87870 matches found
JLSEC-2026-1330
curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS servers...
CVE-2026-75010
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver...
CVE-2026-75010
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver...
CVE-2026-75010
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver...
CVE-2026-75010
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver...
EUVD-2026-60174
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver...
CVE-2026-75010
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the password plugin's modoboa driver can leak a Modoboa API authentication token to a user-controlled host via crafted session data, affecting only instances using that driver. CVSS 3.1 score is 6.4 (Medium). Patches are available in 1.6....
PYSEC-2026-3764
opensslencrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this weakened key derivation to more efficiently crack passwords...
PYSEC-2026-3764
opensslencrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this weakened key derivation to more efficiently crack passwords...
CVE-2026-74888
opensslencrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this weakened key derivation to more efficiently crack passwords...
CVE-2026-74874
opensslencrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generatepseudorandomsequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations...
PYSEC-2026-3753
opensslencrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/pid/cmdline to retrieve plaintext passwords and keystore passwords...
CVE-2026-74871
opensslencrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When configured with a single KDF and no prior hashing stage, attackers can bypass memory-hard key derivation and perform offline password...
CVE-2026-74873
opensslencrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/pid/cmdline to retrieve plaintext passwords and keystore passwords...
PYSEC-2026-3753
opensslencrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/pid/cmdline to retrieve plaintext passwords and keystore passwords...
PYSEC-2026-3976
opensslencrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When configured with a single KDF and no prior hashing stage, attackers can bypass memory-hard key derivation and perform offline password...
EUVD-2026-60107
opensslencrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this weakened key derivation to more efficiently crack passwords...
CVE-2026-74888 openssl_encrypt before 1.4.0 Non-Standard PBKDF2 Key Derivation
opensslencrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this weakened key derivation to more efficiently crack passwords...
CVE-2026-74888
opensslencrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this weakened key derivation to more efficiently crack passwords...
CVE-2026-74888
The PHP package openssl_encrypt before 1.4.0 uses a non-standard PBKDF2 construction (iterations=1 per call) that weakens key derivation, enabling attackers to more efficiently crack passwords protecting legacy encrypted files. No in-the-wild exploitation is reported; upgrading to version 1.4.0 i...