Default credentials

EspoCRM 5.6.4 is vulnerable to user password hash enumeration. A malicious authenticated attacker can brute-force a user password hash by 1 symbol at a time using specially crafted api/v1/User?filterList filters...

CVE-2019-14351

EspoCRM 5.6.4 is vulnerable to user password hash enumeration. A malicious authenticated attacker can brute-force a user password hash by 1 symbol at a time using specially crafted api/v1/User?filterList filters...

CVE-2019-14351

EspoCRM 5.6.4 is vulnerable to user password hash enumeration. A malicious authenticated attacker can brute-force a user password hash by 1 symbol at a time using specially crafted api/v1/User?filterList filters...

CVE-2019-14351

EspoCRM 5.6.4 is vulnerable to user password hash enumeration . An authenticated attacker can brute-force a user password hash one symbol at a time using specially crafted api/v1/User?filterList filters. The connected documents confirm the affected product/version and the attack method; no exploi...

CVE-2019-14351: Improper Restriction of Excessive Authentication Attempts

EspoCRM 5.6.4 is vulnerable to user password hash enumeration. A malicious authenticated attacker can brute-force a user password hash by 1 symbol at a time using specially crafted api/v1/User?filterList filters...

PT-2019-13630

Name of the Vulnerable Software and Affected Versions EspoCRM version 5.6.4 Description The issue allows a malicious authenticated attacker to brute-force a user password hash by 1 symbol at a time. This is achieved using specially crafted "api/v1/User?filterList" filters. Recommendations For...

CVE-2019-13338

In WESEEK GROWI before 3.5.0, a remote attacker can obtain the password hash of the creator of a page by leveraging wiki access to make API calls for page metadata. In other words, the password hash can be retrieved even though it is not a publicly available field...

CVE-2019-13338

In WESEEK GROWI before 3.5.0, a remote attacker can obtain the password hash of the creator of a page by leveraging wiki access to make API calls for page metadata. In other words, the password hash can be retrieved even though it is not a publicly available field...

CVE-2019-13338

CVE-2019-13338 affects WESEEK GROWI prior to version 3.5.0. The issue allows a remote attacker to retrieve the password hash of the page creator by leveraging wiki access to call the API for page metadata, effectively exposing a non-public field. The underlying root cause is the unintended disclo...

CVE-2019-13338

In WESEEK GROWI before 3.5.0, a remote attacker can obtain the password hash of the creator of a page by leveraging wiki access to make API calls for page metadata. In other words, the password hash can be retrieved even though it is not a publicly available field...

CVE-2019-13338

In WESEEK GROWI before 3.5.0, a remote attacker can obtain the password hash of the creator of a page by leveraging wiki access to make API calls for page metadata. In other words, the password hash can be retrieved even though it is not a publicly available field...

CVE-2019-13338: Missing Authentication for Critical Function

In WESEEK GROWI before 3.5.0, a remote attacker can obtain the password hash of the creator of a page by leveraging wiki access to make API calls for page metadata. In other words, the password hash can be retrieved even though it is not a publicly available field...

PT-2019-13274

Name of the Vulnerable Software and Affected Versions WESEEK GROWI versions prior to 3.5.0 Description A remote attacker can obtain the password hash of the creator of a page by leveraging wiki access to make API calls for page metadata. The password hash can be retrieved even though it is not a...

CVE-2018-14529

CVE-2018-14529 affects Invoxia NVX220 devices via an escape from a restricted CLI that grants access to /bin/sh, enabling disclosure of password hashes. Multiple connected sources corroborate the core issue, with the root cause described as improper access to a restricted shell leading to sensiti...

CVE-2018-14529: Exposure of Sensitive Information to an Unauthorized Actor

Invoxia NVX220 devices allow access to /bin/sh via escape from a restricted CLI, leading to disclosure of password hashes...

PT-2019-9035

Name of the Vulnerable Software and Affected Versions Invoxia NVX220 devices affected versions not specified Description The issue allows access to /bin/sh via escape from a restricted Command Line Interface CLI, leading to disclosure of password hashes. Recommendations At the moment, there is no...

Demystifying Password Hash Sync

This blog is part of a series of posts providing a behind-the-scenes look of Microsoft’s Detection and Response Team DART. While responding to cybersecurity incidents around the world, DART engages with customers who are wary about using Password Hash Sync PHS or are not utilizing this service’s...

CVE-2019-10855: Inadequate Encryption Strength

Computrols CBAS 18.0.0 mishandles password hashes. The approach is MD5 with a pw prefix, e.g., if the password is admin, it will calculate the MD5 hash of pwadmin and store it in a MySQL database...

Design/Logic Flaw

Unauthenticated password hash disclosure in the User.getUserPWD method in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to retrieve the GUI password hashes of GUI users. This vulnerability can be exploited by unauthenticated attackers with access to the web interface...

CVE-2019-9727

Unauthenticated password hash disclosure in the User.getUserPWD method in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to retrieve the GUI password hashes of GUI users. This vulnerability can be exploited by unauthenticated attackers with access to the web interface...