CWE-759 Use of a One-Way Hash without a Salt
variantThe product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (31)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-45787US | critical9.1 | — | ||
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.9.5, deterministic AES-192-CBC with a fixed zero IV, constant KDF salt, and no… | ||||
| CVE-2023-23840US | high7.2 | — | ||
The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute a… | ||||
| CVE-2025-36253US | high7.5 | — | ||
IBM Concert 1.0.0 through 2.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. | ||||
| CVE-2025-34208US | high7.5OT elevated | — | ||
Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) store user passwords using unsalted SHA-512 hashes with a fall-back to unsalted SH… | ||||
| CVE-2020-25164US | high7.5 | — | ||
A vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers to recover user credentials… | ||||
| CVE-2021-22774US | high7.5 | — | ||
A CWE-759: Use of a One-Way Hash without a Salt vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all… | ||||
| CVE-2020-16244US | high7.2 | — | ||
GE Digital APM Classic, Versions 4.4 and prior. Salt is not used for hash calculation of passwords, making it possible to decrypt passwords. This design flaw, along with the IDOR v… | ||||
| CVE-2026-6217US | medium6.3 | — | ||
Use of a One-Way hash without a salt vulnerability in Pik Online Software Solutions Inc. Pik Online Portal allows Cryptanalysis.
This issue affects Pik Online Portal: through 3.5.… | ||||
| CVE-2025-36271US | medium5.9 | — | ||
IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. | ||||
| CVE-2025-15631US | medium5.9 | — | ||
A
cryptographic weakness exists in affected Omada devices where site credentials
are protected using a legacy hashing algorithm that does not provide sufficient
protection.… | ||||
| CVE-2025-15544US | medium5.9 | — | ||
A cryptographic
weakness exists in the Omada device adoption process. During adoption, authentication credentials associated
with site management are transmitted using a weak hash… | ||||
| CVE-2026-46089US | medium5.5 | — | ||
In the Linux kernel, the following vulnerability has been resolved:
zram: do not forget to endio for partial discard requests
As reported by Qu Wenruo and Avinesh Kumar, the foll… | ||||
| CVE-2021-21253US | medium5.3 | — | ||
OnlineVotingSystem is an open source project hosted on GitHub. OnlineVotingSystem before version 1.1.2 hashes user passwords without a salt, which is vulnerable to dictionary attac… | ||||
| CVE-2023-33838US | medium4.9 | — | ||
IBM Security Verify Governance 10.0.2 Identity Manager
uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does… | ||||
| CVE-2024-8453US | medium4.9 | — | ||
Certain switch models from PLANET Technology use an insecure hashing function to hash user passwords without being salted. Remote attackers with administrator privileges can read c… | ||||
| CVE-2026-96552US | low3.1 | — | ||
A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function MD5.getMD5 of the file ssm_pro/src/main/j… | ||||
| CVE-2023-1430US | — | Exploit | ||
The FluentCRM - Marketing Automation For WordPress plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 2.8.01 due to the use… | ||||
| CVE-2026-98962US | — | — | ||
In the Linux kernel, the following vulnerability has been resolved:
btrfs: free iov when btrfs_uring_read_extent() fails
After btrfs_uring_read_extent(), the caller always jumped… | ||||
| CVE-2026-89637US | — | — | ||
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2
When a valid primary TR… | ||||
| CVE-2026-80650US | — | — | ||
In the Linux kernel, the following vulnerability has been resolved:
media: atomisp: gc2235: fix UAF and memory leak
gc2235_probe() handles its error paths incorrectly.
If media_… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan