13508 matches found
MD5 hash support in github.com/foxcpp/maddy
Impact This vulnerability affects maddy 0.5.1, 0.5.0 users using auth.shadow module and an extremely outdated system that still allows MD5 hashes in /etc/shadows. Patches Patch is available as part of the 0.5.2 release. Workarounds Ensure MD5 hashes are not present in /etc/shadow...
389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed
A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose password was...
Description of the security update for Office Online Server: October 12, 2021 (KB5002027)
None None...
Description of the security update for Office Web Apps Server 2013: October 12, 2021 (KB5002036)
None None...
Description of the security update for SharePoint Enterprise Server 2016: October 12, 2021 (KB5002006)
None None...
Description of the security update for SharePoint Enterprise Server 2013: October 12, 2021 (KB5001924)
None None...
Description of the security update for Excel 2013: October 12, 2021 (KB5002043)
Description of the security update for Excel 2013: October 12, 2021 KB5002043 Summary This security update resolves a Microsoft Excel information disclosure vulnerability and Microsoft Excel remote code execution vulnerabilities. To learn more about the vulnerabilities, see the following security...
Description of the security update for SharePoint Enterprise Server 2013: October 12, 2021 (KB4493202)
None None...
Description of the security update for SharePoint Foundation 2013: October 12, 2021 (KB5002042)
Description of the security update for SharePoint Foundation 2013: October 12, 2021 KB5002042 Summary This security update resolves a Microsoft SharePoint Server spoofing vulnerability and Microsoft SharePoint Server remote code execution vulnerability. To learn more about the vulnerabilities, se...
CVE-2021-24651
The Poll Maker WordPress plugin before 3.4.2 allows unauthenticated users to perform SQL injection via the aysfinishpoll AJAX action. While the result is not disclosed in the response, it is possible to use a timing attack to exfiltrate data such as password hash...
Sql injection
The Poll Maker WordPress plugin before 3.4.2 allows unauthenticated users to perform SQL injection via the aysfinishpoll AJAX action. While the result is not disclosed in the response, it is possible to use a timing attack to exfiltrate data such as password hash...
MAZ Loader < 1.3.3 - Contributor+ SQL Injection
The plugin does not validate or escape the loaderid parameter of the mzldr shortcode, which allows users with a role as low as Contributor to perform SQL injection. As a user with a role as low as Contributor, put the following shortcode in a page/post and view/preview it to get the login...
WordPress 插件 SQL注入漏洞
WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. SQL injection vulnerability exists in versions prior to WordPress Poll Maker plugin 3.4.2, which stems from the plug...
CVE-2021-36767
In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the server password, making the protection ineffective. An attacker may send an unauthenticated request to the server. The server will reply with a weakly-hashed version of the server's...
PT-2021-21345 · Digi · Digi Realport
Name of the Vulnerable Software and Affected Versions: Digi RealPort versions 4.8.488.0 through 4.10.490 Description: The authentication mechanism in Digi RealPort relies on a challenge-response system that provides access to the server password, rendering the protection ineffective. An attacker...
CVE-2021-3833 Integria IMS incorrect authorization
Integria IMS login check uses a loose comparator "==" to compare the MD5 hash of the password provided by the user and the MD5 hash stored in the database. An attacker with a specific formatted password could exploit this vulnerability in order to login in the system with different passwords...
CVE-2021-3833
CVE-2021-3833 affects Integria IMS where the login check compares MD5(password) using a loose equality (==) instead of a secure comparison. This allows an attacker with a specially formatted password to authenticate as another user, effectively bypassing login checks. The issue is described as en...
Windows/x86 - Bind TCP shellcode / Dynamic PEB & EDT method null-free Shellcode (415 bytes)
; Name: Windows/x86 - Bind TCP shellcode / Dynamic PEB & EDT method null-free Shellcode 415 bytes ; Author: h4pp1n3ss ; Tested on: Microsoft Windows Version 10.0.19042.1237 ; Description: ; This a bind tcp shellcode that open a listen socket on 0.0.0.0 and port 1337. In order to accomplish this...
PT-2021-22048 · Unknown · Integria Ims
Name of the Vulnerable Software and Affected Versions: Integria IMS affected versions not specified Description: The login check in Integria IMS uses a loose comparator to compare the MD5 hash of the user-provided password and the MD5 hash stored in the database. This allows an attacker with a...
CVE-2021-3833
Integria IMS login check uses a loose comparator "==" to compare the MD5 hash of the password provided by the user and the MD5 hash stored in the database. An attacker with a specific formatted password could exploit this vulnerability in order to login in the system with different passwords...