Cortex XDR Agent: Supervisor Password Hash Disclosure Vulnerability When Generating Support Files

An information exposure vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local user to learn the cryptographic hash of the supervisor password when generating support files on a deployed agent. An attacker must crack the supervisor password hash to make unauthorized...

Design/Logic Flaw

Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5UC CPU all versions, Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU all versions, Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU all versions, Mitsubishi Electric MELSEC iQ-R series...

CVE-2022-24784

CVE-2022-24784 affects the Statamic CMS (Laravel/Git powered). Before versions 3.2.39 and 3.3.2, an attacker could confirm a single character of a user’s password hash by sending crafted requests to the REST API’s users endpoint using a regular expression filter. Repeated requests could gradually...

ICT Protege GX/WX 2.08 - Client-Side SHA1 Password Hash Disclosure Vulnerability

Exploit Title: ICT Protege GX/WX 2.08 - Client-Side SHA1 Password Hash Disclosure Exploit Author: LiquidWorm Vendor: Integrated Control Technology Ltd. Product web page: https://www.ict.co Affected version: GX: Ver: 2.08.1002 K1B3 Lib: 04.00.217 Int: 2.3.235.J013 OS: 2.0.20 WX: Ver: 4.00 284 H062...

ICT Protege GX/WX 2.08 Client-Side SHA1 Password Hash Disclosure

Summary Protege GX is an enterprise level integrated access control, intrusion detection and building automation solution with a feature set that is easy to operate, simple to integrate and effortless to extend. Protege WX is an all-in-one, web-based, cross-platform system that gives you a fully...

ICT Protege GX/WX 2.08 Client-Side SHA1 Password Hash Disclosure

ICT Protege GX/WX 2.08 Client-Side SHA1 Password Hash Disclosure Vendor: Integrated Control Technology Ltd. Product web page: https://www.ict.co Affected version: GX: Ver: 2.08.1002 K1B3 Lib: 04.00.217 Int: 2.3.235.J013 OS: 2.0.20 WX: Ver: 4.00 284 H062 App: 02.08.766 Lib: 04.00.169 Int: 02.2.208...

PT-2022-12343

Name of the Vulnerable Software and Affected Versions SalonERP version 3.0.1 Description A SQL injection issue allows an attacker to inject a payload using the sql parameter in a SQL query while generating a report. This can lead to the discovery of the login admin password hash, which can then b...

CVE-2021-27491: Insufficiently Protected Credentials

Ypsomed mylife Cloud, mylife Mobile Application:Ypsomed mylife Cloud,All versions prior to 1.7.2,Ypsomed mylife App,All versions prior to 1.7.5,The Ypsomed mylife Cloud discloses password hashes during the registration process...

Ypsomed mylife App has an unspecified vulnerability

Ypsomed mylife App is an application of Ypsomed AG. To optimize communication between people with diabetes and healthcare professionals, mylife Therapy Management is an easy-to-use, easy-to-share solution for diabetes therapy data. mylife App by Ypsomed suffers from a security vulnerability that...

Ypsomed mylife App 安全漏洞

Ypsomed mylife App is an application of Ypsomed AG. To optimize communication between people with diabetes and healthcare professionals, mylife Therapy Management is an easy-to-use, easy-to-share solution for diabetes therapy data. mylife App by Ypsomed suffers from a security vulnerability that...

CVE-2021-26705

An issue was discovered in SquareBox CatDV Server through 9.2. An attacker can invoke sensitive RMI methods such as getConnections without authentication, the results of which can be used to generate valid authentication tokens. These tokens can then be used to invoke administrative tasks within...

ELOG Project Information Disclosure (CVE-2019-3993)

An information disclosure vulnerability exists in ELOG Project. Successful exploitation of this vulnerability could cause the ELOG server to disclose the password hash for a user...

ELOG < 3.1.4-283534d Multiple Vulnerabilities - Active Check

ELOG is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:elogproject:elog"; ifdescription...

CVE-2019-18284: Improper Authentication

A vulnerability has been identified in SPPA-T3000 Application Server All versions Service Pack R8.2 SP2. The AdminService is available without authentication on the Application Server. An attacker can use methods exposed via this interface to receive password hashes of other users and to change...

PT-2019-7637

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 11.54.0.4 Description The issue concerns the disclosure of password hashes due to a problem in the bin/mkvhostspasswd script. Recommendations For versions prior to 11.54.0.4, update to version 11.54.0.4 or later to...

CVE-2016-10841: Undefined Security Weakness

The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes SEC-73...

PT-2019-7640

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 11.54.0.4 Description The issue concerns the chcpass script in cPanel, which reveals a password hash. Recommendations For versions prior to 11.54.0.4, update to version 11.54.0.4 or later to resolve the issue...

CVE-2019-13338

In WESEEK GROWI before 3.5.0, a remote attacker can obtain the password hash of the creator of a page by leveraging wiki access to make API calls for page metadata. In other words, the password hash can be retrieved even though it is not a publicly available field...

CVE-2018-14529

CVE-2018-14529 affects Invoxia NVX220 devices via an escape from a restricted CLI that grants access to /bin/sh, enabling disclosure of password hashes. Multiple connected sources corroborate the core issue, with the root cause described as improper access to a restricted shell leading to sensiti...

CVE-2018-14529: Exposure of Sensitive Information to an Unauthorized Actor

Invoxia NVX220 devices allow access to /bin/sh via escape from a restricted CLI, leading to disclosure of password hashes...