Weaknesses of type CWE-916

81 results

Hash de senha com esforço computacional insuficiente

Ocorre quando uma aplicação usa funções de hash criptográfico rápidas (como MD5, SHA-1 ou até SHA-256 simples) para armazenar senhas, sem mecanismos de desaceleração. Isso permite que um atacante que roube o banco de dados execute ataques de força bruta ou dicionário em velocidade muito alta, quebrando senhas em minutos ou horas.

Example

Um sistema salva senhas como SHA-256(senha) direto no banco de dados. Um atacante rouba o dump e, com uma GPU moderna, testa bilhões de combinações por segundo, recuperando a senha original em tempo viável. Se tivesse usado bcrypt ou PBKDF2 com iterações altas, o mesmo ataque demoraria séculos.

How to mitigate

Use funções de hash de propósito criptográfico com fator de trabalho elevado: bcrypt (com custo ≥12), scrypt, PBKDF2 (≥600.000 iterações conforme NIST 2023) ou Argon2. Nunca use MD5, SHA-1 ou SHA-256 puro para senhas. Valide e atualize hashes legados migrandoos gradualmente.

CVE-2022-24041—A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXEPSS 0.5%CVE-2023-46133CRITICALcrypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standardEPSS 0.4%CVE-2022-40258MEDIUMWeak password hashes for Redfish & APIEPSS 0.4%CVE-2023-34433HIGHPiiGAB M-Bus Use of Password Hash With Insufficient Computational EffortEPSS 0.4%CVE-2024-23091HIGHWeak password hashing using MD5 in funzioni.php in HotelDruid before 1.32 allows an attacker to obtain plaintext passwords from hash values.EPSS 0.4%CVE-2022-40295—Authenticated sensitive information disclosure in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.EPSS 0.4%CVE-2024-5743CRITICALCommand Injection VulnerabilityEPSS 0.4%CVE-2025-3937HIGHUse of Password Hash with Insufficient Computational EffortEPSS 0.3%CVE-2019-20466HIGHAn issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. A local attacker with the "default" account is EPSS 0.3%CVE-2021-32997HIGHBaker Hughes Bently Nevada 3500 - Use of Password Hash with Insufficient Computational EffortEPSS 0.3%CVE-2024-25607HIGHThe default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and LifeEPSS 0.3%CVE-2022-26115MEDIUMA use of password hash with insufficient computational effort vulnerability [CWE-916] in FortiSandbox before 4.2.0 may allow an attacker witEPSS 0.3%CVE-2025-41692MEDIUMWeak/Predictable root PasswordEPSS 0.3%CVE-2025-7789MEDIUMXuxueli xxl-job Token Generation IndexController.java makeToken weak password hashEPSS 0.3%CVE-2025-24340MEDIUMA vulnerability in the users configuration file of ctrlX OS may allow a remote authenticated (low-privileged) attacker to recover the plaintEPSS 0.3%CVE-2023-5846HIGHUse of Password Hash With Insufficient Computational Effort in Franklin Fueling System TS-550EPSS 0.3%CVE-2026-57310MEDIUMWeak password hashing in Windu CMSEPSS 0.3%CVE-2024-2365LOWMusicshelf SHA-1 PinningTrustManager.java weak password hashEPSS 0.3%CVE-2026-30789MEDIUMRustDesk Auth Proof Uses Server-Controlled Salt/Challenge and Fast Double-SHA256, Enabling Offline Brute-ForceEPSS 0.3%CVE-2024-29886MEDIUMImproved security for stored password hashesEPSS 0.3%