100 matches found
CVE-2012-2122-Home-Lab
CVE-2012-2122 MySQL 認証バイパス ホームラボ このラボは、CVE-2012-2122 - MySQL 認証バイパス の脆弱性をデモンストレーションするものです。 MySQL 5.5.23 以前のバージョンにおけるパスワード比較のエラーが原因で発生します。 攻撃者が間違ったパスワードを繰り返し送信すると、MySQL が誤ってログインを許可してしまう可能性があります。 特徴 vulhub/mysql:5.5.23 をベースに使用 entrypoint.sh スクリプトでフラグを自動生成 フラグは /tmp/flag.txt に配置 docker restart...
Oracle-mysql-CVE-2012-2122
Mysql 認証バイパス脆弱性 CVE-2012-2122 MariaDB/MySQL に接続する際、入力されたパスワードと期待される正しいパスワードが比較されます。不適切な処理により、memcmp が非ゼロを返した場合でも、MySQL は両方のパスワードが同一であると見なします。つまり、ユーザー名さえ分かれば、繰り返し試行することで SQL データベースに直接ログインできます。 影響を受けるバージョン： MariaDB バージョン 5.1.62、5.2.12、5.3.6、5.5.23 は対象外です。 MySQL バージョン 5.1.63、5.5.24、5.6.6 は対象外です。...
SUSE CVE-2026-42393
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...
CVE-2026-42393
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...
AZL-98310 CVE-2026-42393 affecting package dovecot 2.3.20-1
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...
ALPINE-CVE-2026-42393
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...
EUVD-2026-67676
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...
CVE-2026-42393
CVE-2026-42393 affects the doveadm service in Open-Xchange's Dovecot implementation. The password and API key comparison is not fully timing-safe, allowing a network-adjacent attacker who can make repeated requests and accurately measure response times to learn the length of the configured secret...
CVE-2026-42393
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...
CVE-2026-42393
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...
CVE-2026-42393
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...
CVE-2026-42393
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...
PT-2026-83069
Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description The comparison process for the doveadm password and API key is not fully timing safe. This allows an attacker on the same network as the doveadm service to determine the length of the configured...
UBUNTU-CVE-2026-42393
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...
CVE-2026-42393
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...
Oracle Linux 10 : pam (ELSA-2026-59379)
The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-59379 advisory. 1.6.1-9.1 - pamuserdb: fix password comparison timing leak. Resolves: CVE-2026-54411 and RHEL-191704 Tenable has extracted the preceding description block...
pam security update
1.6.1-9.1 - pamuserdb: fix password comparison timing leak. Resolves: CVE-2026-54411 and RHEL-191704...
GHSA-8FXQ-53RX-PH5F Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison
Summary userpassword.Compare substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash nonexistent users and SSO-only users and a subsequent login-type check returned an HTTP 40...
Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison
Summary userpassword.Compare substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash nonexistent users and SSO-only users and a subsequent login-type check returned an HTTP 40...