364 matches found
GHSA-2CJV-6WG9-F4F3 Strapi Password Hashing is Missing Maximum Password Length Validation
Summary Strapi's password hashing implementation using bcryptjs lacks maximum password length validation. Since bcryptjs truncates passwords exceeding 72 bytes, this creates potential vulnerabilities such as authentication bypass and performance degradation. POC Create an admin user with a passwo...
Strapi Password Hashing is Missing Maximum Password Length Validation
Summary Strapi's password hashing implementation using bcryptjs lacks maximum password length validation. Since bcryptjs truncates passwords exceeding 72 bytes, this creates potential vulnerabilities such as authentication bypass and performance degradation. POC Create an admin user with a passwo...
CVE-2025-25298
Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently truncated. A user can create an account...
CVE-2025-25298
CVE-2025-25298 concerns Strapi’s @strapi/core up to v5.10.3, where bcryptjs-based password hashing does not enforce a maximum password length. Passwords longer than 72 bytes are silently truncated by bcryptjs, allowing a user to register with an overlong password and authenticate using only the f...
CVE-2025-25298 Missing Maximum Password Length Validation in Strapi Password Hashing
Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently truncated. A user can create an account...
Your passwords don’t need so many fiddly characters, NIST says
It’s once again time to change your passwords, but if one government agency has its way, this might be the very last time you do it. After nearly four years of work to update and modernize its guidance for how companies, organizations, and businesses should protect their systems and their...
EUVD-2013-3548
Malware in sbrugna...
EUVD-2012-1816
Malware in sbrugna...
EUVD-2016-3101
Malware in sbrugna...
EUVD-2021-12789
Malware in sbrugna...
EUVD-2010-3713
Malware in sbrugna...
EUVD-2015-9382
Malware in sbrugna...
EUVD-2020-29480
Malware in sbrugna...
EUVD-2022-4013
Malicious code in bioql PyPI...
EUVD-2023-1943
Malicious code in bioql PyPI...
EUVD-2022-7012
Malicious code in bioql PyPI...
EUVD-2025-6744
Malicious code in bioql PyPI...
EUVD-2022-45073
Malicious code in bioql PyPI...
EUVD-2022-53078
Malicious code in bioql PyPI...
NewStart CGSL MAIN 6.06 : cloud-init Multiple Vulnerabilities (NS-SA-2025-0230)
The remote NewStart CGSL host, running version MAIN 6.06, has cloud-init packages installed that are affected by multiple vulnerabilities: - The default cloud-init configuration, in cloud-init 0.6.2 and newer, included sshdeletekeys: 0, disabling cloud-init's deletion of ssh host keys. In some...