Total
63 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-26113 | 1 Fortinet | 1 Fortiwan | 2022-04-13 | 5.0 MEDIUM | 7.5 HIGH |
| A use of a one-way hash with a predictable salt vulnerability [CWE-760] in FortiWAN before 4.5.9 may allow an attacker who has previously come in possession of the password file to potentially guess passwords therein stored. | |||||
| CVE-2022-1235 | 1 Livehelperchat | 1 Live Helper Chat | 2022-04-13 | 6.4 MEDIUM | 8.2 HIGH |
| Weak secrethash can be brute-forced in GitHub repository livehelperchat/livehelperchat prior to 3.96. | |||||
| CVE-2022-0022 | 1 Paloaltonetworks | 1 Pan-os | 2022-03-11 | 4.6 MEDIUM | 4.4 MEDIUM |
| Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accounts are not created with a sufficient level of computational effort, which allows for password cracking attacks on accounts in normal (non-FIPS-CC) operational mode. An attacker must have access to the account password hashes to take advantage of this weakness and can acquire those hashes if they are able to gain access to the PAN-OS software configuration. Fixed versions of PAN-OS software use a secure cryptographic algorithm for account password hashes. This issue does not impact Prisma Access firewalls. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.21; All versions of PAN-OS 9.0; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11; PAN-OS 10.0 versions earlier than PAN-OS 10.0.7. | |||||
| CVE-2021-43989 | 1 Myscada | 1 Mypro | 2021-12-29 | 5.0 MEDIUM | 7.5 HIGH |
| mySCADA myPRO Versions 8.20.0 and prior stores passwords using MD5, which may allow an attacker to crack the previously retrieved password hashes. | |||||
| CVE-2019-0030 | 1 Juniper | 3 Advanced Threat Prevention Firmware, Atp400, Atp700 | 2021-11-23 | 4.0 MEDIUM | 7.2 HIGH |
| Juniper ATP uses DES and a hardcoded salt for password hashing, allowing for trivial de-hashing of the password file contents. This issue affects Juniper ATP 5.0 versions prior to 5.0.3. | |||||
| CVE-2021-39182 | 1 Enrocrypt Project | 1 Enrocrypt | 2021-11-09 | 5.0 MEDIUM | 7.5 HIGH |
| EnroCrypt is a Python module for encryption and hashing. Prior to version 1.1.4, EnroCrypt used the MD5 hashing algorithm in the hashing file. Beginners who are unfamiliar with hashes can face problems as MD5 is considered an insecure hashing algorithm. The vulnerability is patched in v1.1.4 of the product. As a workaround, users can remove the `MD5` hashing function from the file `hashing.py`. | |||||
| CVE-2019-3907 | 1 Identicard | 1 Premisys Id | 2021-11-02 | 5.0 MEDIUM | 7.5 HIGH |
| Premisys Identicard version 3.1.190 stores user credentials and other sensitive information with a known weak encryption method (MD5 hash of a salt and password). | |||||
| CVE-2021-38400 | 1 Bostonscientific | 2 Zoom Latitude Pogrammer\/recorder\/monitor 3120, Zoom Latitude Pogrammer\/recorder\/monitor 3120 Firmware | 2021-10-13 | 4.6 MEDIUM | 6.8 MEDIUM |
| An attacker with physical access to Boston Scientific Zoom Latitude Model 3120 can remove the hard disk drive or create a specially crafted USB to extract the password hash for brute force reverse engineering of the system password. | |||||
| CVE-2021-32519 | 1 Qsan | 3 Sanos, Storage Manager, Xevo | 2021-09-20 | 5.0 MEDIUM | 7.5 HIGH |
| Use of password hash with insufficient computational effort vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to recover the plain-text password by brute-forcing the MD5 hash. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.2, QSAN XEVO v2.1.0, and QSAN SANOS v2.1.0. | |||||
| CVE-2021-32596 | 1 Fortinet | 1 Fortiportal | 2021-08-10 | 5.0 MEDIUM | 7.5 HIGH |
| A use of one-way hash with a predictable salt vulnerability in the password storing mechanism of FortiPortal 6.0.0 through 6.04 may allow an attacker already in possession of the password store to decrypt the passwords by means of precomputed tables. | |||||
| CVE-2021-22774 | 1 Schneider-electric | 12 Evlink City Evc1s22p4, Evlink City Evc1s22p4 Firmware, Evlink City Evc1s7p4 and 9 more | 2021-07-28 | 5.0 MEDIUM | 7.5 HIGH |
| A CWE-759: Use of a One-Way Hash without a Salt vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could lead an attacker to get knowledge of charging station user account credentials using dictionary attacks techniques. | |||||
| CVE-2019-19766 | 1 Bitwarden | 1 Server | 2021-07-21 | 5.0 MEDIUM | 7.5 HIGH |
| The Bitwarden server through 1.32.0 has a potentially unwanted KDF. | |||||
| CVE-2019-9080 | 1 Domainmod | 1 Domainmod | 2021-07-21 | 5.0 MEDIUM | 7.5 HIGH |
| DomainMOD before 4.14.0 uses MD5 without a salt for password storage. | |||||
| CVE-2020-10538 | 1 Epikur | 1 Epikur | 2021-07-21 | 2.1 LOW | 5.5 MEDIUM |
| An issue was discovered in Epikur before 20.1.1. It stores the secret passwords of the users as MD5 hashes in the database. MD5 can be brute-forced efficiently and should not be used for such purposes. Additionally, since no salt is used, rainbow tables can speed up the attack. | |||||
| CVE-2019-20138 | 1 Http Authentication Library Project | 1 Http Authentication Library | 2021-07-21 | 5.0 MEDIUM | 7.5 HIGH |
| The HTTP Authentication library before 2019-12-27 for Nim has weak password hashing because the default algorithm for libsodium's crypto_pwhash_str is not used. | |||||
| CVE-2019-7649 | 1 Cmswing | 1 Cmswing | 2021-07-21 | 5.0 MEDIUM | 7.5 HIGH |
| global.encryptPassword in bootstrap/global.js in CMSWing 1.3.7 relies on multiple MD5 operations for password hashing. | |||||
| CVE-2020-25754 | 1 Enphase | 2 Envoy, Envoy Firmware | 2021-06-28 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered on Enphase Envoy R3.x and D4.x devices. There is a custom PAM module for user authentication that circumvents traditional user authentication. This module uses a password derived from the MD5 hash of the username and serial number. The serial number can be retrieved by an unauthenticated user at /info.xml. Attempts to change the user password via passwd or other tools have no effect. | |||||
| CVE-2021-22741 | 1 Schneider-electric | 3 Clearscada, Ecostruxure Geo Scada Expert 2019, Ecostruxure Geo Scada Expert 2020 | 2021-06-07 | 4.6 MEDIUM | 6.7 MEDIUM |
| Use of Password Hash with Insufficient Computational Effort vulnerability exists in ClearSCADA (all versions), EcoStruxure Geo SCADA Expert 2019 (all versions), and EcoStruxure Geo SCADA Expert 2020 (V83.7742.1 and prior), which could cause the revealing of account credentials when server database files are available. Exposure of these files to an attacker can make the system vulnerable to password decryption attacks. Note that “.sde” configuration export files do not contain user account password hashes. | |||||
| CVE-2021-33563 | 1 Koel | 1 Koel | 2021-06-03 | 5.0 MEDIUM | 7.5 HIGH |
| Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username. This might make brute-force attacks easier. | |||||
| CVE-2019-20466 | 1 Sannce | 2 Smart Hd Wifi Security Camera Ean 2 950004 595317, Smart Hd Wifi Security Camera Ean 2 950004 595317 Firmware | 2021-04-07 | 7.2 HIGH | 7.8 HIGH |
| An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. A local attacker with the "default" account is capable of reading the /etc/passwd file, which contains a weakly hashed root password. By taking this hash and cracking it, the attacker can obtain root rights on the device. | |||||