The vulnerability of the Attended SysUpgrade function of the sysupgrade.openwrt.org service allows a malicious actor to create a specially crafted malware image signed with a legitimate key.

The vulnerability of the Attended SysUpgrade function of the sysupgrade.openwrt.org service in the embedded operating system OpenWrt is related to the use of a reversible one-way hash function. Exploiting this vulnerability allows a malicious actor to remotely create a specially crafted malware...

389-ds-base security update

2.4.5-9 - Bump version to 2.4.5-9 - Resolves: RHEL-44323 - unauthenticated user can trigger a DoS by sending a specific extended search request - Resolves: RHEL-40945 - Malformed userPassword hash may cause Denial of Service - Resolves: RHEL-49457 - perf search result investigation for many large...

CVE-2024-21754

A use of password hash with insufficient computational effort vulnerability CWE-916 affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions may allow a privileged...

CVE-2024-23111

An improper neutralization of input during web page Generation 'Cross-site Scripting' vulnerability CWE-79 in FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions reboot page may allow a remote privileged...

WordPress Email Subscribers by Icegram Express plugin <= 5.7.20 - Unauthenticated SQL Injection via hash vulnerability

Unauthenticated SQL Injection via hash vulnerability discovered by 1337Wannabe in WordPress Plugin Email Subscribers & Newsletters versions = 5.7.20...

CryptoES Security Vulnerability

CryptoES is a library of cryptographic algorithms compatible with ES6 and TypeScript. A security vulnerability exists in CryptoES that stems from the use of an insecure cryptographic hash algorithm...

CVE-2023-1430

The FluentCRM - Marketing Automation For WordPress plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 2.7.40 due to the use of an MD5 hash without a salt to control subscriptions. This makes it possible for unauthenticated attackers to...

cargo-generate (>=0.13.1 <=0.16.0), cargo-smart-release (>=0.1.0 <=0.2.4) +43 more potentially affected by unknown CVE via git-hash (>=0.10.3 <=0.9.11)

git-hash CARGO version =0.10.3, =0.13.1, =0.1.0, =0.2.11, =11.0.0, =0.12.11, =0.1.0, =0.1.0, =0.3.0, =0.2.0, =0.1.0, =0.1.0, =0.10.0, =0.1.0, =0.1.0, =0.4.3 - git-lock =0.0.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0025...

Design/Logic Flaw

A use of password hash with insufficient computational effort vulnerability CWE-916 in FortiSandbox before 4.2.0 may allow an attacker with access to the password database to efficiently mount bulk guessing attacks to recover the passwords...

CVE-2023-22334

Use of password hash instead of password for authentication vulnerability in CONPROSYS HMI System CHS Ver.3.4.5 and earlier allows a remote authenticated attacker to obtain user credentials information via a man-in-the-middle attack...

CVE-2022-47931

IO FinNet tss-lib before 2.0.0 allows a collision of hash values...

Priva TopControl Suite

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Priva Equipment: TopControl Suite Vulnerability: Use of Password Hash with Insufficient Computational Effort 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to...

DEBIAN-CVE-2022-23476

Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri 1.13.8 and 1.13.9 fail to check the return value from xmlTextReaderExpand in the method Nokogiri::XML::Readerattributehash. This can lead to a null pointer exception when invalid markup is being parsed. Fo...

CVE-2022-36072

SilverwareGames.io is a social network for users to play video games online. In version 1.1.8 and prior, due to an unobvious feature of PHP, hashes generated by built-in functions and starting with the 0e symbols were being handled as zero multiplied with the e number. Therefore, the hash value w...

CVE-2022-36555

CVE-2022-36555 affects Hytec Inter HWL-2511-SS, versions 1.05 and below. The root cause is a SHA512crypt implementation for the root account that can be cracked via brute-force, allowing unauthorized root access. Public sources confirm the vulnerability in the device firmware and describe the imp...

i18n Vulnerable to Denial of Service Attack

Hashslice in lib/i18n/coreext/hash.rb in the i18n gem before 0.8.0 for Ruby allows remote attackers to cause a denial of service application crash via a call in a situation where :somekey is present in keepkeys but not present in the hash...

CVE-2022-25156

Use of Weak Hash vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5UC CPU all versions, Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU all versions, Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU all versions, Mitsubishi Electric MELSEC iQ-R series R04/08/16/32/120ENCPU all...

CVE-2022-25156

Use of Weak Hash vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5UC CPU all versions, Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU all versions, Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU all versions, Mitsubishi Electric MELSEC iQ-R series R04/08/16/32/120ENCPU all...

CVE-2022-25156

The CVE-2022-25156 entry concerns Mitsubishi Electric FA products (MELSEC iQ-F FX5U(C)/FX5UJ, iQ-R, Q, L series variants and related RJ71/RJ72 modules) where a weak password hash enables a remote, unauthenticated login by replaying or reversing an eavesdropped password hash. The issue stems from ...

PT-2021-10: Possibility of authorization in the file password mechanism using the password hash value in the FX5U(C) CPU and FX5UJ CPU modules

The vulnerability of the FX5UC CPU and FX5UJ CPU modules of Mitsubishi Electric FA products is associated with the possibility of using a password hash instead of a password for authentication. Exploiting the vulnerability may allow an attacker who knows the hash value of the password to perform...