Use of Password Hash With Insufficient Computational Effort

The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

CVEs (127)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2017-11131 1Stashcat 1Heinekingmedia May 13, 2026 Aug 1, 2017 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. For authentication, the user password is hashed directly with SHA-512 without a salt...Show more An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. For authentication, the user password is hashed directly with SHA-512 without a salt or another key-derivation mechanism to enable a secure secret for authentication. Moreover, only the first 32 bytes of the hash are used. This allows for easy dictionary and rainbow-table attacks if an attacker has access to the password hash.Show less
CVE-2014-2354 1Cogentdatahub 1Cogent Datahub May 6, 2026 May 30, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack.
CVE-2008-1526 1Zyxel 19P 660h 61 Firmware P 660h 63 FirmwareP 660h 67 Firmware+16 more Apr 23, 2026 Mar 26, 2008 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(PE9) and 3.40(AGD.2) through 3.40(AHQ.3), do not use a salt when calculating an MD5 password hash, which makes it easier for attackers t...Show more ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(PE9) and 3.40(AGD.2) through 3.40(AHQ.3), do not use a salt when calculating an MD5 password hash, which makes it easier for attackers to crack passwords.Show less
CVE-2006-1058 2Avaya Busybox 5Aura Application Enablement Services Aura Sip Enablement ServicesBusybox+2 more Apr 16, 2026 Apr 4, 2006 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 BusyBox 1.1.1 does not use a salt when generating passwords, which makes it easier for local users to guess passwords from a stolen password file using techniques such as rainbow tables.
CVE-2005-0408 1Citrusdb 1Citrusdb Apr 16, 2026 Feb 14, 2005 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the id_hash cookie, which allows remote attackers to bypass authentication and gain privileges by calculating the MD5 checksum of th...Show more CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the id_hash cookie, which allows remote attackers to bypass authentication and gain privileges by calculating the MD5 checksum of the user name combined with the "boogaadeeboo" string, which is hard-coded in the $hidden_hash variable.Show less
CVE-2002-1657 1Postgresql 1Postgresql Apr 16, 2026 Dec 31, 2002 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 PostgreSQL uses the username for a salt when generating passwords, which makes it easier for remote attackers to guess passwords via a brute force attack.
CVE-2001-0967 1Arkeia 1Arkeia Apr 16, 2026 Aug 31, 2001 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Knox Arkeia server 4.2, and possibly other versions, uses a constant salt when encrypting passwords using the crypt() function, which makes it easier for an attacker to conduct brute force password guessing.

Previous 1 2 3 4 5 67