CVE-2020-6949: Improper Privilege Management

A privilege escalation issue was discovered in the postUser function in HashBrown CMS through 1.3.3. An editor user can change the password hash of an admin user's account, or otherwise reconfigure that account...

CVE-2019-19735: Use of Password Hash With Insufficient Computational Effort

class.userpeer.php in MFScripts YetiShare 3.5.2 through 4.5.3 uses an insecure method of creating password reset hashes based only on microtime, which allows an attacker to guess the hash and set the password within a few hours by bruteforcing...

DEBIAN-CVE-2019-19234

In Sudo through 1.8.29, the fact that a user has been blocked e.g., by using the ! character in the shadow file instead of a password hash is not considered, allowing an attacker who has access to a Runas ALL sudoer account to impersonate any blocked user. NOTE: The software maintainer believes...

UBUNTU-CVE-2019-19234

In Sudo through 1.8.29, the fact that a user has been blocked e.g., by using the ! character in the shadow file instead of a password hash is not considered, allowing an attacker who has access to a Runas ALL sudoer account to impersonate any blocked user. NOTE: The software maintainer believes...

CVE-2019-3993

ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can recover a user's password hash by sending a crafted HTTP POST request...

Information disclosure

ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can recover a user's password hash by sending a crafted HTTP POST request...

CVE-2019-3993

ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can recover a user's password hash by sending a crafted HTTP POST request...

CVE-2019-3993

Summary: CVE-2019-3993 affects ELOG 3.1.4-57bea22 and earlier. A remote unauthenticated attacker can cause an information disclosure to recover a user’s password hash via a crafted HTTP POST request, exposing credential material. Affected versions: ELOG 3.1.4-57bea22 and earlier (per Red Hat/RH, ...

PT-2019-16834

Name of the Vulnerable Software and Affected Versions ELOG versions 3.1.4-57bea22 and below Description The issue allows a remote unauthenticated attacker to recover a user's password hash by sending a crafted HTTP POST request. Recommendations For versions 3.1.4-57bea22 and below, at the moment,...

CVE-2019-3993: Exposure of Sensitive Information to an Unauthorized Actor

ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can recover a user's password hash by sending a crafted HTTP POST request...

ELOG < 3.1.4-283534d Multiple Vulnerabilities - Active Check

ELOG is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:elogproject:elog"; ifdescription...

CVE-2019-19766: Use of Password Hash With Insufficient Computational Effort

The Bitwarden server through 1.32.0 has a potentially unwanted KDF...

CVE-2019-18284: Improper Authentication

A vulnerability has been identified in SPPA-T3000 Application Server All versions Service Pack R8.2 SP2. The AdminService is available without authentication on the Application Server. An attacker can use methods exposed via this interface to receive password hashes of other users and to change...

Siemens SPPA-T3000 Application Server Improper Authentication Vulnerability (CNVD-2019-45416)

SPPA-T3000 is a distributed control system mainly used in thermal power plants and large-scale renewable energy power plants.Application Server is the application server in it, which provides the main system services including access control, distribution of data to thin clients and archiving. A...

Siemens SINEMA Remote Connect Server Multiple Vulnerabilities (SSA-884497)

Binary data scadasiemenssinemarcssa-884497.nbin...

CVE-2012-6077

The CVE-2012-6077 issue affects the WordPress W3 Total Cache plugin (versions before 0.9.2.5). The root cause is insecure storage of database cache files, enabling remote attackers to retrieve password hash information. Documents indicate exposure of usernames and password hashes via the plugin’s...

CVE-2012-6077

W3 Total Cache before 0.9.2.5 allows remote attackers to retrieve password hash information due to insecure storage of database cache files...

CVE-2012-6077

W3 Total Cache before 0.9.2.5 allows remote attackers to retrieve password hash information due to insecure storage of database cache files...

CVE-2012-6077: Exposure of Sensitive Information to an Unauthorized Actor

W3 Total Cache before 0.9.2.5 allows remote attackers to retrieve password hash information due to insecure storage of database cache files...

sssd Function Heap Buffer Overflow DoS

The vulnerability of the ssedbsearchuserbyupnres function of the access control service for remote directories and the sssd authentication mechanism is related to insufficient validation of input data when querying the local cache that stores password hashes. Exploiting this vulnerability could...