Weaknesses of type CWE-916

81 results

Hash de senha com esforço computacional insuficiente

Ocorre quando uma aplicação usa funções de hash criptográfico rápidas (como MD5, SHA-1 ou até SHA-256 simples) para armazenar senhas, sem mecanismos de desaceleração. Isso permite que um atacante que roube o banco de dados execute ataques de força bruta ou dicionário em velocidade muito alta, quebrando senhas em minutos ou horas.

Example

Um sistema salva senhas como SHA-256(senha) direto no banco de dados. Um atacante rouba o dump e, com uma GPU moderna, testa bilhões de combinações por segundo, recuperando a senha original em tempo viável. Se tivesse usado bcrypt ou PBKDF2 com iterações altas, o mesmo ataque demoraria séculos.

How to mitigate

Use funções de hash de propósito criptográfico com fator de trabalho elevado: bcrypt (com custo ≥12), scrypt, PBKDF2 (≥600.000 iterações conforme NIST 2023) ou Argon2. Nunca use MD5, SHA-1 ou SHA-256 puro para senhas. Valide e atualize hashes legados migrandoos gradualmente.

CVE-2025-2265HIGHSantesoft Sante PACS Server HTTP.db SHA1 Hash TruncationEPSS 0.1%CVE-2025-67168MEDIUMRiteCMS v3.1.0 was discovered to use insecure encryption to store passwords.EPSS 0.1%CVE-2026-44611MEDIUMMacGregor Voyage Data Recorder (VDR) G4e Use of Password Hash With Insufficient Computational EffortEPSS 0.1%CVE-2026-45027MEDIUMWeGIA: Use of Weak Password Hashing Algorithm (SHA-256, no salt) in html/login.phpEPSS 0.1%CVE-2024-55057MEDIUMPhpgurukul Online Birth Certificate System 1.0 suffers from insufficient password requirements which can lead to unauthorized access to userEPSS 0.1%CVE-2022-0022MEDIUMPAN-OS: Use of a Weak Cryptographic Algorithm for Stored Password HashesEPSS 0.1%CVE-2022-47557MEDIUMUse of Password Hash With Insufficient Computational Effort in Ormazabal productsEPSS 0.1%CVE-2025-46413MEDIUMUse of password hash with insufficient computational effort issue exists in BUFFALO Wi-Fi router 'WSR-1800AX4 series'. When WPS is enabled, EPSS 0.1%CVE-2025-26486MEDIUMBroken or Risky Cryptographic Algorithm, Use of Password Hash With Insufficient Computational Effort, Use of Weak Hash, Use of a One-Way HEPSS 0.1%CVE-2025-27551MEDIUMDBIx::Class::EncodedColumn until 0.00032 for Perl uses insecure rand() function for salting password hashes in Digest.pmEPSS 0.1%CVE-2025-27552MEDIUMDBIx::Class::EncodedColumn until 0.00032 for Perl uses insecure rand() function for salting password hashes in Crypt/Eksblowfish/Bcrypt.pmEPSS 0.1%CVE-2026-49005LOWRoot password hash exposure vulnerability in ZTE F689 productEPSS 0.1%CVE-2026-75112MEDIUMOTTO® Fleet Manager – Weak Password Hashing ConfigurationEPSS 0.1%CVE-2026-45787MEDIUMelecterm's encrypt method not safe enoughEPSS 0.1%CVE-2025-13532MEDIUMWeak Password Hash in Core Privileged Access Manager (BoKS)EPSS 0.1%CVE-2026-56272MEDIUMFlowise - Insufficient Password Salt Rounds in Bcrypt HashingEPSS 0.1%CVE-2026-5040HIGHWeak Password Hashing Mechanism in TP-Link Deco M5EPSS 0.1%CVE-2026-90457MEDIUMThe administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, aEPSS 0.1%CVE-2026-53762MEDIUMVeraCryp: wolfCrypt backend bypasses VeraCrypt PBKDF2 iteration count (non-default WOLFCRYPT=1 builds)EPSS 0.1%CVE-2026-30785HIGHRustDesk Encrypts Local Passwords with World-Readable Machine ID and Fixed Zero Nonce (XSalsa20-Poly1305)EPSS 0.1%