CVE-2024-1346

CVE-2024-1346 LaborOfficeFree의 약한 MySQL 데이터베이스 루트 비밀번호가 버전 19.10에 영향을 미칩니다. 이 취약점으로 인해 공격자는 두 개의 상수를 사용하여 LaborOfficeFree에서 사용하는 MySQL 데이터베이스의 루트 비밀번호를 계산할 수 있습니다. Exploit Title: LaborOfficeFree 19.10 MySQL Root Password Calculator - CVE-2024-1346 Google Dork: N/A Date: 09/02/2023 Exploit Author:...

CVE-2023-6329

CVE-2023-6329 — Control iD iDSecure 인증 우회 CVE-2023-6329 에 대한 Python 개념 증명 익스플로잇으로, Control iD iDSecure 4.7.43.0 이하 버전에서 발견된 부적절한 접근 제어 취약점입니다. 이 결함은 인증되지 않은 원격 공격자가 공개적으로 접근 가능한 값장치 일련번호, 서버에서 제공하는 nonce, 하드코딩된 솔트만을 사용하는 예측 가능한 비밀번호 유도 알고리즘을 악용하여 유효한 로그인 자격 증명을 재구성할 수 있게 합니다. 인증에 성공하면 공격자는 웹...

CVE-2012-1803

CVE-2012-1803 Siemens RuggedCom ROS 장치의 심각한 취약점으로, 공격자가 장치의 MAC 주소로부터 숨겨진 공장factory 계정 비밀번호를 유도해내고 TELNET, rsh 또는 직렬 인터페이스를 통해 권한 없는 관리자 액세스를 획득할 수 있습니다. ROS 3.10.x 및 이전 버전에 영향을 미칩니다...

EUVD-2026-75055

An attacker could derive the camera's Wi-Fi password and connect to its wireless network. This weakens or eliminates the security value of the access-point password and may expose the live video stream, device services, status interfaces, and firmware-update functionality...

PT-2026-89076

An attacker could derive the camera's Wi-Fi password and connect to its wireless network. This weakens or eliminates the security value of the access-point password and may expose the live video stream, device services, status interfaces, and firmware-update functionality...

Allocation of Resources Without Limits or Throttling

Overview org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the engineLoad method of BcFKSKeyStoreSpi, which reads HMAC PBKDF2 or scrypt cost parameters...

Allocation of Resources Without Limits or Throttling

Overview org.bouncycastle:bcprov-debug-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the engineLoad method of BcFKSKeyStoreSpi, which reads HMAC PBKDF2 or scrypt cost...

Allocation of Resources Without Limits or Throttling

Overview org.bouncycastle:bcprov-jdk15 is a package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5. Affected versions of this package are vulnerable to Allocation of Resources Without...

Allocation of Resources Without Limits or Throttling

Overview org.bouncycastle:bcprov-jdk16 is a Bouncy Castle Crypto package that is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.6. Affected versions of this package are vulnerable to Allocatio...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the engineLoad method of BcFKSKeyStoreSpi, which reads HMAC PBKDF2 or scrypt cost parameters from a keystore's integrity structures and runs key derivation before MAC verification,...

Allocation of Resources Without Limits or Throttling

Overview bouncycastle:bcprov-jdk12 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the engineLoad method of BcFKSKeyStoreSpi, which reads HMAC PBKDF2 or scrypt cost parameters from a...

Allocation of Resources Without Limits or Throttling

Overview org.bouncycastle:bcprov-jdk14 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the engineLoad method of BcFKSKeyStoreSpi, which reads HMAC PBKDF2 or scrypt cost parameters fro...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in PKCS12KeyStoreSpi, which feeds the attacker-controlled KDF iteration count from a PKCS12 file's MAC data and encrypted bags into key derivation during engineLoad without enforcing...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in JcePKCSPBEInputDecryptorProviderBuilder and JceOpenSSLPKCS8DecryptorProviderBuilder, which parse PBES2Parameters from attacker-supplied EncryptedPrivateKeyInfo, PKCS12, or CMS...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in JcePKCSPBEInputDecryptorProviderBuilder and JceOpenSSLPKCS8DecryptorProviderBuilder, which parse PBES2Parameters from attacker-supplied EncryptedPrivateKeyInfo, PKCS12, or CMS...

EUVD-2026-46430

Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm and required inputs to authenticate to the web...

CVE-2026-8982

Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm and required inputs to authenticate to the web...

CVE-2026-8982 Hard-coded / Backdoor Accounts

Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm and required inputs to authenticate to the web...

PT-2026-62120

Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm and required inputs to authenticate to the web...

[SECURITY] Fedora 44 Update: perl-Crypt-ScryptKDF-0.011-1.fc44

Scrypt is a password-based key derivation function like for example PBKDF2. Scrypt was designed to be "memory-hard" algorithm in order to make it expensive to perform large scale custom hardware attacks...