CVE-2021-27935

An issue was discovered in AdGuard before 0.105.2. An attacker able to get the user's cookie is able to bruteforce their password offline, because the hash of the password is stored in the cookie...

CVE-2021-27935: Insufficiently Protected Credentials

An issue was discovered in AdGuard before 0.105.2. An attacker able to get the user's cookie is able to bruteforce their password offline, because the hash of the password is stored in the cookie...

AdGuard 安全漏洞

Eugene AdGuard Home is an open source application from Eugene. It provides network-wide software for blocking ads and tracking. A security vulnerability exists in AdGuard before 0.105.2, which can be exploited by attackers to be able to brute-force their passwords offline, as the hash of the...

PT-2021-17678

Name of the Vulnerable Software and Affected Versions: AdGuard versions prior to 0.105.2 Description: An issue was discovered where an attacker who obtains a user's cookie can bruteforce their password offline. This is possible because the hash of the password is stored in the cookie...

Teachers Record Management System 1.0 - (searchteacher) SQL Injection Vulnerability

Exploit Title: Teachers Record Management System 1.0 - 'searchteacher' SQL Injection Exploit Author: Soham Bakore, Nakul Ratti Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/14399/teacher-record-system-phpmysql.html Version:1.0 Tested on: latest...

Teachers Record Management System 1.0 - 'searchteacher' SQL Injection

Exploit Title: Teachers Record Management System 1.0 - 'searchteacher' SQL Injection Date: 13/02/2021 Exploit Author: Soham Bakore, Nakul Ratti Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/14399/teacher-record-system-phpmysql.html Version:1.0...

CVE-2020-10539

An issue was discovered in Epikur before 20.1.1. The Epikur server contains the checkPasswort function that, upon user login, checks the submitted password against the user password's MD5 hash stored in the database. It is also compared to a second MD5 hash, which is the same for every user aka a...

Epikur Security Breach

Epikur is a healthcare mobile application from German company Epikur that provides users with psychotherapy, patient management, and other functions. A security vulnerability exists in Epikur before 20.1.1, which stems from a function that checks a submitted password against an MD5 hash of the...

SolarWinds Serv-U FTP Server Authorization Issues Vulnerability

SolarWinds Serv-U FTP Server is a suite of FTP and MFT file transfer software from the US-based SolarWinds Corporation. A security vulnerability exists in SolarWinds Serv-U before 15.2.2 Hotfix 1, which stems from a directory containing a user configuration file which includes a user's password...

CVE-2020-23361

CVE-2020-23361 affects phpList 3.5.3. The root cause is type juggling: the code uses == instead of === for comparing password hashes, which mishandles hashes starting with 0e followed by only digits. This enables a login bypass under affected conditions. Connected sources indicate multiple, publi...

CVE-2020-6780

Use of Password Hash With Insufficient Computational Effort in the database of Bosch FSM-2500 server and Bosch FSM-5000 server up to and including version 5.2 allows a remote attacker with admin privileges to dump the credentials of other users and possibly recover their plain-text passwords by...

Default credentials

Use of Password Hash With Insufficient Computational Effort in the database of Bosch FSM-2500 server and Bosch FSM-5000 server up to and including version 5.2 allows a remote attacker with admin privileges to dump the credentials of other users and possibly recover their plain-text passwords by...

CVE-2021-26267: Undefined Security Weakness

cPanel before 92.0.9 allows a MySQL user who has an old-style password hash to bypass suspension SEC-579...

PT-2021-16982 · Cpanel · Cpanel

Name of the Vulnerable Software and Affected Versions: cPanel versions prior to 92.0.9 Description: The issue allows a MySQL user with an old-style password hash to bypass suspension. Recommendations: For versions prior to 92.0.9, update to version 92.0.9 or later to resolve the issue...

CVE-2021-21253 Use of a One-Way Hash without a Salt in OnlineVotingSystem

OnlineVotingSystem is an open source project hosted on GitHub. OnlineVotingSystem before version 1.1.2 hashes user passwords without a salt, which is vulnerable to dictionary attacks. Therefore there is a threat of security breach in the voting system. Without a salt, it is much easier for...

CVE-2021-21253

CVE-2021-21253 concerns OnlineVotingSystem, an open-source project. The vulnerability affects versions prior to 1.1.2 where user passwords are hashed without a salt, making them susceptible to dictionary attacks (e.g., rainbow tables). The root cause is the absence of a long randomly generated sa...

CVE-2020-6780

Use of Password Hash With Insufficient Computational Effort in the database of Bosch FSM-2500 server and Bosch FSM-5000 server up to and including version 5.2 allows a remote attacker with admin privileges to dump the credentials of other users and possibly recover their plain-text passwords by...

D-Link DSL-2888A Default Configuration Issue Vulnerability

The D-link DSL-2888A is a Unified Services Router from D-link China. A default configuration issue vulnerability exists in the D-Link DSL-2888A devices, which can be exploited by an attacker to access system folders and download sensitive files e.g., password hash files...

CVE-2020-24578

An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU2.31V1.1.47ae55. It has a misconfigured FTP service that allows a malicious network user to access system folders and download sensitive files such as the password hash file...

Design/Logic Flaw

In the Macally WIFISD2-2A82 Media and Travel Router 2.000.010, the Guest user is able to reset its own password. This process has a vulnerability which can be used to take over the administrator account and results in shell access. As the admin user may read the /etc/shadow file, the password...