Weakness (CWE)
CWE-836: Use of Password Hash Instead of Password for Authentication
The product includes a client that computes a hash of a password and sends the hash to another component, which compares the supplied hash to the hash obtained from a data store of password hashes.
Source: MITRE CWE-836
6 results · Clear filters · Feed
-
Medium 6.5
OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects
OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retrieve relations — and the subject (title) of work packages they have no permission to view — by supplyin…
-
Medium 4.3
Vikunja's Scoped API tokens with projects.background permission can delete project backgrounds
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's scoped API token enforcement for custom project background routes is method-confused. A token with only projects.background can successfully delete a project background,…
-
Medium 4.4
A use of password hash instead of password for authentication vulnerability [CWE-836] vulnerability in Fortinet FortiWe…
-
Medium 5.3
Login to the application services using only the password hash
E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash.
-
Medium 4.3
The TeleMessage service through 2025-05-05 relies on the client side (e.g., the TM SGNL app) to do MD5 hashing, and the…
-
Medium 6.2
Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100…