Fallos del tipo CWE-916

81 resultados

Uso de hash de senha com esforço computacional insuficiente

A aplicação usa algoritmos de hash de senha (como MD5, SHA-1 ou SHA-256 simples) que são rápidos demais para proteger contra ataques de força bruta e dicionário. Um atacante com acesso ao banco de hashes pode testar milhões de senhas por segundo, tornando trivial descobrir senhas fracas ou comuns.

Ejemplo

Um sistema web armazena senhas fazendo `password_hash = sha256(senha_usuario)` sem iterações ou salt aleatório. Quando o banco de dados é vazado, um atacante usa GPU para crackear centenas de milhares de hashes por hora, comprometendo contas em minutos.

Cómo mitigar

Use funções de derivação de senha com fator de trabalho ajustável: bcrypt, scrypt, PBKDF2 (com mínimo 100.000 iterações) ou Argon2. Adicione salt aleatório único por usuário e aumente o custo computacional conforme o hardware evolui.

CVE-2022-24041—A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXEPSS 0.5%CVE-2023-46133CRITICALcrypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standardEPSS 0.4%CVE-2022-40258MEDIUMWeak password hashes for Redfish & APIEPSS 0.4%CVE-2023-34433HIGHPiiGAB M-Bus Use of Password Hash With Insufficient Computational EffortEPSS 0.4%CVE-2024-23091HIGHWeak password hashing using MD5 in funzioni.php in HotelDruid before 1.32 allows an attacker to obtain plaintext passwords from hash values.EPSS 0.4%CVE-2022-40295—Authenticated sensitive information disclosure in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.EPSS 0.4%CVE-2024-5743CRITICALCommand Injection VulnerabilityEPSS 0.4%CVE-2025-3937HIGHUse of Password Hash with Insufficient Computational EffortEPSS 0.3%CVE-2019-20466HIGHAn issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. A local attacker with the "default" account is EPSS 0.3%CVE-2021-32997HIGHBaker Hughes Bently Nevada 3500 - Use of Password Hash with Insufficient Computational EffortEPSS 0.3%CVE-2024-25607HIGHThe default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and LifeEPSS 0.3%CVE-2022-26115MEDIUMA use of password hash with insufficient computational effort vulnerability [CWE-916] in FortiSandbox before 4.2.0 may allow an attacker witEPSS 0.3%CVE-2025-41692MEDIUMWeak/Predictable root PasswordEPSS 0.3%CVE-2025-7789MEDIUMXuxueli xxl-job Token Generation IndexController.java makeToken weak password hashEPSS 0.3%CVE-2025-24340MEDIUMA vulnerability in the users configuration file of ctrlX OS may allow a remote authenticated (low-privileged) attacker to recover the plaintEPSS 0.3%CVE-2023-5846HIGHUse of Password Hash With Insufficient Computational Effort in Franklin Fueling System TS-550EPSS 0.3%CVE-2026-57310MEDIUMWeak password hashing in Windu CMSEPSS 0.3%CVE-2024-2365LOWMusicshelf SHA-1 PinningTrustManager.java weak password hashEPSS 0.3%CVE-2026-30789MEDIUMRustDesk Auth Proof Uses Server-Controlled Salt/Challenge and Fast Double-SHA256, Enabling Offline Brute-ForceEPSS 0.3%CVE-2024-29886MEDIUMImproved security for stored password hashesEPSS 0.3%