Fallos del tipo CWE-916

81 resultados

Uso de hash de senha com esforço computacional insuficiente

A aplicação usa algoritmos de hash de senha (como MD5, SHA-1 ou SHA-256 simples) que são rápidos demais para proteger contra ataques de força bruta e dicionário. Um atacante com acesso ao banco de hashes pode testar milhões de senhas por segundo, tornando trivial descobrir senhas fracas ou comuns.

Ejemplo

Um sistema web armazena senhas fazendo `password_hash = sha256(senha_usuario)` sem iterações ou salt aleatório. Quando o banco de dados é vazado, um atacante usa GPU para crackear centenas de milhares de hashes por hora, comprometendo contas em minutos.

Cómo mitigar

Use funções de derivação de senha com fator de trabalho ajustável: bcrypt, scrypt, PBKDF2 (com mínimo 100.000 iterações) ou Argon2. Adicione salt aleatório único por usuário e aumente o custo computacional conforme o hardware evolui.

CVE-2018-13811—A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) (All Versions < V15.1). Password hashes with insufficient computational eEPSS 0.3%CVE-2026-86670MEDIUMaircheng-org iWebShop-5 Authentication Storage admin.php weak password hashEPSS 0.3%CVE-2026-80211HIGHFrontAccounting through 2.4.20 Use of Unsalted MD5 for Password StorageEPSS 0.2%CVE-2026-55069HIGHKestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force AttackEPSS 0.2%CVE-2026-40522HIGHFrontAccounting < 2.4.20 SQL Injection via rep601.phpEPSS 0.2%CVE-2026-9641MEDIUMCrypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterationsEPSS 0.2%CVE-2024-24553MEDIUMBludit uses SHA1 as Password Hashing AlgorithmEPSS 0.2%CVE-2024-7701MEDIUMMisuse of SHA256 to create an encryption keyEPSS 0.2%CVE-2026-85497CRITICALCareCam CM2507 Use of Password Hash With Insufficient Computational EffortEPSS 0.2%CVE-2023-4986LOWSupcon InPlant SCADA Project.xml unknown vulnerabilityEPSS 0.2%CVE-2026-81704HIGHopenssl_encrypt before 1.4.9 Weak Key Derivation via D-BusEPSS 0.2%CVE-2026-81689HIGHopenssl_encrypt before 1.4.9 Weak Pepper Key DerivationEPSS 0.2%CVE-2020-10040—A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). An attackEPSS 0.2%CVE-2026-92921MEDIUMadmin3 through 3.0.0 Weak Password Hashing via Single-Round MD5EPSS 0.2%CVE-2026-25861HIGHQloApps 1.7.0 Weak Password Hashing via MD5 in Tools.phpEPSS 0.2%CVE-2021-33003—Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to retrieve passwords in cleartext due to a weak hashing algorithEPSS 0.2%CVE-2021-22741—Use of Password Hash with Insufficient Computational Effort vulnerability exists in ClearSCADA (all versions), EcoStruxure Geo SCADA Expert EPSS 0.2%CVE-2020-12069HIGHCODESYS V3 prone to Inadequate Password HashingEPSS 0.2%CVE-2025-2349LOWIROAD Dash Cam FX2 Password Hash passwd weak password hashEPSS 0.2%CVE-2021-38400MEDIUMUse of Password Hash with Insufficient Computational Effort for Boston Scientific Zoom LatitudeEPSS 0.1%