CWE-261
AllowedWeak Encoding for Password
Abstraction: Base · Status: Incomplete
Obscuring a password with a trivial encoding does not protect the password.
74 vulnerabilities reference this CWE, most recent first.
GHSA-V3Q5-XFQM-WPF2
Vulnerability from github – Published: 2025-07-30 00:32 – Updated: 2025-11-03 21:34A logic issue was addressed with improved checks. This issue is fixed in iOS 18.6 and iPadOS 18.6. Passcode may be read aloud by VoiceOver.
{
"affected": [],
"aliases": [
"CVE-2025-31229"
],
"database_specific": {
"cwe_ids": [
"CWE-261"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-30T00:15:30Z",
"severity": "CRITICAL"
},
"details": "A logic issue was addressed with improved checks. This issue is fixed in iOS 18.6 and iPadOS 18.6. Passcode may be read aloud by VoiceOver.",
"id": "GHSA-v3q5-xfqm-wpf2",
"modified": "2025-11-03T21:34:11Z",
"published": "2025-07-30T00:32:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31229"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/124147"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Jul/30"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W45C-829M-RQ5V
Vulnerability from github – Published: 2026-08-13 15:34 – Updated: 2026-08-13 15:34During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could allow a local authenticated user to escalate privileges.
{
"affected": [],
"aliases": [
"CVE-2026-63424"
],
"database_specific": {
"cwe_ids": [
"CWE-261"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-13T15:19:55Z",
"severity": "HIGH"
},
"details": "During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could allow a local authenticated user to escalate privileges.",
"id": "GHSA-w45c-829m-rq5v",
"modified": "2026-08-13T15:34:43Z",
"published": "2026-08-13T15:34:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63424"
},
{
"type": "WEB",
"url": "https://support.lenovo.com/us/en/product_security/LEN-223470"
},
{
"type": "WEB",
"url": "https://support.lenovo.com/us/en/solutions/ht037099#dm"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-WGCP-RFQ6-33JH
Vulnerability from github – Published: 2026-06-09 21:32 – Updated: 2026-06-09 21:32Dell Client Platform BIOS contains a Weak Encoding for Password vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Elevation of Privileges.
{
"affected": [],
"aliases": [
"CVE-2026-40639"
],
"database_specific": {
"cwe_ids": [
"CWE-261"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-09T19:17:53Z",
"severity": "MODERATE"
},
"details": "Dell Client Platform BIOS contains a Weak Encoding for Password vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Elevation of Privileges.",
"id": "GHSA-wgcp-rfq6-33jh",
"modified": "2026-06-09T21:32:36Z",
"published": "2026-06-09T21:32:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40639"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000453482/dsa-2026-197"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XQ7C-6J9M-M824
Vulnerability from github – Published: 2026-02-10 12:30 – Updated: 2026-02-10 12:30A vulnerability has been identified in syngo.plaza VB30E (All versions < VB30E_HF07). The affected application does not encrypt the passwords properly. This could allow an attacker to recover the original passwords and might gain unauthorized access.
{
"affected": [],
"aliases": [
"CVE-2024-52334"
],
"database_specific": {
"cwe_ids": [
"CWE-261"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-10T10:15:55Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been identified in syngo.plaza VB30E (All versions \u003c VB30E_HF07). The affected application does not encrypt the passwords properly.\nThis could allow an attacker to recover the original passwords and might gain unauthorized access.",
"id": "GHSA-xq7c-6j9m-m824",
"modified": "2026-02-10T12:30:26Z",
"published": "2026-02-10T12:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52334"
},
{
"type": "WEB",
"url": "https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-016040"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Passwords should be encrypted with keys that are at least 128 bits in length for adequate security.
CAPEC-55: Rainbow Table Password Cracking
An attacker gets access to the database table where hashes of passwords are stored. They then use a rainbow table of pre-computed hash chains to attempt to look up the original password. Once the original password corresponding to the hash is obtained, the attacker uses the original password to gain access to the system.