Common Weakness Enumeration
CWE-261
AllowedWeak Encoding for Password
Abstraction: Base · Status: Incomplete
Obscuring a password with a trivial encoding does not protect the password.
77 vulnerabilities reference this CWE, most recent first.
GHSA-QH54-9VC5-M9FG
Vulnerability from github – Published: 2021-10-12 16:06 – Updated: 2021-10-11 21:16
VLAI
Summary
MD5 hash support in github.com/foxcpp/maddy
Details
Impact
This vulnerability affects maddy 0.5.1, 0.5.0 users using auth.shadow module and an extremely outdated system that still allows MD5 hashes in /etc/shadows.
Patches
Patch is available as part of the 0.5.2 release.
Workarounds
Ensure MD5 hashes are not present in /etc/shadow.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/foxcpp/maddy"
},
"ranges": [
{
"events": [
{
"introduced": "0.5.0"
},
{
"fixed": "0.5.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-261"
],
"github_reviewed": true,
"github_reviewed_at": "2021-10-11T21:16:02Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "### Impact\n\nThis vulnerability affects maddy 0.5.1, 0.5.0 users using auth.shadow module\nand an extremely outdated system that still allows MD5 hashes in \n/etc/shadows.\n\n### Patches\n\nPatch is available as part of the 0.5.2 release.\n\n### Workarounds\n\nEnsure MD5 hashes are not present in /etc/shadow.\n",
"id": "GHSA-qh54-9vc5-m9fg",
"modified": "2021-10-11T21:16:02Z",
"published": "2021-10-12T16:06:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/foxcpp/maddy/security/advisories/GHSA-qh54-9vc5-m9fg"
},
{
"type": "PACKAGE",
"url": "https://github.com/foxcpp/maddy"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "MD5 hash support in github.com/foxcpp/maddy"
}
GHSA-R597-7J2H-6248
Vulnerability from github – Published: 2024-10-15 12:30 – Updated: 2024-10-15 12:30
VLAI
Details
An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used.
Severity
8.4 (High)
{
"affected": [],
"aliases": [
"CVE-2024-45273"
],
"database_specific": {
"cwe_ids": [
"CWE-261",
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-15T11:15:11Z",
"severity": "HIGH"
},
"details": "An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used.",
"id": "GHSA-r597-7j2h-6248",
"modified": "2024-10-15T12:30:37Z",
"published": "2024-10-15T12:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45273"
},
{
"type": "WEB",
"url": "https://cert.vde.com/en/advisories/VDE-2024-056"
},
{
"type": "WEB",
"url": "https://cert.vde.com/en/advisories/VDE-2024-066"
},
{
"type": "WEB",
"url": "https://cert.vde.com/en/advisories/VDE-2024-068"
},
{
"type": "WEB",
"url": "https://cert.vde.com/en/advisories/VDE-2024-069"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V3Q5-XFQM-WPF2
Vulnerability from github – Published: 2025-07-30 00:32 – Updated: 2025-11-03 21:34
VLAI
Details
A logic issue was addressed with improved checks. This issue is fixed in iOS 18.6 and iPadOS 18.6. Passcode may be read aloud by VoiceOver.
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-31229"
],
"database_specific": {
"cwe_ids": [
"CWE-261"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-30T00:15:30Z",
"severity": "CRITICAL"
},
"details": "A logic issue was addressed with improved checks. This issue is fixed in iOS 18.6 and iPadOS 18.6. Passcode may be read aloud by VoiceOver.",
"id": "GHSA-v3q5-xfqm-wpf2",
"modified": "2025-11-03T21:34:11Z",
"published": "2025-07-30T00:32:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31229"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/124147"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Jul/30"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W45C-829M-RQ5V
Vulnerability from github – Published: 2026-08-13 15:34 – Updated: 2026-08-13 15:34
VLAI
Details
During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could allow a local authenticated user to escalate privileges.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-63424"
],
"database_specific": {
"cwe_ids": [
"CWE-261"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-13T15:19:55Z",
"severity": "HIGH"
},
"details": "During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could allow a local authenticated user to escalate privileges.",
"id": "GHSA-w45c-829m-rq5v",
"modified": "2026-08-13T15:34:43Z",
"published": "2026-08-13T15:34:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63424"
},
{
"type": "WEB",
"url": "https://support.lenovo.com/us/en/product_security/LEN-223470"
},
{
"type": "WEB",
"url": "https://support.lenovo.com/us/en/solutions/ht037099#dm"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-WGCP-RFQ6-33JH
Vulnerability from github – Published: 2026-06-09 21:32 – Updated: 2026-06-09 21:32
VLAI
Details
Dell Client Platform BIOS contains a Weak Encoding for Password vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Elevation of Privileges.
Severity
5.7 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-40639"
],
"database_specific": {
"cwe_ids": [
"CWE-261"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-09T19:17:53Z",
"severity": "MODERATE"
},
"details": "Dell Client Platform BIOS contains a Weak Encoding for Password vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Elevation of Privileges.",
"id": "GHSA-wgcp-rfq6-33jh",
"modified": "2026-06-09T21:32:36Z",
"published": "2026-06-09T21:32:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40639"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000453482/dsa-2026-197"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WMPF-WH48-4X49
Vulnerability from github – Published: 2026-09-23 15:30 – Updated: 2026-09-23 15:30
VLAI
Details
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Weak Encoding for Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, Protection mechanism bypass, and Unauthorized access.
Severity
6.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-73589"
],
"database_specific": {
"cwe_ids": [
"CWE-261"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-23T15:17:17Z",
"severity": "MODERATE"
},
"details": "Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Weak Encoding for Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, Protection mechanism bypass, and Unauthorized access.",
"id": "GHSA-wmpf-wh48-4x49",
"modified": "2026-09-23T15:30:49Z",
"published": "2026-09-23T15:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73589"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-ca/000503592/dsa-2026-385-security-update-for-dell-secure-connect-gateway-policy-manager-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XQ7C-6J9M-M824
Vulnerability from github – Published: 2026-02-10 12:30 – Updated: 2026-02-10 12:30
VLAI
Details
A vulnerability has been identified in syngo.plaza VB30E (All versions < VB30E_HF07). The affected application does not encrypt the passwords properly. This could allow an attacker to recover the original passwords and might gain unauthorized access.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-52334"
],
"database_specific": {
"cwe_ids": [
"CWE-261"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-10T10:15:55Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been identified in syngo.plaza VB30E (All versions \u003c VB30E_HF07). The affected application does not encrypt the passwords properly.\nThis could allow an attacker to recover the original passwords and might gain unauthorized access.",
"id": "GHSA-xq7c-6j9m-m824",
"modified": "2026-02-10T12:30:26Z",
"published": "2026-02-10T12:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52334"
},
{
"type": "WEB",
"url": "https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-016040"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Passwords should be encrypted with keys that are at least 128 bits in length for adequate security.
CAPEC-55: Rainbow Table Password Cracking
An attacker gets access to the database table where hashes of passwords are stored. They then use a rainbow table of pre-computed hash chains to attempt to look up the original password. Once the original password corresponding to the hash is obtained, the attacker uses the original password to gain access to the system.