The validateCreateOrderHash function is vulnerable to an incorrect token type being provided by the caller

Lines of code Vulnerability details Impact Invalid token types could be used with encoded order info, breaking expectations of the contract. An attacker could create an order hash using different parameters than what is actually encoded in the orderInfo. This could potentially allow the attacker ...

PYSEC-2023-1

Adyen has utility methods for validating notification HMAC signatures. The isvalidhmac and isvalidhmacnotification methods are vulnerable to a timing attack, you should compare the hash of the HMACs instead...

Timing Attacks

github.com/openshift/osin is vulnerable to timing attacks. The vulnerability exists because the ClientSecretMatches function in client.go and CheckClientSecret function in util.go does not compare hashes in constant time, allowing an attacker to progressively use the timing of the request to...

OESA-2022-2005 mailman security update

This is GNU Mailman, a mailing list management system distributed under the terms of the GNU General Public License GPL version 3 or later. The name of this software is spelled 'Mailman' with a leading capital 'M' but with a lower case second m'. Any other spelling is incorrect. Security Fixes:...

Mageia: Security Advisory (MGASA-2014-0493)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2021-22048 · Unknown · Integria Ims

Name of the Vulnerable Software and Affected Versions: Integria IMS affected versions not specified Description: The login check in Integria IMS uses a loose comparator to compare the MD5 hash of the user-provided password and the MD5 hash stored in the database. This allows an attacker with a...

CVE-2021-37848

common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash comparison...

CVE-2021-37848

common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash comparison...

CVE-2021-37848

common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash comparison...

Pengutronix barebox 信息泄露漏洞

Pengutronix barebox is a bootloader used in embedded Linux systems. A security vulnerability exists in barebox that stems from common password. in Pengutronix barebox through 2021.07.0 leaks time information because strncmp is used during hash comparison...

bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible

A flaw was found in bouncycastle. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password allowing incorrect passwords to indicate they were matching with previously hashed ones that were different. The highest threat from this vulnerability is to data...

bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible

A flaw was found in bouncycastle. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password allowing incorrect passwords to indicate they were matching with previously hashed ones that were different. The highest threat from this vulnerability is to data...

CVE-2020-23361

CVE-2020-23361 affects phpList 3.5.3. The root cause is type juggling: the code uses == instead of === for comparing password hashes, which mishandles hashes starting with 0e followed by only digits. This enables a login bypass under affected conditions. Connected sources indicate multiple, publi...

PT-2021-10889 · Phplist · Phplist

Name of the Vulnerable Software and Affected Versions: phpList version 3.5.3 Description: The issue allows for type juggling, enabling a login bypass. This occurs because the code uses == for comparing password hashes instead of ===, which incorrectly handles hashes starting with '0e' followed by...

Huawei EulerOS: Security Advisory for 389-ds-base (EulerOS-SA-2018-1076)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Sooty - The SOC Analysts All-In-One CLI Tool To Automate And Speed Up Workflow

Sooty is a tool developed with the task of aiding SOC analysts with automating part of their workflow. One of the goals of Sooty is to perform as much of the routines checks as possible, allowing the analyst more time to spend on deeper analysis within the same time-frame. Sooty is now proudly...

CVE-2019-15088

An issue was discovered in PRiSE adAS 1.7.0. Password hashes are compared using the equality operator. Thus, under specific circumstances, it is possible to bypass login authentication...

Information Disclosure

tapestry-core is vulnerable to information disclosure. The vulnerability exists due to the insecure usage of .equals for comparing hashes, allowing attackers to determine the correct signature for the payload...

NewStart CGSL MAIN 5.04 : 389-ds-base Multiple Vulnerabilities (NS-SA-2019-0009)

The remote NewStart CGSL host, running version MAIN 5.04, has 389-ds-base packages installed that are affected by multiple vulnerabilities: - An out-of-bounds memory read flaw was found in the way 389-ds-base handled certain LDAP search filters. A remote, unauthenticated attacker could potentiall...

CVE-2018-10081

CMS Made Simple CMSMS through 2.2.6 contains an admin password reset vulnerability because data values are improperly compared, as demonstrated by a hash beginning with the "0e" substring...