Weakness (CWE)
CWE-261: Weak Encoding for Password
The product uses a weak or trivial encoding for a password.
How to prevent it (1 mitigation)
-
Passwords should be encrypted with keys that are at least 128 bits in length for adequate security.
Source: MITRE CWE-261
15 results · Clear filters · Feed
-
High 7.7
Weak password encoding in Płatnik
Use of a weak password encoding algorithm in Płatnik software allows a user who obtains encoded password to easily decode it. This issue was fixed in metric 334 in version 10.02.002.
-
High 7.3
During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could al…
-
High 8.7
Credentials exposure in tinycontrol devices
Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 have two separate authentication mechanisms - one solely for interface management and one for protecting all other server resources. When the latter is turned off (which is a default s…
-
High 8.2
Weak password encoding in Streamsoft Prestiż
Use of a custom password encoding algorithm in Streamsoft Prestiż software allows straightforward decoding of passwords using their encoded forms, which are stored in the application's database. One has to know the encoding algorithm, but it can be deduced by…
-
High 8.4
MB connect line/Helmholz: Weak encryption of configuration file
An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used.
-
High 8.1
PLANET Technology switch devices - Swctrl service exchanges weakly encoded passwords
The swctrl service is used to detect and remotely manage PLANET Technology devices. For certain switch models, the authentication tokens used during communication with this service are encoded user passwords. Due to insufficient strength, unauthorized remote …
-
High 8.8
Secret encryption vulnerable to brute-force attacks
Authenticator is a browser extension that generates two-step verification codes. In versions 7.0.0 and below, encryption keys for user data were stored encrypted at-rest using only AES-256 and the EVP_BytesToKey KDF. Therefore, attackers with a copy of a user…
-
High 8.1
An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request …
-
High 8.8
An issue in secdiskapp 1.5.1 (management program for NewQ Fingerprint Encryption Super Speed Flash Disk) allows attacke…
-
High 7.1
Weak Cryptography for Passwords vulnerability on WIC1200
A Weak Cryptography for Passwords vulnerability has been detected on WIC200 affecting version 1.1. This vulnerability allows a remote user to intercept the traffic and retrieve the credentials from another user and decode it in base64 allowing the attacker to…
-
High 7.5
Weak Encoding for Password vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.49.00…
-
High 7.8
Dell PowerScale OneFS, versions 8.2.x-9.4.x, contain a weak encoding for a NDMP password. A malicious and privileged lo…
-
High 7.5
An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and pas…
-
High 7.8
The DeskLock tool provided with FactoryTalk View SE uses a weak encryption algorithm that may allow a local, authentica…
-
High 8.8
Dell EMC Networking X-Series firmware versions prior to 3.0.1.8 and Dell EMC PowerEdge VRTX Switch Module firmware vers…