212 matches found
CVE-2022-47732
In Yeastar N412 and N824 Configuration Panel 42.x and 45.x, an unauthenticated attacker can create backup file and download it, revealing admin hash, allowing, once cracked, to login inside the Configuration Panel, otherwise, replacing the hash in the archive and restoring it on the device which...
CVE-2024-57698
An issue in modernwms v.1.0 allows an attacker view the MD5 hash of the administrator password and other attributes without authentication, even after initial configuration and password change. This happens due to excessive exposure of information and the lack of adequate access control on the...
CVE-2024-57698
An issue in modernwms v.1.0 allows an attacker view the MD5 hash of the administrator password and other attributes without authentication, even after initial configuration and password change. This happens due to excessive exposure of information and the lack of adequate access control on the...
CVE-2024-57698
An issue in modernwms v.1.0 allows an attacker view the MD5 hash of the administrator password and other attributes without authentication, even after initial configuration and password change. This happens due to excessive exposure of information and the lack of adequate access control on the...
CVE-2025-32789
EspoCRM is an Open Source Customer Relationship Management software. Prior to version 9.0.7, users can be sorted by their password hash. This flaw allows an attacker to make assumptions about the hash values of other users stored in the password column of the user table, based on the results of t...
PT-2025-5588 · Unknown · Develocity
Name of the Vulnerable Software and Affected Versions: Develocity versions prior to 2024.3.1 Description: The issue allows an attacker with network access to a Develocity server to obtain the hashed password of the system user. The hash algorithm used provides some protection against brute-force...
Exploit for Improper Preservation of Permissions in Modernwms
Admin MD5 Password Hash Disclosure - ModernWMS v1.0 - CVE-2024...
Veeam Backup & Replication 安全漏洞
Veeam Backup & Replication is a backup and replication software from Veeam USA. A security vulnerability exists in Veeam Backup & Replication 12.2.0.334 and previous 12.X versions, which stems from insufficient privileges in credentials handling, resulting in the exposure of sensitive NTLM hashes...
CVE-2024-42019
A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. This attack requires user interaction and data collected from Veeam Backup & Replication...
Veeam ONE 安全漏洞
Veeam ONE is a suite of IT monitoring and reporting tools from Veeam USA. The product supports features such as backup monitoring, operational status monitoring of virtual and physical environments. A security vulnerability exists in Veeam ONE version 12.1.0.3208 and previous versions 12, which...
CVE-2024-38650: Exposure of Sensitive Information to an Unauthorized Actor
An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server...
CVE-2024-8106
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.8 via the downloaduserajax function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extra...
PT-2024-6330 · Veeam · Veeam Service Provider Console
Name of the Vulnerable Software and Affected Versions: Veeam Service Provider Console VSPC affected versions not specified Description: An authentication bypass issue can allow a low-privileged attacker to access the NTLM hash of a service account on the VSPC server. This is related to insufficie...
CVE-2024-5213 Exposure of Sensitive Information in mintplex-labs/anything-llm
In mintplex-labs/anything-llm versions up to and including 1.5.3, an issue was discovered where the password hash of a user is returned in the response after login POST /api/request-token and after account creations POST /api/admin/users/new. This exposure occurs because the entire User object,...
PT-2024-35125
Name of the Vulnerable Software and Affected Versions mintplex-labs/anything-llm versions up to and including 1.5.3 Description An issue was discovered where the password hash of a user is returned in the response after login "POST /api/request-token" and after account creations "POST...
CVE-2024-5213: Insertion of Sensitive Information Into Sent Data
In mintplex-labs/anything-llm versions up to and including 1.5.3, an issue was discovered where the password hash of a user is returned in the response after login POST /api/request-token and after account creations POST /api/admin/users/new. This exposure occurs because the entire User object,...
PYSEC-2024-165
The Jupyter Server provides the backend for Jupyter web applications. Jupyter Server on Windows has a vulnerability that lets unauthenticated attackers leak the NTLMv2 password hash of the Windows user running the Jupyter server. An attacker can crack this password to gain access to the Windows...
CVE-2024-31464: Exposure of Sensitive Information to an Unauthorized Actor
XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10.19, 15.5.4, and 15.9-rc-1, it is possible to access the hash of a password by using the diff feature of the history whenever the object storing the password is deleted. Using that vulnerability it'...
CVE-2024-25118: Exposure of Sensitive Information to an Unauthorized Actor
TYPO3 is an open source PHP based web content management system released under the GNU GPL. Password hashes were being reflected in the editing forms of the TYPO3 backend user interface. This allowed attackers to crack the plaintext password using brute force techniques. Exploiting this...
