CVE-2014-10069

CVE-2014-10069 (Hitron CVE-30360) affects Hitron CVE-30360 devices. The vulnerability arises from a DES key 578A958E3DD933FC shared across installations, allowing attackers to decrypt a backup configuration file (evidenced by a password hash in um_auth_account_password). CVSS metrics: CVSS2 base ...

CVE-2014-10069

Hitron CVE-30360 devices use a 578A958E3DD933FC DES key that is shared across different customers' installations, which makes it easier for attackers to obtain sensitive information by decrypting a backup configuration file, as demonstrated by a password hash in the umauthaccountpassword field...

EulerOS 2.0 SP1 : sssd (EulerOS-SA-2017-1324)

According to the version of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that sssd's sysdbsearchuserbyupnres function did not sanitize requests when querying its local cache and was vulnerable to injection. In...

EulerOS 2.0 SP2 : sssd (EulerOS-SA-2017-1325)

According to the version of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that sssd's sysdbsearchuserbyupnres function did not sanitize requests when querying its local cache and was vulnerable to injection. In...

chromium-browser: issue with spake implementation in boringssl

Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the low-order bits of SHA512password by inspecting protocol traffic...

sssd: unsanitized input when searching in local cache database

It was found that sssd's sysdbsearchuserbyupnres function did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this flaw to retrieve ...

MGASA-2017-0421 Updated sssd packages fix security vulnerability

SSSD stores its cached data in an LDAP like local database file using libldb. To lookup cached data LDAP search filters like 'objectClass=user name=username' are used. However, in sysdbsearchuserbyupnres, the input is not sanitized and allows to manipulate the search filter for cache lookups. Thi...

jasypt: Vulnerable to timing attack against the password hash comparison

A vulnerability was found in Jasypt that would allow an attacker to perform a timing attack on password hash comparison...

NQ Contacts Backup&Restore Information Disclosure Vulnerability (CNVD-2017-35644)

NQ Contacts Backup&Restore application for Android is a set of data backup and recovery software based on Android platform. A security vulnerability exists in version 1.1 of the NQ Contacts Backup&Restore application for Android, which originates when the program passes a plaintext username along...

CVE-2017-15999

In the "NQ Contacts Backup & Restore" application 1.1 for Android, no HTTPS is used for transmitting login and synced user data. When logging in, the username is transmitted in cleartext along with an SHA-1 hash of the password. The attacker can either crack this hash or use it for further attack...

Skybox Manager Client Application Information Disclosure Vulnerability

Skybox Manager Client Application is a client-side management application of a network security risk analysis tool from Skybox Security, USA. An information disclosure vulnerability exists in Skybox Manager Client Application versions prior to 8.5.501. A local attacker can exploit this...

jasypt: Vulnerable to timing attack against the password hash comparison

A vulnerability was found in Jasypt that would allow an attacker to perform a timing attack on password hash comparison...

jasypt: Vulnerable to timing attack against the password hash comparison

A vulnerability was found in Jasypt that would allow an attacker to perform a timing attack on password hash comparison...

jasypt: Vulnerable to timing attack against the password hash comparison

A vulnerability was found in Jasypt that would allow an attacker to perform a timing attack on password hash comparison...

CVE-2017-12173

It was found that sssd's sysdbsearchuserbyupnres function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this fla...

Flying Fishstar VE602W+ Router Has Information Disclosure Vulnerability

Flyingfish Star VE602W+ is a newly developed Internet Behavior Management Router from Chengdu Flyingfish Star Technology Development Co. There is an information leakage vulnerability in FMS VE602W+ router. The vulnerability is caused by the leakage of the administrator password hash of FMS VE602W...

jasypt: Vulnerable to timing attack against the password hash comparison

A vulnerability was found in Jasypt that would allow an attacker to perform a timing attack on password hash comparison...

jasypt: Vulnerable to timing attack against the password hash comparison

A vulnerability was found in Jasypt that would allow an attacker to perform a timing attack on password hash comparison...

jasypt: Vulnerable to timing attack against the password hash comparison

A vulnerability was found in Jasypt that would allow an attacker to perform a timing attack on password hash comparison...

jasypt: Vulnerable to timing attack against the password hash comparison

A vulnerability was found in Jasypt that would allow an attacker to perform a timing attack on password hash comparison...