Falhas do tipo CWE-521

159 resultados

Requisitos Fracos de Senha

A aplicação aceita senhas muito fracas ou sem critérios mínimos de complexidade, permitindo que atacantes adivinhem ou façam força bruta com facilidade. Isso acontece quando a política de senha não exige comprimento mínimo, caracteres especiais, números ou mistura de maiúsculas/minúsculas.

Exemplo

Um sistema permite registrar conta com a senha '123' ou 'senha', ou não rejeita senhas com menos de 6 caracteres. Um atacante consegue quebrar milhares de contas em minutos usando dicionário ou força bruta simples.

Como mitigar

Implemente política obrigatória de senha: mínimo 12 caracteres, pelo menos um número, uma maiúscula, uma minúscula e um caractere especial. Use validação server-side (não confie apenas em JavaScript) e considere integrar verificação contra listas de senhas vazadas (HIBP, por exemplo).

CVE-2023-0307MEDIUMWeak Password Requirements in thorsten/phpmyfaqEPSS 0.6%CVE-2024-48272MEDIUMD-Link DSL6740C v6.TR069.20211230 was discovered to use an insecure default Wifi password, possibly allowing attackers to connect to the devEPSS 0.6%CVE-2025-25749HIGHAn issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength poliEPSS 0.6%CVE-2021-40333CRITICALWeak default credential associated with TCP port 26EPSS 0.6%CVE-2023-2160MEDIUMWeak Password Requirements in modoboa/modoboaEPSS 0.6%CVE-2025-28200CRITICALVicture RX1800 EN_V1.0.0_r12_110933 was discovered to utilize a weak default password which includes the last 8 digits of the Mac address.EPSS 0.6%CVE-2023-34995HIGHPiiGAB M-Bus Weak Password RequirementsEPSS 0.6%CVE-2022-3326MEDIUMWeak Password Requirements in ikus060/rdiffwebEPSS 0.6%CVE-2025-28389CRITICALWeak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.EPSS 0.6%CVE-2024-3735MEDIUMSmart Office Main.aspx weak passwordEPSS 0.6%CVE-2022-34333MEDIUMIBM Sterling Order Management information disclosureEPSS 0.6%CVE-2023-40707HIGHWeak password requirements in OPTO 22 SNAP PAC S1 Built-in Web ServerEPSS 0.6%CVE-2026-25715CRITICALJinan USR IOT Technology Limited (PUSR) USR-W610 Weak Password RequirementsEPSS 0.6%CVE-2022-27558MEDIUMHCL iNotes is susceptible to a Broken Password Strength Checks vulnerability.EPSS 0.6%CVE-2022-1236MEDIUMWeak Password Requirements in weseek/growiEPSS 0.6%CVE-2025-5022MEDIUMWeak Password Requirements vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB” PV-DR004J all versionsEPSS 0.5%CVE-2023-41353HIGHChunghwa Telecom NOKIA G-040W-Q - Weak Password RequirementsEPSS 0.5%CVE-2021-39434HIGHA default username and password for an administrator account was discovered in ZKTeco ZKTime 10.0 through 11.1.0, builds 20180901, 20190510.EPSS 0.5%CVE-2023-38369MEDIUMIBM Security Access Manager Container information disclosureEPSS 0.5%CVE-2025-23408HIGHApache Fineract: weak password policyEPSS 0.5%