Weaknesses of type CWE-261

41 results

Codificação fraca de senha

A aplicação armazena ou transmite senhas usando um método de codificação insuficiente (como Base64, XOR simples ou hash sem salt), permitindo que um atacante recupere a senha original com esforço computacional mínimo. Diferente de hash criptográfico robusto, uma codificação fraca não é unidirecional e oferece praticamente nenhuma proteção.

Example

Um sistema salva a senha do usuário codificada em Base64 no banco de dados, ou transmite a credencial pelo JSON usando apenas XOR com chave fixa. Um atacante com acesso ao banco ou interceptação de rede decodifica em segundos e obtém a senha em texto plano.

How to mitigate

Use funções de hash criptográfico com salt aleatório (bcrypt, Argon2, scrypt) para armazenamento e HTTPS com TLS 1.2+ para transmissão. Nunca use Base64, XOR ou qualquer 'codificação' reversível para proteger credenciais.

CVE-2020-10919MEDIUMThis vulnerability allows remote attackers to disclose sensitive information on affected installations of C-MORE HMI EA9 Firmware version 6.EPSS 1.6%CVE-2017-7905—A Weak Cryptography for Passwords issue was discovered in General Electric (GE) Multilin SR 750 Feeder Protection Relay, firmware versions pEPSS 1.3%CVE-2020-10275CRITICALRVD#2565: Weak token generation for the REST API.EPSS 1.0%CVE-2023-22271MEDIUMAEM Weak Cryptography for Passwords Security feature bypassEPSS 0.8%CVE-2025-31229CRITICALA logic issue was addressed with improved checks. This issue is fixed in iOS 18.6 and iPadOS 18.6. Passcode may be read aloud by VoiceOver.EPSS 0.7%CVE-2023-0525HIGHWeak Encoding for Password vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.49.000 and prior, GT25 modEPSS 0.7%CVE-2022-38469HIGH An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords. EPSS 0.6%CVE-2021-21507HIGHDell EMC Networking X-Series firmware versions prior to 3.0.1.8 and Dell EMC PowerEdge VRTX Switch Module firmware versions prior to 2.0.0.8EPSS 0.5%CVE-2023-0356MEDIUM SOCOMEC MODULYS GP Netvision versions 7.20 and prior lack strong encryption for credentials on HTTP connections, which could result in threEPSS 0.5%CVE-2024-28270HIGHAn issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resEPSS 0.4%CVE-2024-0556HIGHWeak Cryptography for Passwords vulnerability on WIC1200EPSS 0.4%CVE-2022-35931LOWNextcloud Password Policy's generated passwords are not fully validated by HIBPValidatorEPSS 0.4%CVE-2025-25298MEDIUMMissing Maximum Password Length Validation in Strapi Password HashingEPSS 0.4%CVE-2024-7407HIGHWeak password encoding in Streamsoft PrestiżEPSS 0.4%CVE-2024-37187MEDIUMAdvantech ADAM-5550 Weak Encoding for PasswordEPSS 0.4%CVE-2024-8455HIGHPLANET Technology switch devices - Swctrl service exchanges weakly encoded passwordsEPSS 0.3%CVE-2024-34113MEDIUMColdFusion | Weak Cryptography for Passwords (CWE-261)EPSS 0.3%CVE-2023-7237MEDIUMLantronix XPort Weak Encoding for PasswordEPSS 0.3%CVE-2025-11500HIGHCredentials exposure in tinycontrol devicesEPSS 0.3%CVE-2024-52334MEDIUMA vulnerability has been identified in syngo.plaza VB30E (All versions < VB30E_HF07). The affected application does not encrypt the passwordEPSS 0.3%