 · 0.9% likely

    IBM

17. global.encryptPassword in bootstrap/global.js in CMSWing 1.3.7 relies on multiple MD5 operations for password hashing.CVE-2019-7649Cmswing · 0.9% likely

    Cmswing

18. ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(PE9) and 3.40(AGD.2) through 3.40(AHQ.3), do not use a salt when calculating an MD5 password ha…CVE-2008-1526Zyxel · 0.9% likely

    Zyxel

19. All Bachmann M1 System Processor Modules - Use of Password Hash with Insufficient Computational EffortCVE-2020-16231Bachmann Electronic, GmbH · CVSS 7.2 · 0.9% likely
20. Fluxbb 1.5.11 is affected by a denial of service (DoS) vulnerability by sending an extremely long password via the user login form. When a long password is sent, the password hash…CVE-2020-28873Fluxbb · 0.9% likely

    Fluxbb

21. QSAN Storage Manager, XEVO, SANOS - Use of Password Hash With Insufficient Computational EffortCVE-2021-32519QSAN · CVSS 9.8 · 0.9% likely

    QSAN

22. The HTTP Authentication library before 2019-12-27 for Nim has weak password hashing because the default algorithm for libsodium's crypto_pwhash_str is not used.CVE-2019-20138Http Authentication Library Project · 0.8% likely
23. USE OF PASSWORD HASH WITH INSUFFICIENT COMPUTATIONAL EFFORT CWE-916CVE-2020-14512Secomea · CVSS 8.1 · 0.8% likely

    Secomea

24. It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account console, allowing access and modificati…CVE-2020-14389Redhat · 0.8% likely

    Red Hat

25. Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username. This might make brute-force attacks easi…CVE-2021-33563Koel · 0.8% likely

    Koel

26. A CWE-759: Use of a One-Way Hash without a Salt vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 al…CVE-2021-22774Schneider-Electric · 0.8% likely

    Schneider Electric

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.