1881 matches found
Authentication flaw
An issue was discovered in PRiSE adAS 1.7.0. Password hashes are compared using the equality operator. Thus, under specific circumstances, it is possible to bypass login authentication...
CVE-2019-15088
PRiSE adAS 1.7.0 contains an authentication bypass vulnerability where password hashes are compared using the equality operator. This improper comparison can allow bypassing login under certain conditions, as described in CVE-2019-15088 and reflected in multiple sources (NVD, Red Hat advisory, CV...
How to: Kerberoast like a boss
Kerberoasting: by default, all standard domain users can request a copy of all service accounts along with their correlating password hashes. Crack these and you could have administrative privileges. But that’s so 2014. Why write a blog post about this in 2019 then? It still works well, yet there...
PT-2019-13878 · WordPress · Easyappointments
Name of the Vulnerable Software and Affected Versions: Easy!Appointments plugin for WordPress version 1.3.2 Description: The issue allows for Sensitive Information Disclosure, specifically exposing usernames and password hashes. Recommendations: For Easy!Appointments plugin for WordPress version...
Knowage Trust Management Issues Vulnerabilities
Knowage is a suite of open source tools for modern business analytics. A security vulnerability exists in Knowage 6.1.1 and earlier versions. An attacker can exploit the vulnerability to obtain all user password hashes...
CVE-2019-13349
In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes...
CVE-2019-13349
In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes...
Default credentials
In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes...
CVE-2019-13349
In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes...
CVE-2019-13421
Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal user database...
CVE-2019-13421
The CVE-2019-13421 affects floragunn Search Guard (Elasticsearch/ELK plug‑ins). Versions before 23.1 expose an information-disclosure flaw whereby an administrative user can retrieve bcrypt password hashes of other users from the internal user database. The issue is confirmed across multiple sour...
CVE-2019-13421
Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal user database...
glpi -- Account takeover vulnerability
MITRE Corporation reports: GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an...
CVE-2016-10841
The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes SEC-73...
CVE-2016-10841
The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes SEC-73...
Default credentials
The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes SEC-73...
CVE-2016-10841
The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes SEC-73...
CVE-2018-14529
Invoxia NVX220 devices allow access to /bin/sh via escape from a restricted CLI, leading to disclosure of password hashes...