PT-2021-9149

Name of the Vulnerable Software and Affected Versions Epikur versions prior to 20.1.1 Description The issue concerns the storage of user passwords as MD5 hashes in the database, which can be brute-forced efficiently. The lack of salt in the hashing process makes it vulnerable to rainbow table...

Epikur Encryption Issues Vulnerabilities

Epikur is a healthcare mobile application from German company Epikur that provides users with psychotherapy, patient management, and other features. A security vulnerability exists in Epikur before 20.1.1 that stems from storing user passwords as MD5 hashes in the database...

EulerOS 2.0 SP5 : ipa (EulerOS-SA-2021-1196)

According to the version of the ipa packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that FreeIPA 4.2.0 and later could disclose password hashes to users having the 'System: Read Stage Users' permission. A remote,...

CVE-2021-25276

In SolarWinds Serv-U before 15.2.2 Hotfix 1, a directory containing user profile files (including password hashes) is world-readable/writable. An unprivileged Windows user with filesystem access can copy a valid profile to that directory to create an FTP user, potentially gaining read/replace acc...

CVE-2021-25276

In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files that include users' password hashes that is world readable and writable. An unprivileged Windows user having access to the server's filesystem can add an FTP user by copying a valid profile file to thi...

PT-2021-16497

Name of the Vulnerable Software and Affected Versions: SolarWinds Serv-U versions prior to 15.2.2 Hotfix 1 Description: The issue concerns a directory containing user profile files, including password hashes, which is world readable and writable. An unprivileged Windows user with access to the...

CVE-2020-13856

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. Authentication is not required to download the support file that contains sensitive information such as cleartext credentials and password hashes...

CVE-2020-13856

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. Authentication is not required to download the support file that contains sensitive information such as cleartext credentials and password hashes...

Design/Logic Flaw

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. Authentication is not required to download the support file that contains sensitive information such as cleartext credentials and password hashes...

CVE-2020-13856

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. Authentication is not required to download the support file that contains sensitive information such as cleartext credentials and password hashes...

CVE-2020-13856: Missing Authentication for Critical Function

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. Authentication is not required to download the support file that contains sensitive information such as cleartext credentials and password hashes...

CVE-2020-23361

phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters...

CVE-2020-23361

phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters...

CVE-2020-23356

dmin/kernel/api/login.class.phpin in nibbleblog v3.7.1c allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters...

CVE-2020-23356

dmin/kernel/api/login.class.phpin in nibbleblog v3.7.1c allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters...

Design/Logic Flaw

phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters...

Design/Logic Flaw

dmin/kernel/api/login.class.phpin in nibbleblog v3.7.1c allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters...

CVE-2020-23361

phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters...

CVE-2020-23356

NIBBLEBLOG 3.7.1c contains a login bypass due to type juggling: PHP code uses == instead of === for password comparison, mishandling hashes starting with 0e followed by digits. This allows bypass via non-strict comparison in admin/kernel/api/login.class.php. Documents identify the issue and affec...

CVE-2020-23356: Undefined Security Weakness

dmin/kernel/api/login.class.phpin in nibbleblog v3.7.1c allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters...