CVE-2022-4036 Appointment Hour Booking <= 1.3.72 - CAPTCHA Bypass

The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.72. This is due to the use of insufficiently strong hashing algorithm on the CAPTCHA secret that is also displayed to the user via a cookie...

Appointment Hour Booking < 1.3.73 - CAPTCHA Bypass

The plugin does not have a strong hashing algorithm on the CAPTCHA secret, and displays it to the user via a cookie, which could allow them to bypass the protection in place...

WordPress plugin Appointment Hour Booking 加密问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A weak algorithmic...

PT-2022-25362 · WordPress · Appointment Hour Booking

Name of the Vulnerable Software and Affected Versions: Appointment Hour Booking plugin for WordPress versions up to, and including, 1.3.72 Description: The issue is related to a CAPTCHA bypass due to the use of an insufficiently strong hashing algorithm on the CAPTCHA secret. This secret is also...

CVE-2022-43958

A vulnerability has been identified in QMS Automotive All versions V12.39, QMS Automotive All versions V12.39. User credentials are stored in plaintext in the database without any hashing mechanism. This could allow an attacker to gain access to credentials and impersonate other users...

Design/Logic Flaw

A vulnerability has been identified in QMS Automotive All versions V12.39, QMS Automotive All versions V12.39. User credentials are stored in plaintext in the database without any hashing mechanism. This could allow an attacker to gain access to credentials and impersonate other users...

CVE-2022-43958

A vulnerability has been identified in QMS Automotive All versions V12.39, QMS Automotive All versions V12.39. User credentials are stored in plaintext in the database without any hashing mechanism. This could allow an attacker to gain access to credentials and impersonate other users...

CVE-2022-43958

CVE-2022-43958 | Siemens QMS Automotive : All versions prior to v12.39 store user credentials in plaintext in the database (no hashing). This enables credential exposure and potential user impersonation. Evidence sources describe plaintext password storage as the root cause and assign CVSS scores...

[SECURITY] [DLA 3175-1] python3.7 security update

Debian LTS Advisory DLA-3175-1 [email protected] https://www.debian.org/lts/security/ Stefano Rivera November 01, 2022 https://wiki.debian.org/LTS Package : python3.7 Version : 3.7.3-2+deb10u4 CVE ID : CVE-2022-37454 Nicky Mouha discovered a buffer overflow in sha3, the SHA-3 hashing...

[SECURITY] [DSA 5267-1] pysha3 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5267-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 30, 2022 https://www.debian.org/security/faq -...

PT-2022-6362 · Tp Link · Tp-Link Tl-Wr940N

Name of the Vulnerable Software and Affected Versions: TP-Link router TL-WR940N V6 version 3.19.1 Build 180119 Description: The issue is related to the use of a deprecated MD5 algorithm to hash the admin password used for basic authentication. This could allow a remote attacker to gain unauthoriz...

OSV-2022-1094 Security exception in com.google.common.hash.Hashing$ConcatenatedHashFunction.makeHash

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52693 Crash type: Security exception Crash state: com.google.common.hash.Hashing$ConcatenatedHashFunction.makeHash com.google.common.hash.AbstractCompositeHashFunction$1.hash HashingFuzzer.testHash...

OESA-2022-1945 python-pip security update

pip is the package installer for Python. You can use pip to install packages from the Python Package Index and other indexes. %global bashcompdir %b=$pkg-config --variable=completionsdir bash-completion 2/dev/null; echo $b:-/bashcompletion.d Name: python-pip Version: 21.3.1 Release: 1 Summary: A...

CVE-2022-29835

WD Discovery software executable files were signed with an unsafe SHA-1 hashing algorithm. An attacker could use this weakness to create forged certificate signatures due to the use of a hashing algorithm that is not collision-free. This could thereby impact the confidentiality of user content...

CVE-2022-29835

WD Discovery software executable files were signed with an unsafe SHA-1 hashing algorithm. An attacker could use this weakness to create forged certificate signatures due to the use of a hashing algorithm that is not collision-free. This could thereby impact the confidentiality of user content...

Design/Logic Flaw

WD Discovery software executable files were signed with an unsafe SHA-1 hashing algorithm. An attacker could use this weakness to create forged certificate signatures due to the use of a hashing algorithm that is not collision-free. This could thereby impact the confidentiality of user content...

CVE-2022-29835

CVE-2022-29835 concerns WD Discovery: WD Discovery Desktop App on Mac and Windows prior to 4.4.396 are signed with an unsafe SHA-1 hashing algorithm, enabling potential forged certificate signatures and compromising user content confidentiality. The issue affects WD Discovery software prior to ve...

Western Digital WD Discovery 加密问题漏洞

Western Digital MyCloud Home is a personal storage device from Western Digital.Western Digital WD Discovery is a remote connection management tool for Western Digital personal storage devices. A security vulnerability exists in Western Digital WD Discovery version 4.4.396 that stems from the use ...

CVE-2022-40621

Because the WAVLINK Quantum D4G WN531G3 running firmware version M31G3.V5030.200325 and earlier communicates over HTTP and not HTTPS, and because the hashing mechanism does not rely on a server-supplied key, it is possible for an attacker with sufficient network access to capture the hashed...

Design/Logic Flaw

Because the WAVLINK Quantum D4G WN531G3 running firmware version M31G3.V5030.200325 and earlier communicates over HTTP and not HTTPS, and because the hashing mechanism does not rely on a server-supplied key, it is possible for an attacker with sufficient network access to capture the hashed...