309 matches found
InvenTree Deploys a Weak Password Change Mechanism
Description When setting a new user password, InvenTree does not require knowledge of the original password or using another form of authentication. Proof of Concept 1. Log in as a regular user 2. Go to the account settings link 3. Select Set Password 4. Enter any 8-character password string this...
CVE-2022-29700
A lack of password length restriction in Zammad v5.1.0 allows for the creation of extremely long passwords which can cause a Denial of Service DoS during password verification...
The vulnerability of the administration interface of the Cisco Wireless LAN Controller allows a perpetrator to increase their privileges.
The vulnerability of the Cisco Wireless LAN Controller administration interface is related to errors in the implementation of the password verification algorithm. Exploiting this vulnerability can allow an attacker to enhance their privileges using specially crafted credentials...
CVE-2021-46390
An access control issue in the authentication module of LexarF35 v1.0.34 allows attackers to access sensitive data and cause a Denial of Service DoS. An attacker without access to securely protected data on a secure USB flash drive can bypass user authentication without having any information...
CVE-2021-46390
An access control issue in the authentication module of LexarF35 v1.0.34 allows attackers to access sensitive data and cause a Denial of Service DoS. An attacker without access to securely protected data on a secure USB flash drive can bypass user authentication without having any information...
The vulnerability of the microprogrammed Ethernet module WISE-4060 and Adam-6050 D lies in the lack of input password verification procedures, allowing attackers to gain full access to the device with administrator privileges.
The vulnerability of the Microprogrammed Ethernet module WISE-4060 and Adam-6050 D lies in the deficiencies in the input password verification process. Exploiting this vulnerability allows a malicious actor to gain full access to the device with administrator privileges through a specially crafte...
WhatsApp to Finally Let Users Encrypt Their Chat Backups in the Cloud
WhatsApp on Friday announced it will roll out support for end-to-end encrypted chat backups on the cloud for Android and iOS users, paving the way for storing information such as chat messages and photos in Apple iCloud or Google Drive in a cryptographically secure manner. The optional feature,...
The vulnerability of the microprogrammed Ethernet switch software from Moxa EDS-405A series lies in the fact that the output operation goes beyond the buffer on the stack, allowing a hacker to trigger a service failure or execute arbitrary code.
The vulnerability of the microprogrammed Ethernet switch software from Moxa EDS-405A series lies in the fact that the operation is performed outside the buffer on the stack during password verification. Exploiting this vulnerability allows a malicious actor to cause service failures or execute...
UPchieve: Business logic error
Hi UPCHIEVE SECURITY TEAM I'm Anto Vulnerability : Business logic error There is no password verification while changing a password. Steps to Reproduce : 1. Go to https://hackers.upchieve.org/resetpassword. 2. Click the change password. 3. If your old password was ex: hacker and in new password...
GHSA-9MGM-GCQ8-86WQ Improper Authentication in Apache ActiveMQ and Apache Artemis
The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error...
June 8, 2021—KB5003637 (OS Builds 19041.1052, 19042.1052, and 19043.1052)
None None...
PAX Technology PAXSTORE 授权问题漏洞
PAX Technology PAXSTORE is an application from China PAX PAX Inc. An ecosystem that connects 2.5 million terminals, thousands of application developers and 180+ markets in 80+ countries worldwide. An access control error vulnerability exists in Pax Technology PAXSTORE version v7.0.820200511171508...
Voting System 1.0 - Time based SQLI (Unauthenticated SQL injection)
Exploit Title: Voting System 1.0 - Time based SQLI Unauthenticated SQL injection Date: 02/05/2021 Exploit Author: Syed Sheeraz Ali Vendor Homepage: https://www.sourcecodester.com/php/12306/voting-system-using-php.html Software Link:...
bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible
A flaw was found in bouncycastle. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password allowing incorrect passwords to indicate they were matching with previously hashed ones that were different. The highest threat from this vulnerability is to data...
Moodle 安全漏洞
Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle has a security vulnerability in which a user can be created to authenticate an account without access to a verification email...
CVE-2020-10048
A vulnerability has been identified in SIMATIC PCS 7 All versions, SIMATIC WinCC All versions V7.5 SP2. Due to an insecure password verification process, an attacker could bypass the password protection set on protected files, thus being granted access to the protected content, circumventing...
CVE-2020-10048
A vulnerability has been identified in SIMATIC PCS 7 All versions, SIMATIC WinCC All versions V7.5 SP2. Due to an insecure password verification process, an attacker could bypass the password protection set on protected files, thus being granted access to the protected content, circumventing...
Authentication flaw
A vulnerability has been identified in SIMATIC PCS 7 All versions, SIMATIC WinCC All versions V7.5 SP2. Due to an insecure password verification process, an attacker could bypass the password protection set on protected files, thus being granted access to the protected content, circumventing...
CVE-2020-10048
A vulnerability has been identified in SIMATIC PCS 7 All versions, SIMATIC WinCC All versions V7.5 SP2. Due to an insecure password verification process, an attacker could bypass the password protection set on protected files, thus being granted access to the protected content, circumventing...
Design/Logic Flaw
An issue was discovered in Epikur before 20.1.1. The Epikur server contains the checkPasswort function that, upon user login, checks the submitted password against the user password's MD5 hash stored in the database. It is also compared to a second MD5 hash, which is the same for every user aka a...