Threats Tagged 'cwe-916'

Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations. The default algorithm is HMAC-SHA1, which should only be used for legacy systems. These versions default to using 1000 iterations. Depending on the chosen algorithm, 220,000 to 1,400,000 iterations should be used.

Version 3.0.7 of the Securly Chrome Extension uses EVP_BytesToKey key derivation with MD5 and a single iteration for AES encryption. MD5 has been broken since 2004 and a single iteration provides no key stretching.

The Danelec MacGregor Voyage Data Recorder (VDR) G4e uses a password hashing method that limits password length and is vulnerable to brute force attacks due to insufficient computational effort. This weakness could allow attackers with network access and low privileges to recover passwords, impacting confidentiality. The vulnerability has a medium severity rating with a CVSS score of 5.4. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, when a user logs in, html/login.php hashes the submitted password using PHP's hash() function with the SHA-256 algorithm and no salt before comparing it to the stored value. The password change flow in controle/FuncionarioControle.php follows the same pattern. SHA-256 is a general-purpose cryptographic hash built for speed, not password storage. Without a salt, identical passwords produce identical digests, making the entire hash database vulnerable to a single precomputed rainbow table lookup. This vulnerability is fixed in 3.7.3.