Falhas do tipo CWE-261

41 resultados

Codificação fraca de senha

Senhas são armazenadas ou transmitidas usando métodos de codificação inadequados (como Base64, ROT13 ou sem hash), em vez de algoritmos criptográficos apropriados. Isso permite que um atacante com acesso aos dados recupere a senha em texto claro ou com esforço computacional trivial.

Exemplo

Um sistema salva senhas em banco de dados codificadas apenas em Base64, ou transmite credenciais via HTTP sem criptografia. Um atacante que captura a requisição ou acessa o banco consegue decodificar e obter a senha original em segundos.

Como mitigar

Use sempre funções de hash iterativas e salted apropriadas (bcrypt, Argon2, PBKDF2) para armazenar senhas. Na transmissão, enforce HTTPS com TLS 1.2+. Nunca use algoritmos de reversão (Base64, ROT13) ou hashes simples (MD5, SHA1 sem salt).

CVE-2020-10919MEDIUMThis vulnerability allows remote attackers to disclose sensitive information on affected installations of C-MORE HMI EA9 Firmware version 6.EPSS 1.6%CVE-2017-7905—A Weak Cryptography for Passwords issue was discovered in General Electric (GE) Multilin SR 750 Feeder Protection Relay, firmware versions pEPSS 1.3%CVE-2020-10275CRITICALRVD#2565: Weak token generation for the REST API.EPSS 1.0%CVE-2023-22271MEDIUMAEM Weak Cryptography for Passwords Security feature bypassEPSS 0.8%CVE-2025-31229CRITICALA logic issue was addressed with improved checks. This issue is fixed in iOS 18.6 and iPadOS 18.6. Passcode may be read aloud by VoiceOver.EPSS 0.7%CVE-2023-0525HIGHWeak Encoding for Password vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.49.000 and prior, GT25 modEPSS 0.7%CVE-2022-38469HIGH An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords. EPSS 0.6%CVE-2021-21507HIGHDell EMC Networking X-Series firmware versions prior to 3.0.1.8 and Dell EMC PowerEdge VRTX Switch Module firmware versions prior to 2.0.0.8EPSS 0.5%CVE-2023-0356MEDIUM SOCOMEC MODULYS GP Netvision versions 7.20 and prior lack strong encryption for credentials on HTTP connections, which could result in threEPSS 0.5%CVE-2024-28270HIGHAn issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resEPSS 0.4%CVE-2024-0556HIGHWeak Cryptography for Passwords vulnerability on WIC1200EPSS 0.4%CVE-2022-35931LOWNextcloud Password Policy's generated passwords are not fully validated by HIBPValidatorEPSS 0.4%CVE-2025-25298MEDIUMMissing Maximum Password Length Validation in Strapi Password HashingEPSS 0.4%CVE-2024-7407HIGHWeak password encoding in Streamsoft PrestiżEPSS 0.4%CVE-2024-37187MEDIUMAdvantech ADAM-5550 Weak Encoding for PasswordEPSS 0.4%CVE-2024-8455HIGHPLANET Technology switch devices - Swctrl service exchanges weakly encoded passwordsEPSS 0.3%CVE-2024-34113MEDIUMColdFusion | Weak Cryptography for Passwords (CWE-261)EPSS 0.3%CVE-2023-7237MEDIUMLantronix XPort Weak Encoding for PasswordEPSS 0.3%CVE-2025-11500HIGHCredentials exposure in tinycontrol devicesEPSS 0.3%CVE-2024-52334MEDIUMA vulnerability has been identified in syngo.plaza VB30E (All versions < VB30E_HF07). The affected application does not encrypt the passwordEPSS 0.3%