1881 matches found
SUSE CVE-2020-7021
Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emitrequestbody option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch...
SUSE CVE-2021-3652
A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose password was...
SUSE CVE-2022-1949
An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows...
VulnCheck KEV: CVE-2013-4786
The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol RAKP authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP message 2 response from a BMC...
The vulnerabilities of Redfish components and the API of microprogramming software for AMI MegaRAC controllers allow a perpetrator to gain unauthorized access to protected information.
The vulnerability of Redfish components and the API of microprogramming software for AMI MegaRAC controllers is related to insufficient calculation of password hashes. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...
Additional Supply Chain Vulnerabilities Uncovered in AMI MegaRAC BMC Software
Two more supply chain security flaws have been disclosed in AMI MegaRAC Baseboard Management Controller BMC software, nearly two months after three security vulnerabilities were brought to light in the same product. Firmware security firm Eclypsium said the two shortcomings were held back until n...
Additional Supply Chain Vulnerabilities Uncovered in AMI MegaRAC BMC Software
Two more supply chain security flaws have been disclosed in AMI MegaRAC Baseboard Management Controller BMC software, nearly two months after three security vulnerabilities were brought to light in the same product. Firmware security firm Eclypsium said the two shortcomings were held back until n...
CVE-2022-40258
AMI Megarac Weak password hashes for Redfish & API...
CVE-2022-40258
AMI Megarac Weak password hashes for Redfish & API...
Design/Logic Flaw
AMI Megarac Weak password hashes for Redfish & API...
CVE-2022-40258 Weak password hashes for Redfish & API
AMI Megarac Weak password hashes for Redfish & API...
CVE-2022-40258
CVE-2022-40258 affects AMI MegaRAC BMC software, describing weak password hashes for Redfish and API. Technical details from connected sources show that older MegaRAC devices use MD5 with a global salt, while newer devices use SHA-512 with per-user salts, enabling potential password cracking. Rel...
CVE-2022-40258 Weak password hashes for Redfish & API
AMI Megarac Weak password hashes for Redfish & API...
PT-2023-16280 · Econolite · Econolite Eos
Name of the Vulnerable Software and Affected Versions: Econolite EOS versions prior to 3.2.23 Description: The issue concerns a lack of password requirement for gaining "READONLY" access to log files and certain database and configuration files. One such file contains tables with MD5 hashes and...
PT-2023-7703 · Unknown · Conprosys Hmi System
Name of the Vulnerable Software and Affected Versions: CONPROSYS HMI System CHS versions 3.4.5 and earlier Description: The issue is related to the use of a password hash instead of the password for authentication, allowing a remote authenticated attacker to obtain user credentials information vi...
FreeBSD : cassandra3 -- jBCrypt integer overflow (b3fd12ea-917a-11ed-acbe-b42e991fc52e)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the b3fd12ea-917a-11ed-acbe-b42e991fc52e advisory. - Integer overflow in the cryptraw method in the key-stretching implementation in jBCrypt before 0.4...
Wordpress Paid Membership Pro code Unauthenticated SQLi
Paid Membership Pro, a WordPress plugin, prior to 2.9.8 is affected by an unauthenticated SQL injection via the code parameter. Remote attackers can exploit this vulnerability to dump usernames and password hashes from the wpusers table of the affected WordPress installation. These password hashe...
openSUSE SQL注入漏洞
openSUSE is a suite of Linux-based free operating systems and open source community projects from German company SUSE. openSUSE suffers from a SQL injection vulnerability that originates in its Travel support program that allows an attacker to extract sensitive user data bank account details,...
PT-2023-14814 · Rails +3 · Rails +3
Name of the Vulnerable Software and Affected Versions: travel-support-program versions prior to the patched version Description: The travel-support-program, a rails app supporting the openSUSE travel support program, is affected by a Ransack query injection issue. This allows sensitive user data,...
Contec CONPROSYS HMI System 授权问题漏洞
Contec CONPROSYS HMI System is an HTML5-based HMI Human Machine Interface/SCADA Supervisory Control and Data Acquisition software product from Contec Japan. An authorization issue vulnerability exists in CONPROSYS HMI System CHS, which arises from the use of password hashes instead of passwords f...