Advisories · Weakness
CWE-836.
Every Advisory and CVE whose sources give the weakness CWE-836, newest first.
- CVSS 9.1 CriticalCritical · CVSS 9+
Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies
- Omnispace Agora Project
- CWE-836
- CVSS 9.1 CriticalCritical · CVSS 9+
motionEye: Authentication possible via password hash
- Authentication bypass
- Weak cryptography or TLS
<0.44.0 · fixed in 0.44.0
GHSA-r3cw-c95m-wfh9 · CVE-2026-46488 - CVSS 6.5 Medium
OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects
- opf openproject
- Information disclosure
- Broken access control
- CVSS 9.2 CriticalCritical · CVSS 9+
Setracker2 Children's Smartwatch Ecosystem Use of password hash instead of password for authentication
- Shenzhen i365-Tech Co. Ltd. Setracker2 Parental Control App (Android) package com.tgelec.setracker
- CWE-836
- CVSS 4.3 Medium
Vikunja: Scoped API tokens with projects.background permission can delete project backgrounds
- Broken access control
- CWE-836
<2.3.0 · fixed in 2.3.0
GHSA-v479-vf79-mg83 · CVE-2026-40103 - CVSS 8.7 High
CEWE PHOTO SHOW 6.4.3 Denial of Service via Password Field
- Cewe-Photoworld CEWE PHOTO SHOW
- CWE-836
- CVSS 4.4 Medium
Fortinet FortiWeb: A use of password hash instead of password for authentication vulnerability [CWE-836]…
- Fortinet FortiWeb
- CWE-836
- CVSS 8.6 High
ELOG file upload stored XSS
- ELOG
- Cross-site scripting (XSS)
- Unrestricted file upload
- CVSS 5.3 Medium
Login to the application services using only the password hash
- Copeland LP E3 Supervisory Control
- CWE-836
- CVSS 4.3 Medium
TeleMessage service: The TeleMessage service through 2025-05-05 relies on the client side (e.g…
- TeleMessage service
- CWE-836
-
CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to t…
- NEC Corporation CLUSTERPRO X (EXPRESSCLUSTER X)
- NEC Corporation CLUSTERPRO X SingleServerSafe (EXPRESSCLUSTER X SingleServerSafe)
- CWE-836
- CVSS 9.0 CriticalCritical · CVSS 9+
Digi RealPort Protocol Use of Password Hash Instead of Password for Authentication
- Digi International Digi RealPort
- Digi International Digi ConnectPort TS 8/16
- CWE-836
-
SonicWall GMS: Use of password hash instead of password for authentication vulnerability in SonicWall…
- SonicWall GMS
- SonicWall Analytics
- CWE-836
- CVSS 6.2 Medium
Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote a…
- SICK AG SICK FTMG-ESD15AXX AIR FLOW SENSOR
- SICK AG SICK FTMG-ESD20AXX AIR FLOW SENSOR
- CWE-836
- CVSS 8.8 High
Improper session handling of "Remember me for 7 days" functionality
- pi-hole AdminLTE
- Authentication bypass
- CWE-836
- CVSS 7.2 High
WWBN AVideo: An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev…
- WWBN AVideo
- CWE-836
- CVSS 10.0 CriticalCritical · CVSS 9+
Login with hash
- Rexroth IndraMotion MLC L25, L45, L65, L75, L85, XM21, XM22, XM41 and XM42 IndraMotion XLC
- Rexroth IndraMotion MLC L20, L40
- CWE-836
-
A Use of Password Hash Instead of Password for Authentication issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH…
- Dahua Technology Co., Ltd Digital Video Recorders and IP Cameras
- CWE-836