CWE-916 Archives - CVE Vulnerability

CVE-2008-4905

Sun, 26 Feb 2023 09:10:46 +0000

Typo 5.1.3 and earlier uses a hard-coded salt for calculating password hashes, which makes it easier for attackers to guess passwords via a brute force attack.

The post CVE-2008-4905 appeared first on CVE Vulnerability.

CVE-2008-1526

Sun, 26 Feb 2023 09:09:04 +0000

ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(PE9) and 3.40(AGD.2) through 3.40(AHQ.3), do not use a salt when calculating an MD5 password hash, which makes it easier for attackers to crack passwords.

The post CVE-2008-1526 appeared first on CVE Vulnerability.

CVE-2018-9233

Sun, 26 Feb 2023 06:51:46 +0000

Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%SophosSophos Anti-VirusConfigmachine.xml, which makes it easier for attackers to determine a cleartext password, and subsequently choose unsafe malware settings, via rainbow tables or other approaches.

The post CVE-2018-9233 appeared first on CVE Vulnerability.

CVE-2018-15681

Sun, 26 Feb 2023 06:46:45 +0000

An issue was discovered in BTITeam XBTIT 2.5.4. When a user logs in, their password hash is rehashed using a predictable salt and stored in the “pass” cookie, which is not flagged as HTTPOnly. Due to the weak and predictable salt that is in place, an attacker who successfully steals this cookie can efficiently brute-force it to retrieve the user’s cleartext password.

The post CVE-2018-15681 appeared first on CVE Vulnerability.

CVE-2018-15680

Sun, 26 Feb 2023 06:46:45 +0000

An issue was discovered in BTITeam XBTIT 2.5.4. The hashed passwords stored in the xbtit_users table are stored as unsalted MD5 hashes, which makes it easier for context-dependent attackers to obtain cleartext values via a brute-force attack.

The post CVE-2018-15680 appeared first on CVE Vulnerability.

CVE-2018-1447

Sun, 26 Feb 2023 06:46:20 +0000

The GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6) CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak password may be recovered. Note: After update the customer should change password to ensure the new password is stored more securely. Products should encourage customers to take this step as a high priority action. IBM X-Force ID: 139972.

The post CVE-2018-1447 appeared first on CVE Vulnerability.

CVE-2018-10618

Sun, 26 Feb 2023 06:44:56 +0000

Davolink DVW-3200N all version prior to Version 1.00.06. The device generates a weak password hash that is easily cracked, allowing a remote attacker to obtain the password for the device.

The post CVE-2018-10618 appeared first on CVE Vulnerability.

CVE-2020-6780

Sun, 26 Feb 2023 06:42:51 +0000

Use of Password Hash With Insufficient Computational Effort in the database of Bosch FSM-2500 server and Bosch FSM-5000 server up to and including version 5.2 allows a remote attacker with admin privileges to dump the credentials of other users and possibly recover their plain-text passwords by brute-forcing the MD5 hash.

The post CVE-2020-6780 appeared first on CVE Vulnerability.

CVE-2020-28873

Sun, 26 Feb 2023 06:40:46 +0000

Fluxbb 1.5.11 is affected by a denial of service (DoS) vulnerability by sending an extremely long password via the user login form. When a long password is sent, the password hashing process will result in CPU and memory exhaustion on the server.

The post CVE-2020-28873 appeared first on CVE Vulnerability.

CVE-2020-27693

Sun, 26 Feb 2023 06:40:24 +0000

Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 stores administrative passwords using a hash that is considered outdated.

The post CVE-2020-27693 appeared first on CVE Vulnerability.