CVE-2024-10026

The CVE-2024-10026 issue concerns Google's gVisor: a weak hashing algorithm and small seed/secret sizes. The connected documents confirm this affects gVisor in multiple advisories (e.g., TencentOS Server 4, OSV/Ubuntu entries) and describe that a remote attacker could calculate a local IP address...

CVE-2023-33838

IBM Security Verify Governance 10.0.2 Identity Manager uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input...

CVE-2023-33838

CVE-2023-33838 affects IBM Security Verify Governance 10.0.2 Identity Manager. The issue is that the product uses a one-way cryptographic hash on inputs that should not be reversible (e.g., passwords) without applying a salt, increasing exposure of hashed values. The connected IBM bulletin confir...

IBM Security Verify Governance 安全漏洞

IBM Security Verify Governance is an intelligent identity access platform from International Business Machines IBM, Inc. provides organizations with a platform to analyze, define and control user access and access risk. IBM Security Verify Governance suffers from a security vulnerability that ste...

How Long Does It Take Hackers to Crack Modern Hashing Algorithms?

While passwords remain the first line of defense for protecting user accounts against unauthorized access, the methods for creating strong passwords and protecting them are continually evolving. For example, NIST password recommendations are now prioritizing password length over complexity...

Wind River Software VxWorks 6.9 Weak Password Hashing Algorithms

The password hashing algorithm introduced in VxWorks 6.9 is considered insecure. This algorithm employs a single iteration of SHA-256 combined with a salt to hash user passwords. The password hashing algorithm used in VxWorks 7 24.04 is also considered insecure. This algorithm uses 5,000 iteratio...

Information Disclosure

typo3/cms-install is vulnerable to Information Disclosure. The vulnerability is due to an incorrect password hashing mechanism, which causes the install tool password to be logged in plaintext, allowing an attacker to potentially gain access to the password if they can access the logs or system...

CVE-2024-55891 Information Disclosure via Exception Handling/Logger in TYPO3

TYPO3 is a free and open source Content Management Framework. It has been discovered that the install tool password has been logged as plaintext in case the password hashing mechanism used for the password was incorrect. Users are advised to update to TYPO3 versions 13.4.3 ELTS which fixes the...

CVE-2024-55891 Information Disclosure via Exception Handling/Logger in TYPO3

TYPO3 is a free and open source Content Management Framework. It has been discovered that the install tool password has been logged as plaintext in case the password hashing mechanism used for the password was incorrect. Users are advised to update to TYPO3 versions 13.4.3 ELTS which fixes the...

CVE-2024-55891 Information Disclosure via Exception Handling/Logger in TYPO3

TYPO3 is a free and open source Content Management Framework. It has been discovered that the install tool password has been logged as plaintext in case the password hashing mechanism used for the password was incorrect. Users are advised to update to TYPO3 versions 13.4.3 ELTS which fixes the...

GHSA-38X7-CC6W-J27Q TYPO3 Information Disclosure via Exception Handling/Logger

Problem It has been discovered that the install tool password has been logged as plaintext in case the password hashing mechanism used for the password was incorrect. Solution Update to TYPO3 versions 13.4.3 LTS that fixes the problem described. Credits Thanks to TYPO3 core & security team member...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow due to improper handling of attacker-controlled checksum lengths s2length in the code. An anonymous client can leverage this overflow, together with the stack memory exposure described in CVE-2024-12085 to...

TYPO3 日志信息泄露漏洞

TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Association. A log information disclosure vulnerability exists in TYPO3 that stems from an incorrect password hashing mechanism used for passwords, where the installation tool password will be recorde...

PT-2025-3142 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 13.4.3 ELTS Description: A problem has been discovered where the install tool password is logged as plaintext if the password hashing mechanism used for the password was incorrect. There are no known workarounds for th...

CVE-2024-5743

An attacker could exploit the 'Use of Password Hash With Insufficient Computational Effort' vulnerability in EveHome Eve Play to execute arbitrary code. This issue affects Eve Play: through 1.1.42...

CVE-2024-5743

CVE-2024-5743 affects Eve Play (EveHome) up to version 1.1.42. Root cause: use of a password hash with insufficient computational effort, enabling an attacker to execute arbitrary code. Impact is high across confidentiality, integrity, and availability per the CVE metrics. Remediation: upgrade to...

CVE-2025-21604 LangChain4j-AIDeepin Using MD5 to Hash files may cause file upload conflicts

LangChain4j-AIDeepin is a Retrieval enhancement generation RAG project. Prior to 3.5.0, LangChain4j-AIDeepin uses MD5 to hash files, which may cause file upload conflicts. This issue is fixed in 3.5.0...

CVE-2025-21604 LangChain4j-AIDeepin Using MD5 to Hash files may cause file upload conflicts

LangChain4j-AIDeepin is a Retrieval enhancement generation RAG project. Prior to 3.5.0, LangChain4j-AIDeepin uses MD5 to hash files, which may cause file upload conflicts. This issue is fixed in 3.5.0...

CVE-2025-21604

CVE-2025-21604 affects LangChain4j-AIDeepin before version 3.5.0. The root cause is the use of MD5 to hash files, which may cause file upload conflicts. The issue is fixed in 3.5.0. Remediation: upgrade to 3.5.0 (or later). Exploitation details are not provided in the available documents.

CVE-2025-21604 LangChain4j-AIDeepin Using MD5 to Hash files may cause file upload conflicts

LangChain4j-AIDeepin is a Retrieval enhancement generation RAG project. Prior to 3.5.0, LangChain4j-AIDeepin uses MD5 to hash files, which may cause file upload conflicts. This issue is fixed in 3.5.0...