CWE-916 Use of Password Hash With Insufficient Computational Effort

Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

Payload: Password hashes use insufficient PBKDF2 iterations

Flowise has Insufficient Password Salt Rounds

NeuVector has an insecure password storage and is vulnerable to rainbow attack

electerm's encrypt method not safe enough

LiteLLM: Password hash exposure and pass-the-hash authentication bypass

Taylored webhook validation vulnerabilities

Flask-AppBuilder before v4.1.3 allows inference of sensitive information through query strings

Liferay Portal defaults to a low work factor for the default password hashing algorithm

Improper hashing in enrocrypt

XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted

Serverpod improved security for stored password hashes

crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard

Buttercup allows attackers to obtain the hash of the master password

crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard

Password Shucking Vulnerability

net-ldap has weak salt when generating passwords

GraphQL queries can expose password hashes

SFTPGo vulnerable to recovery codes abuse

Use of Password Hash With Insufficient Computational Effort in Apache Derby

Weak password hash in LiveHelperChat

Improper privilege management in Keycloak

Improper rate limiting in Koel