2383 matches found
CVE-2014-10069
Hitron CVE-30360 devices use a 578A958E3DD933FC DES key that is shared across different customers' installations, which makes it easier for attackers to obtain sensitive information by decrypting a backup configuration file, as demonstrated by a password hash in the umauthaccountpassword field...
CVE-2014-10069
CVE-2014-10069 (Hitron CVE-30360) affects Hitron CVE-30360 devices. The vulnerability arises from a DES key 578A958E3DD933FC shared across installations, allowing attackers to decrypt a backup configuration file (evidenced by a password hash in um_auth_account_password). CVSS metrics: CVSS2 base ...
CVE-2014-10069: Undefined Security Weakness
Hitron CVE-30360 devices use a 578A958E3DD933FC DES key that is shared across different customers' installations, which makes it easier for attackers to obtain sensitive information by decrypting a backup configuration file, as demonstrated by a password hash in the umauthaccountpassword field...
PT-2018-1887
Name of the Vulnerable Software and Affected Versions GNOME librsvg versions prior to commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea Description The issue is related to improper input validation in the rsvg-io.c file, which can lead to the leakage of a victim's Windows username and NTLM password...
EulerOS 2.0 SP2 : sssd (EulerOS-SA-2017-1325)
According to the version of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that sssd's sysdbsearchuserbyupnres function did not sanitize requests when querying its local cache and was vulnerable to injection. In...
EulerOS 2.0 SP1 : sssd (EulerOS-SA-2017-1324)
According to the version of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that sssd's sysdbsearchuserbyupnres function did not sanitize requests when querying its local cache and was vulnerable to injection. In...
chromium-browser: issue with spake implementation in boringssl
Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the low-order bits of SHA512password by inspecting protocol traffic...
sssd: unsanitized input when searching in local cache database
It was found that sssd's sysdbsearchuserbyupnres function did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this flaw to retrieve ...
MGASA-2017-0421 Updated sssd packages fix security vulnerability
SSSD stores its cached data in an LDAP like local database file using libldb. To lookup cached data LDAP search filters like 'objectClass=user name=username' are used. However, in sysdbsearchuserbyupnres, the input is not sanitized and allows to manipulate the search filter for cache lookups. Thi...
jasypt: Vulnerable to timing attack against the password hash comparison
A vulnerability was found in Jasypt that would allow an attacker to perform a timing attack on password hash comparison...
NQ Contacts Backup&Restore Information Disclosure Vulnerability (CNVD-2017-35644)
NQ Contacts Backup&Restore application for Android is a set of data backup and recovery software based on Android platform. A security vulnerability exists in version 1.1 of the NQ Contacts Backup&Restore application for Android, which originates when the program passes a plaintext username along...
CVE-2017-15999
In the "NQ Contacts Backup & Restore" application 1.1 for Android, no HTTPS is used for transmitting login and synced user data. When logging in, the username is transmitted in cleartext along with an SHA-1 hash of the password. The attacker can either crack this hash or use it for further attack...
Skybox Manager Client Application Information Disclosure Vulnerability
Skybox Manager Client Application is a client-side management application of a network security risk analysis tool from Skybox Security, USA. An information disclosure vulnerability exists in Skybox Manager Client Application versions prior to 8.5.501. A local attacker can exploit this...
jasypt: Vulnerable to timing attack against the password hash comparison
A vulnerability was found in Jasypt that would allow an attacker to perform a timing attack on password hash comparison...
jasypt: Vulnerable to timing attack against the password hash comparison
A vulnerability was found in Jasypt that would allow an attacker to perform a timing attack on password hash comparison...
jasypt: Vulnerable to timing attack against the password hash comparison
A vulnerability was found in Jasypt that would allow an attacker to perform a timing attack on password hash comparison...
CVE-2017-12173
It was found that sssd's sysdbsearchuserbyupnres function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this fla...
PT-2017-3848
Name of the Vulnerable Software and Affected Versions sssd versions prior to 1.16.0 Description The issue is related to insufficient input validation in the sysdb search user by upn res function of the sssd service, which manages access to remote directories and authentication mechanisms. This fl...
Flying Fishstar VE602W+ Router Has Information Disclosure Vulnerability
Flyingfish Star VE602W+ is a newly developed Internet Behavior Management Router from Chengdu Flyingfish Star Technology Development Co. There is an information leakage vulnerability in FMS VE602W+ router. The vulnerability is caused by the leakage of the administrator password hash of FMS VE602W...