1881 matches found
CVE-2022-29731
An access control issue in ICT Protege GX/WX 2.08 allows attackers to leak SHA1 password hashes of other users...
CVE-2022-29731
An access control issue in ICT Protege GX/WX 2.08 allows attackers to leak SHA1 password hashes of other users...
CVE-2022-29731
An access control issue in ICT Protege GX/WX 2.08 allows attackers to leak SHA1 password hashes of other users...
CVE-2022-1949
An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows...
UBUNTU-CVE-2022-1949
An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows...
CVE-2022-29731
An access control issue in ICT Protege GX/WX 2.08 allows attackers to leak SHA1 password hashes of other users...
CVE-2022-29731
CVE-2022-29731 affects ICT Protege GX/WX version 2.08. The issue is an improper access control that allows an authenticated operator to disclose SHA-1 password hashes of other users (client-side hashes). The vulnerability has been documented in ZSL-2022-5700 with a PoC and vendor notifications; p...
Insertion of Sensitive Information into Log File in Elasticsearch
Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emitrequestbody option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch...
GHSA-CQGV-256R-M9R8 Insertion of Sensitive Information into Log File in Elasticsearch
Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emitrequestbody option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch...
GHSA-R3FQ-CMMW-CPMM Containous Traefik Exposes Password Hashes
types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without sufficient access control which is contrary to the API documentation, allows remote authenticated users to discover password hashes by reading the Basic HTT...
Containous Traefik Exposes Password Hashes
types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without sufficient access control which is contrary to the API documentation, allows remote authenticated users to discover password hashes by reading the Basic HTT...
CVE-2019-14666
GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any use...
CVE-2020-16231
The affected Bachmann Electronic M-Base Controllers of version MSYS v1.06.14 and later use weak cryptography to protect device passwords. Affected controllers that are actively supported include MX207, MX213, MX220, MC206, MC212, MC220, and MH230 hardware controllers, and affected end-of-life...
CVE-2020-16231
The affected Bachmann Electronic M-Base Controllers of version MSYS v1.06.14 and later use weak cryptography to protect device passwords. Affected controllers that are actively supported include MX207, MX213, MX220, MC206, MC212, MC220, and MH230 hardware controllers, and affected end-of-life...
CVE-2020-16231 All Bachmann M1 System Processor Modules - Use of Password Hash with Insufficient Computational Effort
The affected Bachmann Electronic M-Base Controllers of version MSYS v1.06.14 and later use weak cryptography to protect device passwords. Affected controllers that are actively supported include MX207, MX213, MX220, MC206, MC212, MC220, and MH230 hardware controllers, and affected end-of-life...
Apache Rave information disclosure vulnerability
The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response...
GHSA-428J-Q447-47RW Apache Rave information disclosure vulnerability
The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response...
Integer Overflow or Wraparound in JBCrypt
Integer overflow in the cryptraw method in the key-stretching implementation in JBCrypt before 0.4 makes it easier for remote attackers to determine cleartext values of password hashes via a brute-force attack against hashes associated with the maximum exponent...
GHSA-9H6P-92JQ-888X Integer Overflow or Wraparound in JBCrypt
Integer overflow in the cryptraw method in the key-stretching implementation in JBCrypt before 0.4 makes it easier for remote attackers to determine cleartext values of password hashes via a brute-force attack against hashes associated with the maximum exponent...
CVE-2022-24041
A vulnerability has been identified in Desigo DXR2 All versions V01.21.142.5-22, Desigo PXC3 All versions V01.21.142.4-18, Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The web application stores the PBKDF2 derived key of users passwords with a low...