The administrative password is hashed using a comparatively weak, fast algorithm for the...
CVE-2026-90457
The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one au
#cwe-916
共收录 43 条相关情报。
← 返回所有主题The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that hash is w...
CVE-2026-90457
CVE-2026-90457 是一处与管理凭据存储相关的安全缺陷，问题的核心是弱口令哈希与不当文件权限两个因素相互叠加。该产品对同一条管理员密码存在两条认证路径：其中一条路径使用了强度较高的哈希算法（属于慢哈希范畴），而支撑另一条认证路径的
openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2i...
CVE-2026-81704
openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile
openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys across all users and ...
CVE-2026-81689
openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of th
FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5($_POST['password']) to add_user() and update_user_password(...
CVE-2026-80211
FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5($_
openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus
CVE-2026-81704
openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile
openssl_encrypt before 1.4.9 Weak Pepper Key Derivation
CVE-2026-81689
openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of th
VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.29, non-default builds created with WOLFCRYPT=1 and WOLFCRYPT_BACKEND route SHA-256 and...
CVE-2026-53762
VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.29, non-default builds created
A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which coul...
CVE-2026-75112
A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor
The root password hash of the device can be obtained through unencrypted information in the firmware.
CVE-2026-49005
The root password hash of the device can be obtained through unencrypted information in the firmware.
Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtain password hash to decode user credentials. Be...
CVE-2026-57310
Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker
TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or privileged access co...
CVE-2026-5040
TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the passwo
FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank Statement report handler that allows authenticated attackers to extract arbitrary database data ...
CVE-2026-40522
FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank Statement report handler that allows au
Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow or...
CVE-2026-55069
Kestra 是一个开源的事件驱动编排平台。在版本 1.3.24 之前，其 BasicAuth 认证组件存在一个安全漏洞。攻击者如果获得了对 Kestra 使用的 PostgreSQL 数据库的读访问权限，可以利用 SHA-512 哈希算法
Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterations instead of the OWASP-recommended minimum of 10 rounds. Attackers can crack password...
CVE-2026-56272
Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterations instead of the OWASP-recom
Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations. The default algorithm is HMAC-SHA1, which should only be used for legacy...
CVE-2026-9641
Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations. The default alg
QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm...
CVE-2026-25861
QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attack
QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attackers to compromise user credentials by exploiting the use ...
CVE-2026-25861
QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attack
Danelec MacGregor Voyage Data Recorder passwords are stored with a hashing method which limits...
CVE-2026-44611
Danelec MacGregor Voyage Data Recorder passwords are stored with a hashing method which limits password length and is su
Danelec MacGregor Voyage Data Recorder passwords are stored with a hashing method which limits password length and is susceptible to brute force attacks.
CVE-2026-44611
Danelec MacGregor Voyage Data Recorder passwords are stored with a hashing method which limits password length and is su