207 matches found
EUVD-2022-48499
Malicious code in bioql PyPI...
EUVD-2025-6405
Malicious code in bioql PyPI...
EUVD-2023-31612
Malicious code in bioql PyPI...
EUVD-2022-48501
Malicious code in bioql PyPI...
EUVD-2025-29462
Malicious code in bioql PyPI...
CVE-2025-59745
AndSoft e-TMS v25.03 is affected. The issue arises from using MD5 to hash passwords, a cryptographically weak hash susceptible to collisions and credential disclosure. Public sources (CNVD/NVD) corroborate MD5-based password hashing as the root cause; exploitation details are not provided in the ...
CVE-2025-51540
EzGED3 3.5.0 stores user passwords using an insecure hashing scheme: md5md5password. This hashing method is cryptographically weak and allows attackers to perform efficient offline brute-force attacks if password hashes are disclosed. The lack of salting and use of a fast, outdated algorithm make...
GO-2025-3792 File Browser vulnerable to insecure password handling in github.com/filebrowser/filebrowser
File Browser vulnerable to insecure password handling in github.com/filebrowser/filebrowser...
CVE-2025-30125
An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. All dashcams were shipped with the same default credentials of 12345678, which creates an insecure-by-default condition. For users who change their passwords, it's limited to 8 characters. These short passwords can be cracked in 8...
Insecure Password Handling
github.com/filebrowser/filebrowser is vulnerable to Insecure Password Handling. The vulnerability is due to a missing password policy and lack of brute-force protection, which allows an attacker to perform brute-force attacks to retrieve user account passwords...
GHSA-CM2R-RG7R-P7GG File Browser vulnerable to insecure password handling
Summary All user accounts authenticate towards a File Browser instance with a password. A missing password policy and brute-force protection makes it impossible for administrators to properly secure the authentication process. Impact Attackers can mount a brute-force attack against the passwords ...
CVE-2024-49370
Pimcore is an open source data and experience management platform. When a PortalUserObject is connected to a PimcoreUser and "Use Pimcore Backend Password" is set to true, the change password function in Portal Profile sets the new password. Prior to Pimcore portal engine versions 4.1.7 and 3.1.1...
CVE-2022-37164
Inoda OnTrack v3.4 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Additionally, user passwords are hashed without a salt or pepper making it much easier for tools like hashcat to crack the hashes...
CVE-2020-6857
CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local FTP server passwords is hard-coded in the binary...
CVE-2020-29193
Panasonic Security System WV-S2231L 4.25 has an insecure hard-coded password of lkjhgfdsa which is just the asdf keyboard row in reverse order...
Actualizer 安全漏洞
Actualizer is a simple single shell scripting solution open-sourced by ChewKeanHo for creating Debian from scratch. A security vulnerability exists in versions of Actualizer prior to 1.2.0 that stems from the use of an inappropriate SHA512 password hash algorithm, which may result in insufficient...
CVE-2025-22372 Insecure password storage in SicommNet BASEC
Insufficiently Protected Credentials vulnerability in SicommNet BASEC on SaaS allows Password Recovery. Passwords are either stored in plain text using reversible encryption, allowing an attacker with sufficient privileges to extract plain text passwords easily. This issue affects BASEC: from 14...
CVE-2025-22372 Insecure password storage in SicommNet BASEC
Insufficiently Protected Credentials vulnerability in SicommNet BASEC on SaaS allows Password Recovery. Passwords are either stored in plain text using reversible encryption, allowing an attacker with sufficient privileges to extract plain text passwords easily. This issue affects BASEC: from 14...
CVE-2024-28143 Insecure Password Change Function
The password change function at /cgi/admin.cgi does not require the current/old password, which makes the application vulnerable to account takeover. An attacker can use this to forcefully set a new password within the -rsetpass+-aaction+- parameter for a user without knowing the old password, e....