Falhas do tipo CWE-521

156 resultados

Requisitos Fracos de Senha

A aplicação aceita senhas muito fracas ou sem critérios mínimos de complexidade, permitindo que atacantes adivinhem ou façam força bruta com facilidade. Isso acontece quando a política de senha não exige comprimento mínimo, caracteres especiais, números ou mistura de maiúsculas/minúsculas.

Exemplo

Um sistema permite registrar conta com a senha '123' ou 'senha', ou não rejeita senhas com menos de 6 caracteres. Um atacante consegue quebrar milhares de contas em minutos usando dicionário ou força bruta simples.

Como mitigar

Implemente política obrigatória de senha: mínimo 12 caracteres, pelo menos um número, uma maiúscula, uma minúscula e um caractere especial. Use validação server-side (não confie apenas em JavaScript) e considere integrar verificação contra listas de senhas vazadas (HIBP, por exemplo).

CVE-2019-17444CRITICALJFrog Artifactory does not enforce default admin password changeEPSS 69.4%CVE-2017-3186—ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC use non-random default credentials across all deEPSS 6.1%CVE-2019-18988HIGHTeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' inEPSS 4.7%KEVCVE-2017-7903CRITICALA Weak Password Requirements issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-LEPSS 2.8%CVE-2022-1775HIGHWeak Password Requirements in polonel/trudeskEPSS 2.2%CVE-2022-1668CRITICALSecheron SEPCOS Control and Protection RelayEPSS 2.0%CVE-2022-43030HIGHSiyucms v6.1.7 was discovered to contain a remote code execution (RCE) vulnerability in the background. SIYUCMS is a content management systEPSS 1.9%CVE-2024-48845CRITICALWeak Password Rules/StrengthEPSS 1.8%CVE-2023-29974CRITICALAn issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements.EPSS 1.8%CVE-2020-6995—In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the application utilizes weak passEPSS 1.6%CVE-2020-25153CRITICALMOXA NPort IAW5000A-I/O SeriesEPSS 1.6%CVE-2025-11200HIGHMLflow Weak Password Requirements Authentication Bypass VulnerabilityEPSS 1.5%CVE-2020-6991—In Moxa EDS-G516E Series firmware, Version 5.2 or lower, weak password requirements may allow an attacker to gain access using brute force.EPSS 1.5%CVE-2024-42850CRITICALAn issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements.EPSS 1.4%CVE-2020-11925HIGHAn issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Authentication to the device is based on a username and passwordEPSS 1.3%CVE-2020-15115MEDIUMNo minimum password length in etcdEPSS 1.3%CVE-2022-45482CRITICALLazy Mouse server enforces weak password requirements and doesn't implement rate limiting, allowing remote unauthenticated users to easily aEPSS 1.3%CVE-2020-7519—A CWE-521: Weak Password Requirements vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to cEPSS 1.3%CVE-2023-31098CRITICALApache InLong: Weak Password Implementation in InLongEPSS 1.2%CVE-2022-1039CRITICALICSA-22-104-03 Red Lion DA50NEPSS 1.2%