Fallos del tipo CWE-261

41 resultados

Codificação fraca de senha

É quando a aplicação armazena ou transmite senhas usando um esquema de codificação insuficiente (como Base64, ROT13 ou até texto plano), em vez de funções criptográficas apropriadas. O risco é que um atacante consegue descriptografar ou reverter a senha com ferramentas simples, comprometendo contas de usuário e sistemas.

Ejemplo

Uma aplicação web salva senhas em banco de dados codificadas apenas em Base64, ou envia credenciais via HTTP em vez de HTTPS. Um atacante que acessa o banco de dados ou intercepta a rede consegue recuperar a senha legível em segundos.

Cómo mitigar

Use sempre funções de hash criptográfico com salt — bcrypt, scrypt, PBKDF2 ou Argon2 — para armazenar senhas, e força HTTPS com TLS para transmissão. Nunca use codificação reversível (Base64, XOR) ou hash sem salt (MD5, SHA1 simples).

CVE-2020-10919MEDIUMThis vulnerability allows remote attackers to disclose sensitive information on affected installations of C-MORE HMI EA9 Firmware version 6.EPSS 1.6%CVE-2017-7905—A Weak Cryptography for Passwords issue was discovered in General Electric (GE) Multilin SR 750 Feeder Protection Relay, firmware versions pEPSS 1.3%CVE-2020-10275CRITICALRVD#2565: Weak token generation for the REST API.EPSS 1.0%CVE-2023-22271MEDIUMAEM Weak Cryptography for Passwords Security feature bypassEPSS 0.8%CVE-2025-31229CRITICALA logic issue was addressed with improved checks. This issue is fixed in iOS 18.6 and iPadOS 18.6. Passcode may be read aloud by VoiceOver.EPSS 0.7%CVE-2023-0525HIGHWeak Encoding for Password vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.49.000 and prior, GT25 modEPSS 0.7%CVE-2022-38469HIGH An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords. EPSS 0.6%CVE-2021-21507HIGHDell EMC Networking X-Series firmware versions prior to 3.0.1.8 and Dell EMC PowerEdge VRTX Switch Module firmware versions prior to 2.0.0.8EPSS 0.5%CVE-2023-0356MEDIUM SOCOMEC MODULYS GP Netvision versions 7.20 and prior lack strong encryption for credentials on HTTP connections, which could result in threEPSS 0.5%CVE-2024-28270HIGHAn issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resEPSS 0.4%CVE-2024-0556HIGHWeak Cryptography for Passwords vulnerability on WIC1200EPSS 0.4%CVE-2022-35931LOWNextcloud Password Policy's generated passwords are not fully validated by HIBPValidatorEPSS 0.4%CVE-2025-25298MEDIUMMissing Maximum Password Length Validation in Strapi Password HashingEPSS 0.4%CVE-2024-7407HIGHWeak password encoding in Streamsoft PrestiżEPSS 0.4%CVE-2024-37187MEDIUMAdvantech ADAM-5550 Weak Encoding for PasswordEPSS 0.4%CVE-2024-8455HIGHPLANET Technology switch devices - Swctrl service exchanges weakly encoded passwordsEPSS 0.3%CVE-2024-34113MEDIUMColdFusion | Weak Cryptography for Passwords (CWE-261)EPSS 0.3%CVE-2023-7237MEDIUMLantronix XPort Weak Encoding for PasswordEPSS 0.3%CVE-2025-11500HIGHCredentials exposure in tinycontrol devicesEPSS 0.3%CVE-2024-52334MEDIUMA vulnerability has been identified in syngo.plaza VB30E (All versions < VB30E_HF07). The affected application does not encrypt the passwordEPSS 0.3%