The vulnerability of cloud-based software for creating and using Nextcloud Server and Nextcloud Enterprise Server lies in the use of a reversible one-way hash function. This allows attackers to make background tasks effective.

The vulnerability of cloud-based software for creating and using Nextcloud Server and Nextcloud Enterprise Server lies in the use of a reversible one-way hash function. Exploiting this vulnerability allows a malicious actor to make a background task effective...

OpenWrt 安全漏洞

OpenWrt is a Linux operating system for embedded devices. A security vulnerability exists in versions prior to OpenWrt 920c8a1 that stems from a truncated SHA-256 hash down to 12 characters, reducing security and allowing the generation of malicious images...

PT-2024-16533 · Sick · Sick Tim3Xx +2

Name of the Vulnerable Software and Affected Versions: SICK InspectorP61x versions affected versions not specified SICK InspectorP62x versions affected versions not specified SICK TiM3xx versions affected versions not specified Description: The product is vulnerable to pass-the-hash attacks in...

SICK多款产品 安全漏洞

SICK InspectorP61x and others are products of SICK, Germany.SICK InspectorP61x is an ultra-compact industrial 2D vision sensor.SICK InspectorP62x is an ultra-compact industrial 2D vision sensor.SICK TiM3xx is an opto-electronic laser scanner that scans the surrounding environment with the help of...

PT-2024-9199 · Abb · Abb Aspect +2

Name of the Vulnerable Software and Affected Versions: ABB ASPECT - Enterprise version 3.08.01 NEXUS Series version 3.08.01 MATRIX Series version 3.08.01 Description: The issue is related to a weakness in the way an application dependency calculates or validates MD5 checksum hashes, allowing for...

Veeam Issues Patch for Critical RCE Vulnerability in Service Provider Console

Veeam has released security updates to address a critical flaw impacting Service Provider Console VSPC that could pave the way for remote code execution on susceptible instances. The vulnerability, tracked as CVE-2024-42448, carries a CVSS score of 9.9 out of a maximum of 10.0. The company noted...

CVE-2024-45204

A vulnerability exists where a low-privileged user can exploit insufficient permissions in credential handling to leak NTLM hashes of saved credentials. The exploitation involves using retrieved credentials to expose sensitive NTLM hashes, impacting systems beyond the initial target and potential...

CVE-2024-45204

CVE-2024-45204 affects Veeam Backup & Replication (12.x) prior to build 12.3.0.310. The issue arises from insufficient permissions in credential handling, allowing a low-privileged authenticated user with a role in Users and Roles to access saved credentials and leak NTLM hashes. This is confirme...

kernel: udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port()

In the Linux kernel, the following vulnerability has been resolved: udp: Set SOCKRCUFREE earlier in udplibgetport. syzkaller triggered the warning 0 in udpv4earlydemux. In udpv46earlydemux and sklookup, we do not touch the refcount of the looked-up sk and use sockpfree as skb-destructor, so we...

Veeam Backup & Replication 安全漏洞

Veeam Backup & Replication is a backup and replication software from Veeam USA. A security vulnerability exists in Veeam Backup & Replication 12.2.0.334 and previous 12.X versions, which stems from insufficient privileges in credentials handling, resulting in the exposure of sensitive NTLM hashes...

Dahua Technology Co., Ltd Digital Video Recorders and IP Cameras Use of Password Hash Instead of Password For Authentication (CVE-2017-7927)

A Use of Password Hash Instead of Password for Authentication issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH- IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC- HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH- HCVR5XXX,...

SUSE CVE-2024-53106

In the Linux kernel, the following vulnerability has been resolved: ima: fix buffer overrun in imaeventdigestinitcommon Function imaeventdigestinit calls imaeventdigestinitcommon with HASHALGOLAST which is then used to access the array hashdigestsize leading to buffer overrun. Have a conditional...

Veeam Service Provider Console Vulnerability (CVE-2024-42448 | CVE-2024-42449)

Veeam Software Security Commitment Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure Program VDP for all Veeam products and perform extensive internal code audits. When a vulnerability is...

DEBIAN-CVE-2024-53106

In the Linux kernel, the following vulnerability has been resolved: ima: fix buffer overrun in imaeventdigestinitcommon Function imaeventdigestinit calls imaeventdigestinitcommon with HASHALGOLAST which is then used to access the array hashdigestsize leading to buffer overrun. Have a conditional...

UBUNTU-CVE-2024-53106

In the Linux kernel, the following vulnerability has been resolved: ima: fix buffer overrun in imaeventdigestinitcommon Function imaeventdigestinit calls imaeventdigestinitcommon with HASHALGOLAST which is then used to access the array hashdigestsize leading to buffer overrun. Have a conditional...

CVE-2024-53106 ima: fix buffer overrun in ima_eventdigest_init_common

In the Linux kernel, the following vulnerability has been resolved: ima: fix buffer overrun in imaeventdigestinitcommon Function imaeventdigestinit calls imaeventdigestinitcommon with HASHALGOLAST which is then used to access the array hashdigestsize leading to buffer overrun. Have a conditional...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that originates from a buffer overflow due to the use of HASHALGOLAST in the imaeventdigestinitcommon function in the ima...

Exploit for Unrestricted Upload of File with Dangerous Type in Hashthemes Hash_Form

Hash Form 9.9.1 file upload vulnerability Exploit The Hash...

U.S. Dept Of Defense: Unauthenticated File Read Adobe ColdFusion

A vulnerability was discovered in Adobe ColdFusion that led to an Unauthenticated Arbitrary File Read. The vulnerability was caused by the deserialization of untrusted data. A password hash was disclosed as a result of the vulnerability...

Schneider Electric Modicon M340, MC80, and Momentum Unity M1E Improper Enforcement of Message Integrity During Transmission in a Communication Channel (CVE-2024-8933)

A vulnerability exists that could cause retrieval of password hash that could lead to denial of service and loss of confidentiality and integrity of controllers. To be successful, the attacker needs to inject themselves inside the logical network while a valid user uploads or downloads a project...