Fallos del tipo CWE-916

98 resultados

Uso de hash de senha com esforço computacional insuficiente

A aplicação usa algoritmos de hash de senha (como MD5, SHA-1 ou SHA-256 simples) que são rápidos demais para proteger contra ataques de força bruta e dicionário. Um atacante com acesso ao banco de hashes pode testar milhões de senhas por segundo, tornando trivial descobrir senhas fracas ou comuns.

Ejemplo

Um sistema web armazena senhas fazendo `password_hash = sha256(senha_usuario)` sem iterações ou salt aleatório. Quando o banco de dados é vazado, um atacante usa GPU para crackear centenas de milhares de hashes por hora, comprometendo contas em minutos.

Cómo mitigar

Use funções de derivação de senha com fator de trabalho ajustável: bcrypt, scrypt, PBKDF2 (com mínimo 100.000 iterações) ou Argon2. Adicione salt aleatório único por usuário e aumente o custo computacional conforme o hardware evolui.

CVE-2026-5040HIGHWeak Password Hashing Mechanism in TP-Link Deco M5EPSS 0.1%CVE-2025-46413MEDIUMUse of password hash with insufficient computational effort issue exists in BUFFALO Wi-Fi router 'WSR-1800AX4 series'. When WPS is enabled, EPSS 0.1%CVE-2022-0022MEDIUMPAN-OS: Use of a Weak Cryptographic Algorithm for Stored Password HashesEPSS 0.1%CVE-2022-47557MEDIUMUse of Password Hash With Insufficient Computational Effort in Ormazabal productsEPSS 0.1%CVE-2025-26486MEDIUMBroken or Risky Cryptographic Algorithm, Use of Password Hash With Insufficient Computational Effort, Use of Weak Hash, Use of a One-Way HEPSS 0.1%CVE-2025-27552MEDIUMDBIx::Class::EncodedColumn until 0.00032 for Perl uses insecure rand() function for salting password hashes in Crypt/Eksblowfish/Bcrypt.pmEPSS 0.1%CVE-2025-27551MEDIUMDBIx::Class::EncodedColumn until 0.00032 for Perl uses insecure rand() function for salting password hashes in Digest.pmEPSS 0.1%CVE-2026-74871MEDIUMopenssl_encrypt before 1.4.6 KDF Bypass via Sequential-XOREPSS 0.1%CVE-2026-45787MEDIUMelecterm's encrypt method not safe enoughEPSS 0.1%CVE-2026-0857MEDIUMUse of a Password Hash With Insufficient Computational Effort in Mesalvo MEONA (MEONA Server and MEONA Client) for user accounts whose passwEPSS 0.1%CVE-2025-13532MEDIUMWeak Password Hash in Core Privileged Access Manager (BoKS)EPSS 0.1%CVE-2026-56272MEDIUMFlowise - Insufficient Password Salt Rounds in Bcrypt HashingEPSS 0.1%CVE-2026-30785HIGHRustDesk Encrypts Local Passwords with World-Readable Machine ID and Fixed Zero Nonce (XSalsa20-Poly1305)EPSS 0.1%CVE-2026-90457MEDIUMThe administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, aEPSS 0.1%CVE-2026-105804MEDIUMPayload: Password hashes use insufficient PBKDF2 iterationsEPSS 0.1%CVE-2026-112029LOWdiem-project diem SHA1 PluginDmUser.class.php weak password hashEPSS 0.1%CVE-2026-53762MEDIUMVeraCryp: wolfCrypt backend bypasses VeraCrypt PBKDF2 iteration count (non-default WOLFCRYPT=1 builds)EPSS 0.1%CVE-2026-65629HIGHWeak PBKDF2 parameters for password-encrypted private-key export in joseEPSS 0.1%