CWE-916 · Cryptography
Use of Password Hash With Insufficient Computational Effort
127CVEs
SortMost likely exploited
127 CVEs with CWE-916 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2022-23348CheckBigAnt Server 5.6.06 - Improper Access ControlBigantsoft · Bigant Server · 2022-03-21 | – | 3.3% | 2022-03-21 |
| CVE-2018-10618Davolink DVW-3200N all version prior to Version 1.00.06. The device generates a weak password hash that is easily cracked, allowing a remote attacker to obtain the password for th…Davolink · DVW-3200N · 2018-08-01 | – | 10.0% | 2018-08-01 |
| CVE-2005-0408CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the id_hash cookie, which allows remote attackers to bypass authentication and gain privile…Citrusdb · Citrusdb · 2005-02-16 | – | 4.7% | 2005-02-16 |
| CVE-2023-33243RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext passw…Starface · Starface · CVSS 8.1 · 2023-06-15 | 8.1 | 4.4% | 2023-06-15 |
| CVE-2020-14516In Rockwell Automation FactoryTalk Services Platform Versions 6.10.00 and 6.11.00, there is an issue with the implementation of the SHA-256 hashing algorithm with FactoryTalk Serv…Rockwellautomation · Rockwell Automation FactoryTalk Services Platform · 2021-03-18 | – | 4.2% | 2021-03-18 |
| CVE-2024-21754A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versio…Fortinet · FortiProxy · CVSS 1.7 · 2024-06-11 | 1.7 | 3.5% | 2024-06-11 |
| CVE-2024-3183Freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute forceRedhat · freeipa · CVSS 8.1 · 2024-06-12 | 8.1 | 2.1% | 2024-06-12 |
| CVE-2020-27693Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 stores administrative passwords using a hash that is considered outdated.Trend Micro · Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) · 2020-11-09 | – | 1.8% | 2020-11-09 |
| CVE-2014-2560The PhonerLite phone before 2.15 provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for remote attackers to obtain access via…Phoner · Phonerlite · 2020-02-12 | – | 1.7% | 2020-02-12 |
| CVE-2018-9233Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xml, which makes it easier for attackers…Sophos · Endpoint Protection · 2018-04-05 | – | 1.7% | 2018-04-05 |
| CVE-2020-25754An issue was discovered on Enphase Envoy R3.x and D4.x devices. There is a custom PAM module for user authentication that circumvents traditional user authentication. This module…Enphase · Envoy Firmware · 2021-06-16 | – | 1.4% | 2021-06-16 |
| CVE-2019-19766The Bitwarden server through 1.32.0 has a potentially unwanted KDF.Bitwarden · Server · 2019-12-12 | – | 1.3% | 2019-12-12 |
| CVE-2002-1657PostgreSQL uses the username for a salt when generating passwords, which makes it easier for remote attackers to guess passwords via a brute force attack.Postgresql · Postgresql · CVSS 7.5 · 2005-04-22 | 7.5 | 1.3% | 2005-04-22 |
| CVE-2001-0967Knox Arkeia server 4.2, and possibly other versions, uses a constant salt when encrypting passwords using the crypt() function, which makes it easier for an attacker to conduct br…Arkeia · Arkeia · 2002-02-02 | – | 1.0% | 2002-02-02 |
| CVE-2023-0567password_verify() always returns true for some invalid hashesPHP Group · PHP · CVSS 7.7 · 2023-02-16 | 7.7 | 0.9% | 2023-02-16 |
| CVE-2018-1447The GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6) CMS KDB logic fails to salt the hash function resulting in weaker than exp…IBM · Spectrum Protect · CVSS 5.1 · 2018-04-04 | 5.1 | 0.9% | 2018-04-04 |
| CVE-2019-7649global.encryptPassword in bootstrap/global.js in CMSWing 1.3.7 relies on multiple MD5 operations for password hashing.Cmswing · Cmswing · 2019-02-17 | – | 0.9% | 2019-02-17 |
| CVE-2008-1526ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(PE9) and 3.40(AGD.2) through 3.40(AHQ.3), do not use a salt when calculating an MD5 password ha…Zyxel · P-663hn-51 Firmware · 2008-03-26 | – | 0.9% | 2008-03-26 |
| CVE-2020-16231All Bachmann M1 System Processor Modules - Use of Password Hash with Insufficient Computational EffortBachmann Electronic, GmbH · M1 Hardware Controller MX207 · CVSS 7.2 · 2022-05-19 | 7.2 | 0.9% | 2022-05-19 |
| CVE-2020-28873Fluxbb 1.5.11 is affected by a denial of service (DoS) vulnerability by sending an extremely long password via the user login form. When a long password is sent, the password hash…Fluxbb · Fluxbb · 2021-03-17 | – | 0.9% | 2021-03-17 |
| CVE-2021-32519QSAN Storage Manager, XEVO, SANOS - Use of Password Hash With Insufficient Computational EffortQSAN · Storage Manager · CVSS 9.8 · 2021-07-07 | 9.8 | 0.9% | 2021-07-07 |
| CVE-2019-20138The HTTP Authentication library before 2019-12-27 for Nim has weak password hashing because the default algorithm for libsodium's crypto_pwhash_str is not used.Http Authentication Library Project · Http Authentication Library · 2019-12-30 | – | 0.8% | 2019-12-30 |
| CVE-2020-14512USE OF PASSWORD HASH WITH INSUFFICIENT COMPUTATIONAL EFFORT CWE-916Secomea · GateManager · CVSS 8.1 · 2020-08-25 | 8.1 | 0.8% | 2020-08-25 |
| CVE-2020-14389It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account console, allowing access and modificati…Redhat · keycloak · 2020-11-17 | – | 0.8% | 2020-11-17 |
| CVE-2021-33563Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username. This might make brute-force attacks easi…Koel · Koel · 2021-05-24 | – | 0.8% | 2021-05-24 |
| CVE-2021-22774A CWE-759: Use of a One-Way Hash without a Salt vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 al…Schneider-Electric · EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Pa… · 2021-07-21 | – | 0.8% | 2021-07-21 |
| CVE-2018-15680An issue was discovered in BTITeam XBTIT 2.5.4. The hashed passwords stored in the xbtit_users table are stored as unsalted MD5 hashes, which makes it easier for context-dependent…Btiteam · Xbtit · 2018-09-05 | – | 0.8% | 2018-09-05 |
| CVE-2019-19735class.userpeer.php in MFScripts YetiShare 3.5.2 through 4.5.3 uses an insecure method of creating password reset hashes (based only on microtime), which allows an attacker to gues…Mfscripts · Yetishare · 2019-12-30 | – | 0.8% | 2019-12-30 |
| CVE-2019-17216An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. Password authentication uses MD5 to hash passwords. Cracking is possible with mi…Vzug · Combi-Stream Mslq Firmware · 2019-10-06 | – | 0.7% | 2019-10-06 |
| CVE-2017-18917An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens.Mattermost · Mattermost Server · 2020-06-19 | – | 0.7% | 2020-06-19 |
| CVE-2021-38979IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software do…IBM · Security Key Lifecycle Manager · CVSS 4.4 · 2021-11-15 | 4.4 | 0.7% | 2021-11-15 |
| CVE-2021-37551In JetBrains YouTrack before 2021.2.16363, system user passwords were hashed with SHA-256.Jetbrains · Youtrack · 2021-08-06 | – | 0.7% | 2021-08-06 |
| CVE-2021-43989mySCADA myPROmySCADA · myPRO · CVSS 7.5 · 2021-12-23 | 7.5 | 0.7% | 2021-12-23 |
| CVE-2014-2354Cogent DataHub Use of Password Hash With Insufficient Computational EffortCogent · DataHub · CVSS 6 · 2014-05-30 | 6.0 | 0.7% | 2014-05-30 |
| CVE-2021-36767In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the server password, making the protection ineffective. An attacker…Digi · Realport · 2021-10-08 | – | 0.7% | 2021-10-08 |
| CVE-2019-12737UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing user credentials.Jetbrains · Ktor · 2019-10-02 | – | 0.7% | 2019-10-02 |
| CVE-2019-9080DomainMOD before 4.14.0 uses MD5 without a salt for password storage.Domainmod · Domainmod · 2020-10-20 | – | 0.7% | 2020-10-20 |
| CVE-2023-46233crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standardbrix · crypto-js · CVSS 9.1 · 2023-10-25 | 9.1 | 0.6% | 2023-10-25 |
| CVE-2020-6780Password Hash With Insufficient Computational Effort in the Database of Bosch FSM-2500 Server and Bosch FSM-5000 ServerBosch · FSM-2500 · CVSS 4.4 · 2021-01-25 | 4.4 | 0.6% | 2021-01-25 |
| CVE-2021-39182Use of Password Hash With Insufficient Computational Effort and Use of a Broken or Risky Cryptographic Algorithm and Reversible One-Way Hash in hashing.pyMorgan-Phoenix · EnroCrypt · CVSS 7.5 · 2021-11-08 | 7.5 | 0.6% | 2021-11-08 |
| CVE-2022-1235Weak secrethash can be brute-forced in livehelperchat/livehelperchatlivehelperchat · livehelperchat/livehelperchat · CVSS 7.5 · 2022-04-05 | 7.5 | 0.6% | 2022-04-05 |
| CVE-2022-47732In Yeastar N412 and N824 Configuration Panel 42.x and 45.x, an unauthenticated attacker can create backup file and download it, revealing admin hash, allowing, once cracked, to lo…Yeastar · N824 Firmware · CVSS 7.5 · 2023-01-20 | 7.5 | 0.5% | 2023-01-20 |
| CVE-2017-11131An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. For authentication, the user password is has…Stashcat · Heinekingmedia · 2017-08-01 | – | 0.5% | 2017-08-01 |
| CVE-2023-46133crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standardentronad · crypto-es · CVSS 9.1 · 2023-10-25 | 9.1 | 0.5% | 2023-10-25 |
| CVE-2018-15717Open Dental before version 18.4 stores user passwords as base64 encoded MD5 hashes.Open Dental · Open Dental · 2018-12-12 | – | 0.5% | 2018-12-12 |
| CVE-2023-27580CodeIgniter Shield Password Shucking Vulnerabilitycodeigniter4 · shield · CVSS 7.5 · 2023-03-13 | 7.5 | 0.5% | 2023-03-13 |
| CVE-2022-24041A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884)…Siemens · Desigo DXR2 · 2022-05-10 | – | 0.5% | 2022-05-10 |
| CVE-2023-41646Buttercup v2.20.3 allows attackers to obtain the hash of the master password for the password manager via accessing the file /vaults.json/Perrymitchell · Buttercup · 2023-09-07 | – | 0.5% | 2023-09-07 |
| CVE-2022-40295Authenticated sensitive information disclosure in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.PHP Point of Sale LLC · PHP Point of Sale · 2022-10-31 | – | 0.5% | 2022-10-31 |
| CVE-2022-29731An access control issue in ICT Protege GX/WX 2.08 allows attackers to leak SHA1 password hashes of other users.Ict · Protege Gx Firmware · 2022-05-27 | – | 0.4% | 2022-05-27 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.