Weaknesses of type CWE-916

98 results

Hash de senha com esforço computacional insuficiente

Ocorre quando uma aplicação usa funções de hash criptográfico rápidas (como MD5, SHA-1 ou até SHA-256 simples) para armazenar senhas, sem mecanismos de desaceleração. Isso permite que um atacante que roube o banco de dados execute ataques de força bruta ou dicionário em velocidade muito alta, quebrando senhas em minutos ou horas.

Example

Um sistema salva senhas como SHA-256(senha) direto no banco de dados. Um atacante rouba o dump e, com uma GPU moderna, testa bilhões de combinações por segundo, recuperando a senha original em tempo viável. Se tivesse usado bcrypt ou PBKDF2 com iterações altas, o mesmo ataque demoraria séculos.

How to mitigate

Use funções de hash de propósito criptográfico com fator de trabalho elevado: bcrypt (com custo ≥12), scrypt, PBKDF2 (≥600.000 iterações conforme NIST 2023) ou Argon2. Nunca use MD5, SHA-1 ou SHA-256 puro para senhas. Valide e atualize hashes legados migrandoos gradualmente.

CVE-2023-4986LOWSupcon InPlant SCADA Project.xml unknown vulnerabilityEPSS 0.2%CVE-2026-13576HIGHCallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashesEPSS 0.2%CVE-2026-116071HIGHrotki before 1.44.2 Weak Key Derivation for Premium Cloud Backup EncryptionEPSS 0.2%CVE-2026-118991HIGHCallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES keyEPSS 0.2%CVE-2026-107829HIGHJivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSqlEPSS 0.2%CVE-2020-10040—A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). An attackEPSS 0.2%CVE-2026-105156MEDIUMYzmCMS MD5 system.func.php password weak password hashEPSS 0.2%CVE-2026-25861HIGHQloApps 1.7.0 Weak Password Hashing via MD5 in Tools.phpEPSS 0.2%CVE-2020-12069HIGHCODESYS V3 prone to Inadequate Password HashingEPSS 0.2%CVE-2021-33003—Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to retrieve passwords in cleartext due to a weak hashing algorithEPSS 0.2%CVE-2026-45027MEDIUMWeGIA: Use of Weak Password Hashing Algorithm (SHA-256, no salt) in html/login.phpEPSS 0.2%CVE-2021-22741—Use of Password Hash with Insufficient Computational Effort vulnerability exists in ClearSCADA (all versions), EcoStruxure Geo SCADA Expert EPSS 0.2%CVE-2026-75112MEDIUMOTTO® Fleet Manager – Weak Password Hashing ConfigurationEPSS 0.2%CVE-2025-2349LOWIROAD Dash Cam FX2 Password Hash passwd weak password hashEPSS 0.2%CVE-2026-49005LOWRoot password hash exposure vulnerability in ZTE F689 productEPSS 0.2%CVE-2021-38400MEDIUMUse of Password Hash with Insufficient Computational Effort for Boston Scientific Zoom LatitudeEPSS 0.1%CVE-2025-2265HIGHSantesoft Sante PACS Server HTTP.db SHA1 Hash TruncationEPSS 0.1%CVE-2025-67168MEDIUMRiteCMS v3.1.0 was discovered to use insecure encryption to store passwords.EPSS 0.1%CVE-2026-44611MEDIUMMacGregor Voyage Data Recorder (VDR) G4e Use of Password Hash With Insufficient Computational EffortEPSS 0.1%CVE-2024-55057MEDIUMPhpgurukul Online Birth Certificate System 1.0 suffers from insufficient password requirements which can lead to unauthorized access to userEPSS 0.1%