CWE-916
Use of Password Hash With Insufficient Computational Effort
Description
The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-55
CVEs mapped to this weakness (123)
page 5 of 7| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-3962 | Med | 0.36 | 5.6 | 0.00 | Jun 12, 2018 | Password recovery exploitation vulnerability in the non-certificate-based authentication mechanism in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to crack user passwords via unsalted hashes. | ||
| CVE-2006-1058 | Med | 0.36 | 5.5 | 0.00 | Apr 4, 2006 | BusyBox 1.1.1 does not use a salt when generating passwords, which makes it easier for local users to guess passwords from a stolen password file using techniques such as rainbow tables. | ||
| CVE-2026-44611 | Med | 0.35 | 5.4 | 0.00 | May 29, 2026 | Danelec MacGregor Voyage Data Recorder passwords are stored with a hashing method which limits password length and is susceptible to brute force attacks. | ||
| CVE-2024-55057 | Med | 0.35 | 5.4 | 0.00 | Dec 17, 2024 | Phpgurukul Online Birth Certificate System 1.0 suffers from insufficient password requirements which can lead to unauthorized access to user accounts. | ||
| CVE-2022-23348 | Med | 0.35 | 5.3 | 0.03 | Mar 21, 2022 | BigAnt Software BigAnt Server v5.6.06 was discovered to utilize weak password hashes. | ||
| CVE-2021-37551 | Med | 0.35 | 5.3 | 0.01 | Aug 6, 2021 | In JetBrains YouTrack before 2021.2.16363, system user passwords were hashed with SHA-256. | ||
| CVE-2019-20575 | Med | 0.35 | 5.4 | 0.00 | Mar 24, 2020 | An issue was discovered on Samsung mobile devices with P(9.0) software. The WPA3 handshake feature allows a downgrade or dictionary attack. The Samsung ID is SVE-2019-14204 (August 2019). | ||
| CVE-2019-12737 | Med | 0.35 | 5.3 | 0.01 | Oct 2, 2019 | UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing user credentials. | ||
| CVE-2026-9641 | Med | 0.34 | 5.3 | 0.00 | Jun 12, 2026 | Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations. The default algorithm is HMAC-SHA1, which should only be used for legacy systems. These versions default to using 1000 iterations. Depending on the chosen algorithm,… | ||
| CVE-2025-67168 | Med | 0.34 | 5.3 | 0.00 | Dec 17, 2025 | RiteCMS v3.1.0 was discovered to use insecure encryption to store passwords. | ||
| CVE-2022-40258 | Med | 0.34 | 5.3 | 0.00 | Jan 31, 2023 | AMI Megarac Weak password hashes for Redfish & API | ||
| CVE-2018-15717 | Med | 0.34 | 5.3 | 0.01 | Dec 12, 2018 | Open Dental before version 18.4 stores user passwords as base64 encoded MD5 hashes. | ||
| CVE-2018-1447 | Med | 0.33 | 5.1 | 0.01 | Apr 4, 2018 | The GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6) CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak password may be recovered. Note: After update the customer… | ||
| CVE-2022-40295 | Med | 0.32 | 4.9 | 0.00 | Oct 31, 2022 | The application was vulnerable to an authenticated information disclosure, allowing administrators to view unsalted user passwords, which could lead to the compromise of plaintext passwords via offline attacks. | ||
| CVE-2026-25861 | Med | 0.31 | 5.9 | 0.00 | Jun 2, 2026 | QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attackers to compromise user credentials by exploiting the use of MD5 for password hashing in the Tools::encrypt() function within classes/Tools.php, which… | ||
| CVE-2026-45027 | Med | 0.31 | 5.9 | 0.00 | May 27, 2026 | WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, when a user logs in, html/login.php hashes the submitted password using PHP's hash() function with the SHA-256 algorithm and no salt before comparing it to the stored value. The password change flow… | ||
| CVE-2023-33838 | Med | 0.29 | 4.4 | 0.00 | Jan 29, 2025 | IBM Security Verify Governance 10.0.2 Identity Manager uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input. | ||
| CVE-2020-6780 | Med | 0.29 | 4.4 | 0.01 | Jan 26, 2021 | Use of Password Hash With Insufficient Computational Effort in the database of Bosch FSM-2500 server and Bosch FSM-5000 server up to and including version 5.2 allows a remote attacker with admin privileges to dump the credentials of other users and possibly recover their… | ||
| CVE-2020-27693 | Med | 0.29 | 4.4 | 0.02 | Nov 9, 2020 | Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 stores administrative passwords using a hash that is considered outdated. | ||
| CVE-2014-0083 | Med | 0.29 | 5.5 | 0.00 | Nov 21, 2019 | The Ruby net-ldap gem before 0.11 uses a weak salt when generating SSHA passwords. |
- risk 0.36cvss 5.6epss 0.00
Password recovery exploitation vulnerability in the non-certificate-based authentication mechanism in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to crack user passwords via unsalted hashes.
- risk 0.36cvss 5.5epss 0.00
BusyBox 1.1.1 does not use a salt when generating passwords, which makes it easier for local users to guess passwords from a stolen password file using techniques such as rainbow tables.
- risk 0.35cvss 5.4epss 0.00
Danelec MacGregor Voyage Data Recorder passwords are stored with a hashing method which limits password length and is susceptible to brute force attacks.
- risk 0.35cvss 5.4epss 0.00
Phpgurukul Online Birth Certificate System 1.0 suffers from insufficient password requirements which can lead to unauthorized access to user accounts.
- risk 0.35cvss 5.3epss 0.03
BigAnt Software BigAnt Server v5.6.06 was discovered to utilize weak password hashes.
- risk 0.35cvss 5.3epss 0.01
In JetBrains YouTrack before 2021.2.16363, system user passwords were hashed with SHA-256.
- risk 0.35cvss 5.4epss 0.00
An issue was discovered on Samsung mobile devices with P(9.0) software. The WPA3 handshake feature allows a downgrade or dictionary attack. The Samsung ID is SVE-2019-14204 (August 2019).
- risk 0.35cvss 5.3epss 0.01
UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing user credentials.
- risk 0.34cvss 5.3epss 0.00
Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations. The default algorithm is HMAC-SHA1, which should only be used for legacy systems. These versions default to using 1000 iterations. Depending on the chosen algorithm,…
- risk 0.34cvss 5.3epss 0.00
RiteCMS v3.1.0 was discovered to use insecure encryption to store passwords.
- risk 0.34cvss 5.3epss 0.00
AMI Megarac Weak password hashes for Redfish & API
- risk 0.34cvss 5.3epss 0.01
Open Dental before version 18.4 stores user passwords as base64 encoded MD5 hashes.
- risk 0.33cvss 5.1epss 0.01
The GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6) CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak password may be recovered. Note: After update the customer…
- risk 0.32cvss 4.9epss 0.00
The application was vulnerable to an authenticated information disclosure, allowing administrators to view unsalted user passwords, which could lead to the compromise of plaintext passwords via offline attacks.
- risk 0.31cvss 5.9epss 0.00
QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attackers to compromise user credentials by exploiting the use of MD5 for password hashing in the Tools::encrypt() function within classes/Tools.php, which…
- risk 0.31cvss 5.9epss 0.00
WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, when a user logs in, html/login.php hashes the submitted password using PHP's hash() function with the SHA-256 algorithm and no salt before comparing it to the stored value. The password change flow…
- risk 0.29cvss 4.4epss 0.00
IBM Security Verify Governance 10.0.2 Identity Manager uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.
- risk 0.29cvss 4.4epss 0.01
Use of Password Hash With Insufficient Computational Effort in the database of Bosch FSM-2500 server and Bosch FSM-5000 server up to and including version 5.2 allows a remote attacker with admin privileges to dump the credentials of other users and possibly recover their…
- risk 0.29cvss 4.4epss 0.02
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 stores administrative passwords using a hash that is considered outdated.
- risk 0.29cvss 5.5epss 0.00
The Ruby net-ldap gem before 0.11 uses a weak salt when generating SSHA passwords.