Weaknesses of type CWE-916

81 results

Hash de senha com esforço computacional insuficiente

Ocorre quando uma aplicação usa funções de hash criptográfico rápidas (como MD5, SHA-1 ou até SHA-256 simples) para armazenar senhas, sem mecanismos de desaceleração. Isso permite que um atacante que roube o banco de dados execute ataques de força bruta ou dicionário em velocidade muito alta, quebrando senhas em minutos ou horas.

Example

Um sistema salva senhas como SHA-256(senha) direto no banco de dados. Um atacante rouba o dump e, com uma GPU moderna, testa bilhões de combinações por segundo, recuperando a senha original em tempo viável. Se tivesse usado bcrypt ou PBKDF2 com iterações altas, o mesmo ataque demoraria séculos.

How to mitigate

Use funções de hash de propósito criptográfico com fator de trabalho elevado: bcrypt (com custo ≥12), scrypt, PBKDF2 (≥600.000 iterações conforme NIST 2023) ou Argon2. Nunca use MD5, SHA-1 ou SHA-256 puro para senhas. Valide e atualize hashes legados migrandoos gradualmente.

CVE-2026-86670MEDIUMaircheng-org iWebShop-5 Authentication Storage admin.php weak password hashEPSS 0.3%CVE-2026-55069HIGHKestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force AttackEPSS 0.2%CVE-2026-80211HIGHFrontAccounting through 2.4.20 Use of Unsalted MD5 for Password StorageEPSS 0.2%CVE-2018-13811—A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) (All Versions < V15.1). Password hashes with insufficient computational eEPSS 0.2%CVE-2026-40522HIGHFrontAccounting < 2.4.20 SQL Injection via rep601.phpEPSS 0.2%CVE-2026-9641MEDIUMCrypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterationsEPSS 0.2%CVE-2024-24553MEDIUMBludit uses SHA1 as Password Hashing AlgorithmEPSS 0.2%CVE-2024-7701MEDIUMMisuse of SHA256 to create an encryption keyEPSS 0.2%CVE-2026-85497CRITICALCareCam CM2507 Use of Password Hash With Insufficient Computational EffortEPSS 0.2%CVE-2023-4986LOWSupcon InPlant SCADA Project.xml unknown vulnerabilityEPSS 0.2%CVE-2026-81704HIGHopenssl_encrypt before 1.4.9 Weak Key Derivation via D-BusEPSS 0.2%CVE-2026-81689HIGHopenssl_encrypt before 1.4.9 Weak Pepper Key DerivationEPSS 0.2%CVE-2020-10040—A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). An attackEPSS 0.2%CVE-2026-92921MEDIUMadmin3 through 3.0.0 Weak Password Hashing via Single-Round MD5EPSS 0.2%CVE-2026-25861HIGHQloApps 1.7.0 Weak Password Hashing via MD5 in Tools.phpEPSS 0.2%CVE-2021-33003—Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to retrieve passwords in cleartext due to a weak hashing algorithEPSS 0.2%CVE-2021-22741—Use of Password Hash with Insufficient Computational Effort vulnerability exists in ClearSCADA (all versions), EcoStruxure Geo SCADA Expert EPSS 0.2%CVE-2020-12069HIGHCODESYS V3 prone to Inadequate Password HashingEPSS 0.2%CVE-2025-2349LOWIROAD Dash Cam FX2 Password Hash passwd weak password hashEPSS 0.2%CVE-2021-38400MEDIUMUse of Password Hash with Insufficient Computational Effort for Boston Scientific Zoom LatitudeEPSS 0.1%