Weakness (CWE)
CWE-261: Weak Encoding for Password
The product uses a weak or trivial encoding for a password.
How to prevent it (1 mitigation)
-
Passwords should be encrypted with keys that are at least 128 bits in length for adequate security.
Source: MITRE CWE-261
46 results · Feed
-
High 7.7
Weak password encoding in Płatnik
Use of a weak password encoding algorithm in Płatnik software allows a user who obtains encoded password to easily decode it. This issue was fixed in metric 334 in version 10.02.002.
-
Medium 5.3
Improperly Stored Credentials
Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user.
-
Medium 6.3
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Weak…
-
High 7.3
During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could al…
-
Medium 6.2
CSL 1010 M2M 3G WiFi Module 2.2.1.4 Weak Encryption via Router.cfg
CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a weak encryption vulnerability that allows unauthenticated attackers to recover all stored secrets in plaintext by reversing a single-byte XOR cipher that uses a static key to obfuscate the config…
-
Medium 5.7
Dell Client Platform BIOS contains a Weak Encoding for Password vulnerability. An unauthenticated attacker with physica…
-
Medium 5.7
Weak password encoding in STER
Use of a weak password encoding algorithm in STER software allows the value of the password to be guessed after analyzing how passwords with known values are encoded. This issue was fixed in version 9.5.
-
High 8.7
Credentials exposure in tinycontrol devices
Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 have two separate authentication mechanisms - one solely for interface management and one for protecting all other server resources. When the latter is turned off (which is a default s…
-
Medium 6.3
Weak KSeF token encoding in Streamsoft Prestiż
Use of a custom token encoding algorithm in Streamsoft Prestiż software allows the value of the KSeF (Krajowy System e-Faktur) token to be guessed after analyzing how tokens with know values are encoded. This issue was fixed in version 20.0.380.92.
-
Medium 5.3
A vulnerability has been identified in syngo.plaza VB30E (All versions < VB30E_HF07). The affected application does not…
-
Medium 6.1
AutomationDirect CLICK Programmable Logic Controller Weak Encoding for Password
An attacker with access to the project file could use the exposed credentials to impersonate users, escalate privileges, or gain unauthorized access to systems and services. The absence of robust encryption or secure handling mechanisms increases the likeliho…
-
Medium 6.9
WEEK ENCODING FOR PASSWORDS
The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercept the web request handling the login and obtain the credentials
-
Medium 6.3
Missing Maximum Password Length Validation in Strapi Password Hashing
Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently tru…
-
Medium 6.8
WEAK ENCODING FOR PASSWORD IN DEVICE SERVER CONFIGURATION
The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercept the web request handling the login and obtain the credentials.
-
Critical 9.1
A logic issue was addressed with improved checks. This issue is fixed in iOS 18.6 and iPadOS 18.6. Passcode may be read…
-
Medium 6.5
Weak encoding for password vulnerability exists in HMI ViewJet C-more series. If this vulnerability is exploited, authe…
-
Medium 6.9
Weak Encoding for Password vulnerability in saTECH BCU
SaTECH BCU, in its firmware version 2.1.3, performs weak password encryption. This allows an attacker with access to the device's system or website to obtain the credentials, as the storage methods used are not strong enough in terms of encryption.
-
High 8.2
Weak password encoding in Streamsoft Prestiż
Use of a custom password encoding algorithm in Streamsoft Prestiż software allows straightforward decoding of passwords using their encoded forms, which are stored in the application's database. One has to know the encoding algorithm, but it can be deduced by…
-
High 8.4
MB connect line/Helmholz: Weak encryption of configuration file
An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used.
-
High 8.1
PLANET Technology switch devices - Swctrl service exchanges weakly encoded passwords
The swctrl service is used to detect and remotely manage PLANET Technology devices. For certain switch models, the authentication tokens used during communication with this service are encoded user passwords. Due to insufficient strength, unauthorized remote …
-
Medium 5.7
Advantech ADAM-5630 Weak Encoding for Password
Advantech ADAM-5630 shares user credentials plain text between the device and the user source device during the login process.
-
Medium 5.7
Advantech ADAM-5550 Weak Encoding for Password
Advantech ADAM-5550 share user credentials with a low level of encryption, consisting of base 64 encoding.
-
High 8.8
Secret encryption vulnerable to brute-force attacks
Authenticator is a browser extension that generates two-step verification codes. In versions 7.0.0 and below, encryption keys for user data were stored encrypted at-rest using only AES-256 and the EVP_BytesToKey KDF. Therefore, attackers with a copy of a user…
-
Medium 5.5
ColdFusion | Weak Cryptography for Passwords (CWE-261)
ColdFusion versions 2023u7, 2021u13 and earlier are affected by a Weak Cryptography for Passwords vulnerability that could result in a security feature bypass. This vulnerability arises due to the use of insufficiently strong cryptographic algorithms or flawe…
-
Medium 6.9
Weak Encoding for Password vulnerability in Campbell Scientific CSI Web Server and RTMC
The Campbell Scientific CSI Web Server stores web authentication credentials in a file with a specific file name. Passwords within that file are stored in a weakly encoded format. There is no known way to remotely access the file unless it has been manually r…
-
High 8.1
An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request …
-
High 8.8
An issue in secdiskapp 1.5.1 (management program for NewQ Fingerprint Encryption Super Speed Flash Disk) allows attacke…
-
Medium 5.7
Commend WS203VICM Weak Encoding for Password
A weak encoding is used to transmit credentials for WS203VICM.
-
Medium 5.7
Lantronix XPort Weak Encoding for Password
Lantronix XPort sends weakly encoded credentials within web request headers.
-
High 7.1
Weak Cryptography for Passwords vulnerability on WIC1200
A Weak Cryptography for Passwords vulnerability has been detected on WIC200 affecting version 1.1. This vulnerability allows a remote user to intercept the traffic and retrieve the credentials from another user and decode it in base64 allowing the attacker to…
-
Low 3.3
Weak encoding for password in UDS services
Access to critical Unified Diagnostics Services (UDS) of the Modular Infotainment Platform 3 (MIB3) infotainment is transmitted via Controller Area Network (CAN) bus in a form that can be easily decoded by attackers with physical access to the vehicle. Vulner…
-
Medium 6.8
Weak encoding vulnerability in easyE4
Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the device password was stored with a weak encoding algorithm in the easyE4 program file when exported t…
-
High 7.5
Weak Encoding for Password vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.49.00…
-
Medium 5.3
AEM Weak Cryptography for Passwords Security feature bypass
Experience Manager versions 6.5.15.0 (and earlier) are affected by a Weak Cryptography for Passwords vulnerability that can lead to a security feature bypass. A low-privileged attacker can exploit this in order to decrypt a user's password. The attack complex…
-
Medium 6.0
Dell PowerScale OneFS, versions 8.2.x through 9.3.x contain a weak encoding for a password. A malicious local privilege…
-
High 7.8
Dell PowerScale OneFS, versions 8.2.x-9.4.x, contain a weak encoding for a NDMP password. A malicious and privileged lo…
-
Medium 5.7
SOCOMEC MODULYS GP Netvision versions 7.20 and prior lack strong encryption for credentials on HTTP connections, which …
-
High 7.5
An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and pas…
-
Low 2.7
Nextcloud Password Policy's generated passwords are not fully validated by HIBPValidator
Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, 23.0.7, and 24.0.3 the random password generator may, in very rare cases, generate common passwords that the validator …
-
High 7.8
The DeskLock tool provided with FactoryTalk View SE uses a weak encryption algorithm that may allow a local, authentica…