Weakness (CWE)
CWE-261: Weak Encoding for Password
The product uses a weak or trivial encoding for a password.
How to prevent it (1 mitigation)
-
Passwords should be encrypted with keys that are at least 128 bits in length for adequate security.
Source: MITRE CWE-261
25 results · Clear filters · Feed
-
Medium 5.3
Improperly Stored Credentials
Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user.
-
Medium 6.3
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Weak…
-
Medium 6.2
CSL 1010 M2M 3G WiFi Module 2.2.1.4 Weak Encryption via Router.cfg
CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a weak encryption vulnerability that allows unauthenticated attackers to recover all stored secrets in plaintext by reversing a single-byte XOR cipher that uses a static key to obfuscate the config…
-
Medium 5.7
Dell Client Platform BIOS contains a Weak Encoding for Password vulnerability. An unauthenticated attacker with physica…
-
Medium 5.7
Weak password encoding in STER
Use of a weak password encoding algorithm in STER software allows the value of the password to be guessed after analyzing how passwords with known values are encoded. This issue was fixed in version 9.5.
-
Medium 6.3
Weak KSeF token encoding in Streamsoft Prestiż
Use of a custom token encoding algorithm in Streamsoft Prestiż software allows the value of the KSeF (Krajowy System e-Faktur) token to be guessed after analyzing how tokens with know values are encoded. This issue was fixed in version 20.0.380.92.
-
Medium 5.3
A vulnerability has been identified in syngo.plaza VB30E (All versions < VB30E_HF07). The affected application does not…
-
Medium 6.1
AutomationDirect CLICK Programmable Logic Controller Weak Encoding for Password
An attacker with access to the project file could use the exposed credentials to impersonate users, escalate privileges, or gain unauthorized access to systems and services. The absence of robust encryption or secure handling mechanisms increases the likeliho…
-
Medium 6.9
WEEK ENCODING FOR PASSWORDS
The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercept the web request handling the login and obtain the credentials
-
Medium 6.3
Missing Maximum Password Length Validation in Strapi Password Hashing
Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently tru…
-
Medium 6.8
WEAK ENCODING FOR PASSWORD IN DEVICE SERVER CONFIGURATION
The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercept the web request handling the login and obtain the credentials.
-
Medium 6.5
Weak encoding for password vulnerability exists in HMI ViewJet C-more series. If this vulnerability is exploited, authe…
-
Medium 6.9
Weak Encoding for Password vulnerability in saTECH BCU
SaTECH BCU, in its firmware version 2.1.3, performs weak password encryption. This allows an attacker with access to the device's system or website to obtain the credentials, as the storage methods used are not strong enough in terms of encryption.
-
Medium 5.7
Advantech ADAM-5630 Weak Encoding for Password
Advantech ADAM-5630 shares user credentials plain text between the device and the user source device during the login process.
-
Medium 5.7
Advantech ADAM-5550 Weak Encoding for Password
Advantech ADAM-5550 share user credentials with a low level of encryption, consisting of base 64 encoding.
-
Medium 5.5
ColdFusion | Weak Cryptography for Passwords (CWE-261)
ColdFusion versions 2023u7, 2021u13 and earlier are affected by a Weak Cryptography for Passwords vulnerability that could result in a security feature bypass. This vulnerability arises due to the use of insufficiently strong cryptographic algorithms or flawe…
-
Medium 6.9
Weak Encoding for Password vulnerability in Campbell Scientific CSI Web Server and RTMC
The Campbell Scientific CSI Web Server stores web authentication credentials in a file with a specific file name. Passwords within that file are stored in a weakly encoded format. There is no known way to remotely access the file unless it has been manually r…
-
Medium 5.7
Commend WS203VICM Weak Encoding for Password
A weak encoding is used to transmit credentials for WS203VICM.
-
Medium 5.7
Lantronix XPort Weak Encoding for Password
Lantronix XPort sends weakly encoded credentials within web request headers.
-
Medium 6.8
Weak encoding vulnerability in easyE4
Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the device password was stored with a weak encoding algorithm in the easyE4 program file when exported t…
-
Medium 5.3
AEM Weak Cryptography for Passwords Security feature bypass
Experience Manager versions 6.5.15.0 (and earlier) are affected by a Weak Cryptography for Passwords vulnerability that can lead to a security feature bypass. A low-privileged attacker can exploit this in order to decrypt a user's password. The attack complex…
-
Medium 6.0
Dell PowerScale OneFS, versions 8.2.x through 9.3.x contain a weak encoding for a password. A malicious local privilege…
-
Medium 5.7
SOCOMEC MODULYS GP Netvision versions 7.20 and prior lack strong encryption for credentials on HTTP connections, which …
-
Medium 5.5
Insecure crypto for storing passwords
In crypt.c of remote-login-service, the cryptographic algorithm used to cache usernames and passwords is insecure. An attacker could use this vulnerability to recover usernames and passwords from the file. This issue affects version 1.0.0-0ubuntu3 and prior v…
-
Medium 5.9
This vulnerability allows remote attackers to disclose sensitive information on affected installations of C-MORE HMI EA…