CWE-328 Use of Weak Hash
baseThe product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (111)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-45141US | critical9.8OT elevated | — | ||
Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable Sa… | ||||
| CVE-2026-28479US | critical9.1OT elevated | — | ||
OpenClaw versions prior to 2026.2.15 use SHA-1 to hash sandbox identifier cache keys for Docker and browser sandbox configurations, which is deprecated and vulnerable to collision… | ||||
| CVE-2024-48847US | critical9.1OT elevated | — | ||
MD5 Checksum Bypass vulnerabilities where found exploiting a weakness in the way an application dependency calculates or validates MD5 checksum hashes.
Affected products:
ABB AS… | ||||
| CVE-2023-46233US | critical9.1OT elevated | — | ||
crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 time… | ||||
| CVE-2023-46133US | critical9.1OT elevated | — | ||
CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript. Prior to version 2.1.0, CryptoES PBKDF2 is 1,000 times weaker than originally specified in 1993, a… | ||||
| CVE-2024-40465US | high8.8OT elevated | — | ||
An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go file | ||||
| CVE-2023-43635US | high8.8OT elevated | — | ||
Vault Key Sealed With SHA1 PCRs
The measured boot solution implemented in EVE OS leans on a PCR locking mechanism.
Different parts of the system update different PCR values… | ||||
| CVE-2023-43630US | high8.8 | — | ||
PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but
due to the change that was implemented in commit
“7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4”, fixing this issu… | ||||
| CVE-2026-21717US | medium5.9 | Exploit | ||
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that ca… | ||||
| CVE-2004-2761US | medium5.0OT elevated | Exploit | ||
The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the us… | ||||
| CVE-2023-1206US | medium5.7 | Exploit | ||
A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. A user located in the… | ||||
| CVE-2022-25156US | high8.1 | — | ||
Use of Weak Hash vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU all versions, Mitsubishi Electri… | ||||
| CVE-2019-13539US | high7.8 | — | ||
Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energy Platform (VLFX8GEN)… | ||||
| CVE-2025-54535US | high7.5 | — | ||
In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms | ||||
| CVE-2025-8260US | high7.5OT elevated | — | ||
A security flaw has been discovered in Vaelsys VaelsysV4 up to 5.1.0/5.4.0. This affects an unknown part of the file /grid/vgrid_server.php of the component Web interface. Performi… | ||||
| CVE-2025-49197US | high7.5 | — | ||
The application uses a weak password hash function, allowing an attacker to crack the weak password hash to gain access to an FTP user account. | ||||
| CVE-2024-38341US | high7.5 | — | ||
IBM Sterling Secure Proxy 6.0.0.0 through 6.0.3.1, 6.1.0.0 through 6.1.0.0, and 6.2.0.0 through 6.2.0.1 uses weaker than expected cryptographic algorithms that could allow an attac… | ||||
| CVE-2024-55885US | high7.5OT elevated | — | ||
beego is an open-source web framework for the Go programming language. Versions of beego prior to 2.3.4 use MD5 as a hashing algorithm. MD5 is no longer considered secure against w… | ||||
| CVE-2024-8452US | high7.5OT elevated | — | ||
Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNMPv3 service, allowing attackers to obtai… | ||||
| CVE-2024-47182US | high7.5 | — | ||
Dozzle is a realtime log viewer for docker containers. Before version 8.5.3, the app uses sha-256 as the hash for passwords, which leaves users susceptible to rainbow table attacks… | ||||
04
attack patterns (2)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan