xbootEncodePwd

xbootEncodePwd xboot-activiti-1.0-SNAPSHOT xboot-cms-1.0-SNAPSHOT xboot-generator-1.0-SNAPSHOT xboot-app-1.0-SNAPSHOT xboot-core-1.0-SNAPSHOT xboot-open-1.0-SNAPSHOT xboot-autochat-1.0-SNAPSHOT xboot-docking-1.0-SNAPSHOT xboot-quartz-1.0-SNAPSHOT xboot-base-1.0-SNAPSHOT xboot-ems-1.0-SNAPSHOT...

HTB-Pterodactyl-Writeup

HackTheBox — Pterodactyl 题解 难度： 中等 | 操作系统： Linux openSUSE Leap 15.6 | 赛季： 10 概述 Pterodactyl 是一台中等难度的 Linux 靶机，运行着 Pterodactyl 游戏服务器面板。攻击链涉及面板中一个无需认证的 LFI 到 RCE 漏洞、通过 MySQL 提取凭据、破解 bcrypt 哈希以获得 SSH 访问权限，以及一条利用 PAM 会话注入和 udisks2 XFS resize 竞态条件的双 CVE 提权链。 Flag： 用户： Root： （通过 CVE-2025-6019 获得） 信息收集...

PT-2026-104128

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could...

PT-2026-104187

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP server that supports this algorithm will cause the server CPU to run for hours checking the credentials. A bounded cost should be enforced...

CVE-2026-103880: Asymmetric Resource Consumption (Amplification)

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP server that supports this algorithm will cause the server CPU to run for hours checking the credentials. A bounded cost should be enforced...

CVE-2026-101089

Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints...

CVE-2026-101089 Nezha before 2.2.7 Information Disclosure via /api/v1/profile

Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints...

CVE-2026-101089 Nezha before 2.2.7 Information Disclosure via /api/v1/profile

Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints...

CVE-2026-101089

Versions of Nezha before 2.2.7 are susceptible to an information disclosure vulnerability within the GET /api/v1/profile endpoint. This flaw allows authenticated users to retrieve their bcrypt-hashed password field. Because there are no rate limiting or audit trail constraints, an attacker can ex...

EUVD-2026-88024

Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints...

PT-2026-99717

Name of the Vulnerable Software and Affected Versions Nezha versions prior to 2.2.7 Description An information disclosure issue exists where the 'GET /api/v1/profile' endpoint returns the bcrypt-hashed password field of authenticated users. This allows attackers to extract password hashes and...

CVE-2026-101089: Insufficiently Protected Credentials

Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints...

CVE-2026-100719

Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes. Authenticated API users can retrieve bcrypt password hashes for protected-directory users, enabling offline cracking attempts and exposure ...

Information Exposure

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Information Exposure via the DirProtections.listing API command, which returns bcrypt password hashes for protected-directory users. An attacker can obtain sensitive credential...

CVE-2026-100719 Froxlor before 2.3.12 Credential Disclosure via DirProtections API

Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes. Authenticated API users can retrieve bcrypt password hashes for protected-directory users, enabling offline cracking attempts and exposure ...

EUVD-2026-87692

Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes. Authenticated API users can retrieve bcrypt password hashes for protected-directory users, enabling offline cracking attempts and exposure ...

CVE-2026-100719

Froxlor versions before 2.3.12 are affected by a credential disclosure vulnerability within the DirProtections.listing API command. The root cause allows authenticated API users to retrieve bcrypt password hashes for users of protected directories. This exposure enables offline cracking attempts ...

CVE-2026-100719 Froxlor before 2.3.12 Credential Disclosure via DirProtections API

Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes. Authenticated API users can retrieve bcrypt password hashes for protected-directory users, enabling offline cracking attempts and exposure ...

CVE-2026-100719 Froxlor before 2.3.12 Credential Disclosure via DirProtections API

Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes. Authenticated API users can retrieve bcrypt password hashes for protected-directory users, enabling offline cracking attempts and exposure ...

CVE-2026-100719: Exposure of Sensitive Information to an Unauthorized Actor

Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes. Authenticated API users can retrieve bcrypt password hashes for protected-directory users, enabling offline cracking attempts and exposure ...