1727 matches found
CVE-2022-30285
In Quest KACE Systems Management Appliance SMA through 12.0, a hash collision is possible during authentication. This may allow authentication with invalid credentials...
Authentication flaw
In Quest KACE Systems Management Appliance SMA through 12.0, a hash collision is possible during authentication. This may allow authentication with invalid credentials...
CVE-2022-30285
In Quest KACE Systems Management Appliance SMA through 12.0, a hash collision is possible during authentication. This may allow authentication with invalid credentials...
CVE-2022-30285
CVE-2022-30285 affects Quest KACE Systems Management Appliance (SMA) up to version 12.0. The vulnerability arises from a hash collision in the authentication process, which may allow authentication with invalid credentials. Severity is high (CVSSv3.1: 9.8, network attack vector, no user interacti...
PT-2022-20045 ยท Quest ยท Quest Kace System Management Appliance
Name of the Vulnerable Software and Affected Versions: Quest KACE Systems Management Appliance SMA versions prior to 12.0 Description: A hash collision is possible during authentication in the affected software, which may allow authentication with invalid credentials. Recommendations: For version...
CVE-2022-24139
In IOBit Advanced System Care AscService.exe 15, an attacker with SEImpersonatePrivilege can create a named pipe with the same name as one of ASCService's named pipes. ASCService first tries to connect before trying to create the named pipes, because of that during login the service will try to...
Insufficiently complex hash function used in `useFetch` means return data cannot be trusted
Description The useFetch function uses the ohash library to key requests. This hash function outputs a 32 bit number. Finding a collision for this function is easy. In a situation where useFetch is called more than once, any call after the first that contains untrusted input into any argument is...
Proxy storage collision - contracts might be bricked
Lines of code Vulnerability details The proxy contracts save the implementation variables in the first storage slot see links above. This will lead to storage collusions when the implementation contract tries to read/update the first storage slot. For the implementation contract, the first storag...
PT-2022-3081 ยท Saia Burgess Controls ยท Pcd
Name of the Vulnerable Software and Affected Versions: Saia Burgess Controls SBC PCD through 2022-05-06 Description: The issue is related to the use of an insecure algorithm for hashing passwords in the S-Bus protocol implementation of the Saia Burgess Controls SBC PCD controllers. This allows an...
CLSA-2022-1654106950 Fixed CVE-2021-33582 in cyrus-imapd
CVE-2021-33582: Fix a bad string hashing algorithm which could lead to collisions and cause a CPU denial of service...
JRuby denial of service via Hash Collision
JRuby computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service CPU consumption via crafted input to an application that maintains a hash table, as demonstrated by a universal...
GHSA-FMMQ-J7PQ-F85C JRuby denial of service via Hash Collision
JRuby computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service CPU consumption via crafted input to an application that maintains a hash table, as demonstrated by a universal...
OpenStack Glance Signature Verification Bypass
The image signature algorithm in OpenStack Glance 11.0.0 allows remote attackers to bypass the signature verification process via a crafted image, which triggers an MD5 collision...
GHSA-WMHW-FVG9-87FC OpenStack Glance Signature Verification Bypass
The image signature algorithm in OpenStack Glance 11.0.0 allows remote attackers to bypass the signature verification process via a crafted image, which triggers an MD5 collision...
JetBrains Ktor Native ๅฎๅ จ็นๅพ้ฎ้ข็นๅพ้ฎ้ขๆผๆด
JetBrains Ktor Native is an asynchronous framework for creating microservices, web applications, and more from the Czech company JetBrains. A security signature issue vulnerability exists in JetBrains Ktor Native versions prior to 2.0.1, which stems from the fact that SHA1 can return the same val...
GHSA-FH32-35W2-RXCC Use of Password Hash With Insufficient Computational Effort in Apache Derby
The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to...
SUSE-SU-2022:1454-1 Security update for python-pip
This update for python-pip fixes the following issues: - Add wheel subpackage with the generated wheel for this package bsc1176262, CVE-2019-20916. - Make wheel a separate build run to avoid the setuptools/wheel build cycle. - Switch this package to use update-alternatives for all files in %bindi...
Hash collision attack vulnerability in Jenkins
Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before 1.424.2.1 and 1.400.x before 1.400.0.11 could allow remote attackers to cause a considerable CPU load, aka "the Hash DoS attack."...
GHSA-PCHP-C5W8-47GC Hash collision attack vulnerability in Jenkins
Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before 1.424.2.1 and 1.400.x before 1.400.0.11 could allow remote attackers to cause a considerable CPU load, aka "the Hash DoS attack."...
CVE-2021-41119
Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object causing a hash collision. This collision causes the server to spend at least quadratic time parsing it which can lead to a denial of servic...