CWE-261 Weak Encoding for Password
baseObscuring a password with a trivial encoding does not protect the password.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (60)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-43261US | high7.5 | Exploit | ||
An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components. | ||||
| CVE-1999-0504US | high7.5OT high | Exploit | ||
A Windows NT local user or administrator account has a default, null, blank, or missing password. | ||||
| CVE-2012-1803US | high8.5 | Exploit | ||
RuggedCom Rugged Operating System (ROS) 3.10.x and earlier has a factory account with a password derived from the MAC Address field in the banner, which makes it easier for remote… | ||||
| CVE-2021-21507US | critical9.8 | — | ||
Dell EMC Networking X-Series firmware versions prior to 3.0.1.8 and Dell EMC PowerEdge VRTX Switch Module firmware versions prior to 2.0.0.82 contain a Weak Password Encryption Vul… | ||||
| CVE-2020-10275US | critical9.8 | — | ||
The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is… | ||||
| CVE-2017-7905US | critical9.8OT elevated | — | ||
A Weak Cryptography for Passwords issue was discovered in General Electric (GE) Multilin SR 750 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 760 Feeder Prot… | ||||
| CVE-2023-23482US | critical9.6 | — | ||
IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious W… | ||||
| CVE-2006-2896US | medium5.0 | Exploit | ||
profile.php in FunkBoard CF0.71 allows remote attackers to change arbitrary passwords via a modified uid hidden form field in an Edit Profile action. | ||||
| CVE-2024-45273US | high7.8 | — | ||
An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used. | ||||
| CVE-2024-45394US | high7.8OT elevated | — | ||
Authenticator is a browser extension that generates two-step verification codes. In versions 7.0.0 and below, encryption keys for user data were stored encrypted at-rest using only… | ||||
| CVE-2022-45099US | high7.8OT elevated | — | ||
Dell PowerScale OneFS, versions 8.2.x-9.4.x, contain a weak encoding for a NDMP password. A malicious and privileged local attacker could potentially exploit this vulnerability, l… | ||||
| CVE-2020-14481US | high7.8 | — | ||
The DeskLock tool provided with FactoryTalk View SE uses a weak encryption algorithm that may allow a local, authenticated attacker to decipher user credentials, including the Wind… | ||||
| CVE-2025-2862US | high7.5 | — | ||
SaTECH BCU, in its firmware version 2.1.3, performs weak password encryption. This allows an attacker with access to the device's system or website to obtain the credentials, as th… | ||||
| CVE-2023-7237US | high7.5 | — | ||
Lantronix XPort sends weakly encoded credentials within web request headers.
| ||||
| CVE-2023-0525US | high7.5 | — | ||
Weak Encoding for Password vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.49.000 and prior, GT25 model versions 01.49.000 and prior, GT23 mo… | ||||
| CVE-2023-0356US | high7.5 | — | ||
SOCOMEC MODULYS GP Netvision versions 7.20 and prior lack strong encryption for credentials on HTTP connections, which could result in threat actors obtaining sensitive informatio… | ||||
| CVE-2022-38469US | high7.5 | — | ||
An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords.
| ||||
| CVE-2018-7792US | high7.5OT elevated | — | ||
A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulne… | ||||
| CVE-2012-2183US | medium6.8 | — | ||
Session fixation vulnerability in IBM Maximo Asset Management 6.2 through 7.5, as used in SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, M… | ||||
| CVE-2012-1925US | medium6.8OT elevated | — | ||
Opera before 11.62 does not ensure that a dialog window is placed on top of content windows, which makes it easier for user-assisted remote attackers to trick users into downloadin… | ||||
03
attack patterns (1)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan