CWE-261 Weak Encoding for Password
baseObscuring a password with a trivial encoding does not protect the password.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (60)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-43261US | high7.5 | Exploit | ||
An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components. | ||||
| CVE-1999-0504US | high7.5OT hoch | Exploit | ||
A Windows NT local user or administrator account has a default, null, blank, or missing password. | ||||
| CVE-2012-1803US | high8.5 | Exploit | ||
RuggedCom Rugged Operating System (ROS) 3.10.x and earlier has a factory account with a password derived from the MAC Address field in the banner, which makes it easier for remote… | ||||
| CVE-2021-21507US | critical9.8 | — | ||
Dell EMC Networking X-Series firmware versions prior to 3.0.1.8 and Dell EMC PowerEdge VRTX Switch Module firmware versions prior to 2.0.0.82 contain a Weak Password Encryption Vul… | ||||
| CVE-2020-10275US | critical9.8 | — | ||
The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is… | ||||
| CVE-2017-7905US | critical9.8OT erhöht | — | ||
A Weak Cryptography for Passwords issue was discovered in General Electric (GE) Multilin SR 750 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 760 Feeder Prot… | ||||
| CVE-2023-23482US | critical9.6 | — | ||
IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious W… | ||||
| CVE-2006-2896US | medium5.0 | Exploit | ||
profile.php in FunkBoard CF0.71 allows remote attackers to change arbitrary passwords via a modified uid hidden form field in an Edit Profile action. | ||||
| CVE-2024-45273US | high7.8 | — | ||
An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used. | ||||
| CVE-2024-45394US | high7.8OT erhöht | — | ||
Authenticator is a browser extension that generates two-step verification codes. In versions 7.0.0 and below, encryption keys for user data were stored encrypted at-rest using only… | ||||
| CVE-2022-45099US | high7.8OT erhöht | — | ||
Dell PowerScale OneFS, versions 8.2.x-9.4.x, contain a weak encoding for a NDMP password. A malicious and privileged local attacker could potentially exploit this vulnerability, l… | ||||
| CVE-2020-14481US | high7.8 | — | ||
The DeskLock tool provided with FactoryTalk View SE uses a weak encryption algorithm that may allow a local, authenticated attacker to decipher user credentials, including the Wind… | ||||
| CVE-2025-2862US | high7.5 | — | ||
SaTECH BCU, in its firmware version 2.1.3, performs weak password encryption. This allows an attacker with access to the device's system or website to obtain the credentials, as th… | ||||
| CVE-2023-7237US | high7.5 | — | ||
Lantronix XPort sends weakly encoded credentials within web request headers.
| ||||
| CVE-2023-0525US | high7.5 | — | ||
Weak Encoding for Password vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.49.000 and prior, GT25 model versions 01.49.000 and prior, GT23 mo… | ||||
| CVE-2023-0356US | high7.5 | — | ||
SOCOMEC MODULYS GP Netvision versions 7.20 and prior lack strong encryption for credentials on HTTP connections, which could result in threat actors obtaining sensitive informatio… | ||||
| CVE-2022-38469US | high7.5 | — | ||
An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords.
| ||||
| CVE-2018-7792US | high7.5OT erhöht | — | ||
A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulne… | ||||
| CVE-2012-2183US | medium6.8 | — | ||
Session fixation vulnerability in IBM Maximo Asset Management 6.2 through 7.5, as used in SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, M… | ||||
| CVE-2012-1925US | medium6.8OT erhöht | — | ||
Opera before 11.62 does not ensure that a dialog window is placed on top of content windows, which makes it easier for user-assisted remote attackers to trick users into downloadin… | ||||
03
Angriffsmuster (1)
CAPEC-Angriffsmuster, die dies ausnutzen.
04
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan