Weak Encoding for Password
CWE-261
The product uses a weak or trivial encoding for a password.
We track 12 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.9.
How this weakness is prevented
- Passwords should be encrypted with keys that are at least 128 bits in length for adequate security.
Latest Weak Encoding for Password vulnerabilities
- 7.7 High severity
Płatnik: Weak Encoding for Password
Use of a weak password encoding algorithm in Płatnik software allows a user who obtains encoded password to easily decode it. This issue was fixed in metric 334 in version 10.02.002.
- 7.3 High severity
Dock Manager: Weak Encoding for Password
During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could allow a local authenticated user to escalate privileges.
- 8.7 High severity
Lan Kontroler v3.5: Insertion of Sensitive Information Into Sent Data
Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 have two separate authentication mechanisms - one solely for interface management and one for protecting all other server resources. When the latter is turned off (which is a default se
- 7.5 High severity
saTECH BCU: Weak Encoding for Password
SaTECH BCU, in its firmware version 2.1.3, performs weak password encryption. This allows an attacker with access to the device's system or website to obtain the credentials, as the storage methods used are not strong enough in terms of encryption.
- 8.2 High severity
Streamsoft Prestiż: Weak Encoding for Password
Use of a custom password encoding algorithm in Streamsoft Prestiż software allows straightforward decoding of passwords using their encoded forms, which are stored in the application's database. One has to know the encoding algorithm, but it can be deduced by
- 7.8 High severity
mbNET.mini: Inadequate Encryption Strength
An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used.
- 7.8 High severity
Authenticator: Inadequate Encryption Strength
Authenticator is a browser extension that generates two-step verification codes. In versions 7.0.0 and below, encryption keys for user data were stored encrypted at-rest using only AES-256 and the EVP_BytesToKey KDF. Therefore, attackers with a copy of a user'
- 8.8 High severity
secdiskapp: Weak Encoding for Password
An issue in secdiskapp 1.5.1 (management program for NewQ Fingerprint Encryption Super Speed Flash Disk) allows attackers to gain escalated privileges via vsVerifyPassword and vsSetFingerPrintPower functions.
- 8.1 High severity
web-flash: Weak Encoding for Password
An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resetPassword.
- 7.5 High severity
GOT2000 Series GT27 model: Inadequate Encryption Strength
Weak Encoding for Password vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.49.000 and prior, GT25 model versions 01.49.000 and prior, GT23 model versions 01.49.000 and prior, GT21 model versions 01.49.000 and prior, GOT S
- 7.8 High severity
PowerScale OneFS: Incorrect Default Permissions
Dell PowerScale OneFS, versions 8.2.x-9.4.x, contain a weak encoding for a NDMP password. A malicious and privileged local attacker could potentially exploit this vulnerability, leading to a full system compromise
- 7.5 High severity
MODULYS GP: Weak Encoding for Password
SOCOMEC MODULYS GP Netvision versions 7.20 and prior lack strong encryption for credentials on HTTP connections, which could result in threat actors obtaining sensitive information.