PT-2022-20589 · Pypi · Flask-Appbuilder

Name of the Vulnerable Software and Affected Versions: Flask-AppBuilder versions prior to 4.1.3 Description: An authenticated Admin user could query other users by their salted and hashed passwords strings, using partial hashed password strings. The response would not include the hashed passwords...

VulnCheck KEV: CVE-2019-25776

Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by submitting malicious input through the userIdentifiers GET parameter in the mobile plugin endpoint. Attackers can bypass space-based filter controls by wrapping...

The vulnerability of the network traffic analysis, network detection, and response mechanism of the Cortex XDR Agent lies in the insufficient protection of registration data, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the Cortex XDR Agent’s network traffic analysis, network detection, and response capabilities is related to insufficient protection of password hashes. Exploiting this vulnerability could allow attackers to gain unauthorized access to protected information by loading speciall...

Ubuntu: Security Advisory (USN-5496-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-5496-1: cloud-init vulnerability

Mike Stroyan discovered that cloud-init could log password hashes when reporting schema failures. An attacker with access to these logs could potentially use this to gain user credentials...

USN-5496-1 cloud-init vulnerability

Mike Stroyan discovered that cloud-init could log password hashes when reporting schema failures. An attacker with access to these logs could potentially use this to gain user credentials...

Malicious code in grand-whitelisted-hashes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0376424aef04154e0957721651e9e4066a8869bdcd687406f4984bc25c18f4e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-30231

A vulnerability has been identified in SICAM GridEdge Classic All versions V2.6.6. The affected application discloses password hashes of other users upon request. This could allow an authenticated user to retrieve another user's password hash...

Timing Attacks

ezsystems/ezpublish-kernel is vulnerable to timing attacks. The vulnerability exists because the library does not compare hashes in constant time, allowing an attacker to progressively use the timing of the request to identify a valid hash...

CVE-2022-29731

An access control issue in ICT Protege GX/WX 2.08 allows attackers to leak SHA1 password hashes of other users...

CVE-2022-29731

An access control issue in ICT Protege GX/WX 2.08 allows attackers to leak SHA1 password hashes of other users...

CVE-2022-29731

An access control issue in ICT Protege GX/WX 2.08 allows attackers to leak SHA1 password hashes of other users...

CVE-2022-1949

An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows...

Design/Logic Flaw

An access control issue in ICT Protege GX/WX 2.08 allows attackers to leak SHA1 password hashes of other users...

UBUNTU-CVE-2022-1949

An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows...

CVE-2022-29731

CVE-2022-29731 affects ICT Protege GX/WX version 2.08. The issue is an improper access control that allows an authenticated operator to disclose SHA-1 password hashes of other users (client-side hashes). The vulnerability has been documented in ZSL-2022-5700 with a PoC and vendor notifications; p...

CVE-2022-29731

An access control issue in ICT Protege GX/WX 2.08 allows attackers to leak SHA1 password hashes of other users...

PT-2022-19804

Name of the Vulnerable Software and Affected Versions ICT Protege GX/WX version 2.08 Description The issue is related to an access control problem, allowing attackers to leak SHA1 password hashes of other users. Recommendations For ICT Protege GX/WX version 2.08, at the moment, there is no...

CVE-2022-29731: Use of Password Hash With Insufficient Computational Effort

An access control issue in ICT Protege GX/WX 2.08 allows attackers to leak SHA1 password hashes of other users...

Insertion of Sensitive Information into Log File in Elasticsearch

Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emitrequestbody option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch...