360 Wireless IP Camera is vulnerable (CNVD-2018-06852)

360 Wireless IP Camera is a webcam product from China's Qihoo 360 Qihu 360. A security vulnerability exists in the 360 Wireless IP Camera, which originates from the root account using a known SHA-512 password hash. The vulnerability can be exploited by a remote attacker to gain administrative...

Session fixation

An issue was discovered on Wireless IP Camera 360 devices. A root account with a known SHA-512 password hash exists, which makes it easier for remote attackers to obtain administrative access via a TELNET session...

jasypt: Vulnerable to timing attack against the password hash comparison

A vulnerability was found in Jasypt that would allow an attacker to perform a timing attack on password hash comparison...

CVE-2018-1000041

GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c that can result in the victim's Windows username and NTLM password hash being leaked to remote attackers through SMB. This attack appear to be exploitable v...

CVE-2018-1000041

GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c that can result in the victim's Windows username and NTLM password hash being leaked to remote attackers through SMB. This attack appear to be exploitable v...

CVE-2018-1000041

GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c that can result in the victim's Windows username and NTLM password hash being leaked to remote attackers through SMB. This attack appear to be exploitable v...

Authentication flaw

A password hash usage authentication bypass vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to bypass authentication on vulnerable installations...

CVE-2018-3601

A password hash usage authentication bypass vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to bypass authentication on vulnerable installations...

CVE-2018-3601

CVE-2018-3601 affects Trend Micro Control Manager 6.0, where a password hash usage authentication bypass allows remote attackers to bypass authentication on vulnerable installations. Multiple connected sources (NVD/CNVD/ZDI) confirm the flaw arises in how authentication challenges are handled, en...

Multiple Vulnerabilities in Sprecher AutomationSPRECON-E-C,PU-2433

Sprecher Automation GmbH provides switchgear and automation solutions for energy, industry and infrastructure development, among others. Power utilities, industry, transportation companies, municipal utilities and public institutions are among its customers. 1 An authentication path traversal...

CVE-2017-12169

It was found that FreeIPA 4.2.0 and later could disclose password hashes to users having the 'System: Read Stage Users' permission. A remote, authenticated attacker could potentially use this flaw to disclose the password hashes belonging to Stage Users. This security issue does not result in...

Trend Micro Control Manager TMCM_MembershipProvider ValidateUser Password Hash Usage Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Trend Micro Control Manager. User interaction is not required to exploit this vulnerability. The specific flaw exists within the handling of challenges for authentication. The implementation of the...

CVE-2014-10069

Hitron CVE-30360 devices use a 578A958E3DD933FC DES key that is shared across different customers' installations, which makes it easier for attackers to obtain sensitive information by decrypting a backup configuration file, as demonstrated by a password hash in the umauthaccountpassword field...

CVE-2014-10069

CVE-2014-10069 (Hitron CVE-30360) affects Hitron CVE-30360 devices. The vulnerability arises from a DES key 578A958E3DD933FC shared across installations, allowing attackers to decrypt a backup configuration file (evidenced by a password hash in um_auth_account_password). CVSS metrics: CVSS2 base ...

CVE-2014-10069

Hitron CVE-30360 devices use a 578A958E3DD933FC DES key that is shared across different customers' installations, which makes it easier for attackers to obtain sensitive information by decrypting a backup configuration file, as demonstrated by a password hash in the umauthaccountpassword field...

EulerOS 2.0 SP1 : sssd (EulerOS-SA-2017-1324)

According to the version of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that sssd's sysdbsearchuserbyupnres function did not sanitize requests when querying its local cache and was vulnerable to injection. In...

EulerOS 2.0 SP2 : sssd (EulerOS-SA-2017-1325)

According to the version of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that sssd's sysdbsearchuserbyupnres function did not sanitize requests when querying its local cache and was vulnerable to injection. In...

chromium-browser: issue with spake implementation in boringssl

Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the low-order bits of SHA512password by inspecting protocol traffic...

sssd: unsanitized input when searching in local cache database

It was found that sssd's sysdbsearchuserbyupnres function did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this flaw to retrieve ...

MGASA-2017-0421 Updated sssd packages fix security vulnerability

SSSD stores its cached data in an LDAP like local database file using libldb. To lookup cached data LDAP search filters like 'objectClass=user name=username' are used. However, in sysdbsearchuserbyupnres, the input is not sanitized and allows to manipulate the search filter for cache lookups. Thi...