Weakness (CWE)
CWE-261: Weak Encoding for Password
The product uses a weak or trivial encoding for a password.
How to prevent it (1 mitigation)
-
Passwords should be encrypted with keys that are at least 128 bits in length for adequate security.
Source: MITRE CWE-261
3 results · Clear filters · Feed
-
Low 3.3
Weak encoding for password in UDS services
Access to critical Unified Diagnostics Services (UDS) of the Modular Infotainment Platform 3 (MIB3) infotainment is transmitted via Controller Area Network (CAN) bus in a form that can be easily decoded by attackers with physical access to the vehicle. Vulner…
-
Low 2.7
Nextcloud Password Policy's generated passwords are not fully validated by HIBPValidator
Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, 23.0.7, and 24.0.3 the random password generator may, in very rare cases, generate common passwords that the validator …
-
Low 3.0
MD5 hash support in github.com/foxcpp/maddy
### Impact This vulnerability affects maddy 0.5.1, 0.5.0 users using auth.shadow module and an extremely outdated system that still allows MD5 hashes in /etc/shadows. ### Patches Patch is available as part of the 0.5.2 release. ### Workarounds Ensure MD5 hash…