CVE-2024-12201 Hash Form <= 1.2.1 - Missing Authorization to Authenticated (Contributor+) Form Style Creation

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when creating form styles in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, ...

CVE-2024-12201 Hash Form <= 1.2.1 - Missing Authorization to Authenticated (Contributor+) Form Style Creation

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when creating form styles in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, ...

PT-2024-17485 · WordPress · The Hash Form – Drag & Drop Form Builder

Name of the Vulnerable Software and Affected Versions: Hash Form – Drag & Drop Form Builder plugin for WordPress versions up to, and including, 1.2.1 Description: The issue is related to a missing capability check when creating form styles. This allows authenticated attackers with Contributor-lev...

WordPress plugin Hash Form 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

php: password_verify can erroneously return true, opening ATO risk

A null byte interaction error vulnerability was found in PHP. If a password stored with passwordhash starts with a null byte \x00, testing a blank string as the password via passwordverify will incorrectly return true. If a user can create a password with a leading null byte unlikely, but...

php: password_verify can erroneously return true, opening ATO risk

A null byte interaction error vulnerability was found in PHP. If a password stored with passwordhash starts with a null byte \x00, testing a blank string as the password via passwordverify will incorrectly return true. If a user can create a password with a leading null byte unlikely, but...

php: password_verify can erroneously return true, opening ATO risk

A null byte interaction error vulnerability was found in PHP. If a password stored with passwordhash starts with a null byte \x00, testing a blank string as the password via passwordverify will incorrectly return true. If a user can create a password with a leading null byte unlikely, but...

The vulnerability of the Attended SysUpgrade function of the sysupgrade.openwrt.org service allows a malicious actor to create a specially crafted malware image signed with a legitimate key.

The vulnerability of the Attended SysUpgrade function of the sysupgrade.openwrt.org service in the embedded operating system OpenWrt is related to the use of a reversible one-way hash function. Exploiting this vulnerability allows a malicious actor to remotely create a specially crafted malware...

CVE-2024-54039

creationtimestamp| type| source ---|---|--- 2024-12-10 23:20:49+00:00| seen| https://t.me/cvedetector/12585...

Password Bypass

moodle/moodle is vulnerable to Password Bypass. The vulnerability is due to loose comparison in the password-checking logic, allowing certain "magic hash" values to bypass password restrictions...

Description of the security update for Office 2016: December 10, 2024 (KB2920716)

None None...

Description of the security update for Access 2016: December 10, 2024 (KB5002641)

None None...

SMB Password Change

Change the password of an account using SMB. This provides several different APIs, each of which have their respective benefits and drawbacks. Module Options msf use auxiliary/admin/smb/changepassword msf auxiliarychangepassword show actions ...actions... msf auxiliarychangepassword set ACTION ms...

The vulnerability of microprogramming software in embedded network control controllers of ASPECT Enterprise, NEXUS Series, and MATRIX Series is related to the use of a reversible one-way hash function. This function allows attackers to compromise data integrity.

The vulnerability of microprogramming software in embedded network control controllers of ASPECT Enterprise, NEXUS Series, and MATRIX Series is related to the use of a reversible one-way hash function. Exploiting this vulnerability could allow an attacker to compromise data integrity remotely...

Use of Weak Hash

Overview asu is an An image on demand server for OpenWrt based distributions Affected versions of this package are vulnerable to Use of Weak Hash which allows the ASU server to be polluted with malicious firmware images. Due to the low entropy employed when only 12 characters are used from the...

CVE-2024-54143 openwrt/asu allows build artifact poisoning via truncated SHA-256 hash and command injection

openwrt/asu is an image on demand server for OpenWrt based distributions. The request hashing mechanism truncates SHA-256 hashes to only 12 characters. This significantly reduces entropy, making it feasible for an attacker to generate collisions. By exploiting this, a previously built malicious...

CVE-2024-54143

CVE-2024-54143 affects OpenWrt ASU (image-on-demand server). The build request hash truncates SHA-256 to 12 characters, lowering entropy and enabling potential hash collisions. An attacker could poison the artifact cache by serving a previously built malicious image, possibly combined with a comm...

CVE-2024-10773

The product is vulnerable to pass-the-hash attacks in combination with hardcoded credentials of hidden user levels. This means that an attacker can log in with the hidden user levels and gain full access to the device...

CVE-2024-10773 SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for pass-the-hash attacks

The product is vulnerable to pass-the-hash attacks in combination with hardcoded credentials of hidden user levels. This means that an attacker can log in with the hidden user levels and gain full access to the device...

CVE-2024-10773 SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for pass-the-hash attacks

The product is vulnerable to pass-the-hash attacks in combination with hardcoded credentials of hidden user levels. This means that an attacker can log in with the hidden user levels and gain full access to the device...