Authentication flaw

The time-based one-time-password TOTP function in the application logic of the Green Electronics RainMachine Mini-8 2nd generation uses the administrator's password hash to generate a 6-digit temporary passcode that can be used for remote and local access, aka a "Use of Password Hash Instead of...

CVE-2018-6011

The time-based one-time-password TOTP function in the application logic of the Green Electronics RainMachine Mini-8 2nd generation uses the administrator's password hash to generate a 6-digit temporary passcode that can be used for remote and local access, aka a "Use of Password Hash Instead of...

CVE-2018-6011

The time-based one-time-password TOTP function in the application logic of the Green Electronics RainMachine Mini-8 2nd generation uses the administrator's password hash to generate a 6-digit temporary passcode that can be used for remote and local access, aka a "Use of Password Hash Instead of...

CVE-2018-6011

The CVE-2018-6011 entry concerns the Green Electronics RainMachine Mini-8 (2nd generation). The TOTP function in the device’s application logic uses the administrator’s password hash to generate a 6-digit temporary passcode, enabling remote or local access. Affected component: the rainmachine-set...

CVE-2018-18754

ZyXEL VMG3312-B10B 1.00AAPP.7 devices have a backdoor root account with the tTn3+Z@!Sr0O+ password hash in the etc/default.cfg file...

CVE-2018-18754

ZyXEL VMG3312-B10B 1.00AAPP.7 devices have a backdoor root account with the tTn3+Z@!Sr0O+ password hash in the etc/default.cfg file...

Design/Logic Flaw

ZyXEL VMG3312-B10B 1.00AAPP.7 devices have a backdoor root account with the tTn3+Z@!Sr0O+ password hash in the etc/default.cfg file...

ZyXEL VMG3312-B10B Backdoor Root Account Vulnerability

The VMG3312-B10B is a Wireless N VDSL2 4-port gateway with USB from ZyXEL. A backdoor root account vulnerability exists in the ZyXEL VMG3312-B10B 1.00 AAPP.7. An attacker can exploit this vulnerability to access this backdoor root account via a tTn3+Z@!Sr0O+ password hash in the etc/default.cfg...

CVE-2018-18754

ZyXEL VMG3312-B10B 1.00AAPP.7 devices have a backdoor root account with the tTn3+Z@!Sr0O+ password hash in the etc/default.cfg file...

FreeBSD : Django -- password hash disclosure (004d8c23-c710-11e8-98c7-000c29434208)

Django release notes : CVE-2018-16984: Password hash disclosure to 'view only' admin users If an admin user has the change permission to the user model, only part of the password hash is displayed in the change form. Admin users with the view but not change permission to the user model were...

Information Disclosure

django is vulnerable to information disclosure. Admin users with the view-only permission are able to retrieve the entire password hash of arbitrary accounts through the read-only password widget that displays obfuscated password hashes...

PT-2018-13817

Name of the Vulnerable Software and Affected Versions Django versions 2.1 through 2.1.1 Django versions prior to 2.1.2 Description An issue allows unprivileged users to read the password hashes of arbitrary accounts. The read-only password widget used by the Django Admin to display an obfuscated...

Django -- password hash disclosure

Django release notes: CVE-2018-16984: Password hash disclosure to "view only" admin users If an admin user has the change permission to the user model, only part of the password hash is displayed in the change form. Admin users with the view but not change permission to the user model were...

Design/Logic Flaw

An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is password hash exposure to privileged users...

CVE-2018-17216

An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is password hash exposure to privileged users...

CVE-2018-17216

An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is password hash exposure to privileged users...

CVE-2018-15681

An issue was discovered in BTITeam XBTIT 2.5.4. When a user logs in, their password hash is rehashed using a predictable salt and stored in the "pass" cookie, which is not flagged as HTTPOnly. Due to the weak and predictable salt that is in place, an attacker who successfully steals this cookie c...

CVE-2017-15423

Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the low-order bits of SHA512password by inspecting protocol traffic...

UBUNTU-CVE-2017-15423

Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the low-order bits of SHA512password by inspecting protocol traffic...

Geutebrueck re_porter 7.8.974.20 - Credential Disclosure Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Geutebrueck reporter 7.8.974.20 - Credential Disclosure Exploit Author: Kamil Suska Vendor: https://www.geutebrueck.com/enUS.html Link: https://www.sourcesecurity.com/geutebruck-re-porter-16-technical-details.html Version:...