2021 matches found
PT-2026-67462
A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection. An attacker who obtains access to stored credential data may be able to recover valid credentials to gain unauthorized acces...
CVE-2026-38447
osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the ke...
EUVD-2026-52402
osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the ke...
CVE-2026-38447
Summary: CVE-2026-38447 affects osTicket 1.18.3, where API keys are generated with a predictable construction based on MD5 hashing and inputs such as the current timestamp and client IP. The underlying issue is low-entropy key generation due to MD5 and predictable inputs. Impact: The vulnerabilit...
CVE-2026-38447
osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the ke...
PT-2026-67457
A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credentials associated with site management are transmitted using a weak hashing algorithm that does not provide sufficient protection. An attacker who successfully intercepts adoption-related...
K000162463: PostgreSQL vulnerability CVE-2026-6478
Security Advisory Description Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current...
CVE-2026-47743
The CVE-2026-47743 issue affects Shopper’s admin Livewire components prior to v2.8.0. The root causes are: (1) IDOR-like vulnerability where public Eloquent identifiers could be rewritten in the wire payload due to missing #[Locked], enabling targeting of arbitrary records; (2) leakage of plainte...
bytedance InfiniStore: Denial of Service via Non-Cryptographic Hashing in InfiniStore KV Map
A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purgekvmap in the library /src/infinistore.h of the component KV Map Handler. Performing a manipulation results in inefficient algorithmic complexity. The attack requires a local approach. The...
PYSEC-2026-3469 bytedance InfiniStore: Denial of Service via Non-Cryptographic Hashing in InfiniStore KV Map
A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purgekvmap in the library /src/infinistore.h of the component KV Map Handler. Performing a manipulation results in inefficient algorithmic complexity. The attack requires a local approach. The...
Incorrect Implementation of Authentication Algorithm
Overview Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm due to lossy ISO-8859-1 encoding in the digest hash computation. An attacker can log in as a user with a non-Latin-1 password by supplying a collision password that replaces each...
CVE-2026-57310
Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtain password hash to decode user credentials. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also...
CVE-2026-57310 Weak password hashing in Windu CMS
Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtain password hash to decode user credentials. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also...
EUVD-2026-45944
Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtain password hash to decode user credentials. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also...
CVE-2026-57310
Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtain password hash to decode user credentials. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also...
CVE-2026-57310
Windu CMS stores user passwords using a weak scheme: an MD5/SHA1-based hash with a static salt. This design allows an attacker who obtains password hashes to recover credentials. The vulnerability is confirmed in version 4.1 and may affect other versions; exploitation details are not provided in ...
CVE-2026-57310 Weak password hashing in Windu CMS
Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtain password hash to decode user credentials. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also...
CVE-2026-16235
Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography...
CVE-2026-63999 ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
In the Linux kernel, the following vulnerability has been resolved: ethtool: rss: fix indirtable and hkey leak on getrxfh failure rssprepareget allocates the indirection table and hash key buffer via rssgetdataalloc, then calls ops-getrxfh to populate them. If getrxfh fails, the function returns ...
