1146 matches found
CVE-2025-24806 Regulation applies separately to Username-based logins to Email-based logins in authelia
Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on SSO for applications via a web portal. If users are allowed to sign in via both username and email the regulation system treats these as separate login events. This leads to t...
CVE-2024-57707
An issue in DataEase v1 allows an attacker to execute arbitrary code via the user account and password components...
CVE-2025-22936
The Smartcom Bulgaria AD Smartcom Ralink CPE/WiFi router (models SAM-4G1G-TT-W-VC and SAM-4F1F-TT-W-A1 ) is vulnerable to a security flaw where a weak default WiFi password generation algorithm allows a remote attacker to obtain sensitive information. An attacker can exploit this to gain access t...
CVE-2022-36091
XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. Through the suggestion feature, string and list properties of objects the user shouldn't have access to can be accessed in versions prior to 13.10.4 and 14.2. This includes private personal information like...
CVE-2022-22110
In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. This may allow an attacker to brute-force users’...
CVE-2020-5229
Opencast before 8.1 stores passwords using the rather outdated and cryptographically insecure MD5 hash algorithm. Furthermore, the hashes are salted using the username instead of a random salt, causing hashes for users with the same username and password to collide which is problematic especially...
CVE-2024-53357
Multiple SQL injection vulnerabilities in EasyVirt DCScope = 8.6.0 and CO2Scope = 1.3.0 allows remote authenticated attackers, with low privileges, to 1 add an admin user via the /api/user/addalias route; 2 modifiy a user via the /api/user/updatealiasroute; 4 delete users via the /api/user/delali...
CVE-2024-53357
Multiple SQL injection vulnerabilities in EasyVirt DCScope = 8.6.0 and CO2Scope = 1.3.0 allows remote authenticated attackers, with low privileges, to 1 add an admin user via the /api/user/addalias route; 2 modifiy a user via the /api/user/updatealiasroute; 4 delete users via the /api/user/delali...
CVE-2024-53357
Multiple SQL injection vulnerabilities exist in EasyVirt DCScope versions 8.6.0 and earlier and EasyVirt CO2Scope versions 1.3.0 and earlier. These flaws allow remote authenticated attackers with low privileges to perform unauthorized actions, including adding admin users, modifying/deleting user...
CVE-2023-37398
IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts...
CVE-2023-35907 IBM Aspera Faspex information disclosure
IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts...
CVE-2023-35907
CVE-2023-35907 affects IBM Aspera Faspex versions 5.0.0–5.0.10, where default weak password requirements can allow attacker compromise of user accounts. The cited sources also show remediation: upgrade to Faspex 5.0.11 (IBM) to address the vulnerability. No exploitation details are provided in th...
CVE-2023-37398 IBM Aspera Faspex information disclosure
IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts...
CVE-2023-33838: Use of a One-Way Hash without a Salt
IBM Security Verify Governance 10.0.2 Identity Manager uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input...
Advisory ROSA-SA-2025-2609
software: shadow-utils 4.10 WASP: ROSA-CHROME packageevrstring: shadow-utils-4.10-7 CVE-ID: CVE-2023-4641 BDU-ID: 2024-02776 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in the shadow-utils package involves requesting a password twice and failing to clear the memory buffer. Exploitation of the...
How Long Does It Take Hackers to Crack Modern Hashing Algorithms?
While passwords remain the first line of defense for protecting user accounts against unauthorized access, the methods for creating strong passwords and protecting them are continually evolving. For example, NIST password recommendations are now prioritizing password length over complexity...
About the security content of Safari 18.3
About the security content of Safari 18.3 This document describes the security content of Safari 18.3. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...
CVE-2024-48460
An issue in Eugeny Tabby 1.0.213 allows a remote attacker to obtain sensitive information via the server and sends the SSH username and password even when the host key verification fails...
BIT-PHP-MIN-2024-3096 PHP function password_verify can erroneously return true when argument contains NUL
In PHP version 8.1. before 8.1.28, 8.2. before 8.2.18, 8.3. before 8.3.5, if a password stored with passwordhash starts with a null byte \x00, testing a blank string as the password via passwordverify will incorrectly return true...
