CVE-2020-12772

An issue was discovered in Ignite Realtime Spark 2.8.3 and the ROAR plugin for it on Windows. A chat message can include an IMG element with a SRC attribute referencing an external host's IP address. Upon access to this external host, the NTLM hashes of the user are sent with the HTTP request. Th...

CVE-2020-8547

phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters...

CVE-2020-8088

panellogin.php in UseBB 1.0.12 allows type juggling for login bypass because != is used instead of !== for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters...

CVE-2020-17383

A directory traversal vulnerability on Telos Z/IP One devices through 4.0.0r grants an unauthenticated individual root level access to the device's file system. This can be used to identify configuration settings, password hashes for built-in accounts, and the cleartext password for remote...

CVE-2020-25987

MonoCMS Blog 1.0 stores hard-coded admin hashes in the log.xml file in the source files for MonoCMS Blog. Hash type is bcrypt and hashcat mode 3200 can be used to crack the hash...

CVE-2020-13856

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. Authentication is not required to download the support file that contains sensitive information such as cleartext credentials and password hashes...

CVE-2020-10244

JPaseto before 0.3.0 generates weak hashes when using v2.local tokens...

CVE-2013-1814

The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response...

CVE-2019-1443

An information disclosure vulnerability exists in Microsoft SharePoint when an attacker uploads a specially crafted file to the SharePoint Server.An authenticated attacker who successfully exploited this vulnerability could potentially leverage SharePoint functionality to obtain SMB hashes.The...

CVE-2012-3720

Mobile Accounts in Apple Mac OS X before 10.7.5 and 10.8.x before 10.8.2 saves password hashes for external-account use even if external accounts are not enabled, which might allow remote attackers to determine passwords via unspecified access to a mobile account...

SUSE SLES15: openssh / openssh-askpass-gnome / openssh-clients / openssh-common / etc (SUSE-SU-2025:1576-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1576-1 advisory. - Security issues fixed: CVE-2025-32728: Fixed a logic error in DisableForwarding option bsc1241012 - Other bugs fixed: Allow KEX hashes...

CVE-2025-48413

The eCharge Hardy Barth cPH2 and cPP2 electric vehicle charging stations, specifically version 2.2.0 , are affected by hard-coded credentials. The /etc/passwd and /etc/shadow files contain hard-coded password hashes for the root user which are shipped with the update files. Because there is no op...

eCharge Hardy Barth cPH2和eCharge Hardy Barth cPP2 安全漏洞

The eCharge Hardy Barth cPH2 and eCharge Hardy Barth cPP2 are both an electric vehicle charging station from eCharge. A security vulnerability exists in the eCharge Hardy Barth cPH2 and eCharge Hardy Barth cPP2 that stems from the fact that the /etc/passwd and /etc/shadow files contain hard-coded...

Security update for openssh

This update for openssh fixes the following issues: Security issues fixed: CVE-2025-32728: Fixed a logic error in DisableForwarding option bsc1241012 Other bugs fixed: Allow KEX hashes greater than 256 bits bsc1241045 Fixed hostname being left out of the audit output bsc1228634 Fixed failures wit...

SUSE-SU-2025:1576-1 Security update for openssh

This update for openssh fixes the following issues: - Security issues fixed: CVE-2025-32728: Fixed a logic error in DisableForwarding option bsc1241012 - Other bugs fixed: Allow KEX hashes greater than 256 bits bsc1241045 Fixed hostname being left out of the audit output bsc1228634 Fixed failures...

Exploit for Improper Input Validation in Microsoft

Explotación de CVE-2024-21413 Outlook Estado del proyecto:...

Real-Time Bit-Level Encryption of Full High-Definition Video without Diffusion

Despite the widespread adoption of Shannon's confusion-diffusion architecture in image encryption, the implementation of diffusion to sequentially establish inter-pixel dependencies for attaining plaintext sensitivity constrains algorithmic parallelism, while the execution of multiple rounds of...

Node.js: HashDoS in V8

The V8 release used in Node.js v24.0.0 changed how string hashes were computed using rapidhash. This implementation reintroduced the HashDoS vulnerability, where an attacker who could control the strings to be hashed could generate many hash collisions without knowing the hash-seed...

CVE-2025-32968

XWiki is a generic wiki platform. In versions starting from 1.6-milestone-1 to before 15.10.16, 16.4.6, and 16.10.1, it is possible for a user with SCRIPT right to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend...

OESA-2025-1423 firefox security update

Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions. Security Fixes: If an attacker loaded a font using codeFontFace/code on a background worker, a use-after-free could have occurred, leadin...