PT-2025-11262

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue concerns the use of an unencrypted, proprietary protocol for communication, which allows an attacker to intercept the authentication hash. This hash can then be used to log into th...

CVE-2025-27594: Cleartext Transmission of Sensitive Information

The device uses an unencrypted, proprietary protocol for communication. Through this protocol, configuration data is transmitted and device authentication is performed. An attacker can thereby intercept the authentication hash and use it to log into the device using a pass-the-hash attack...

ALPINE-CVE-2024-38472

SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note: Existing configurations that access UNC paths will have to configure new...

PT-2023-23789 · Alerton · Alerton Acm

Name of the Vulnerable Software and Affected Versions: BCM-WEB version 3.3.X Description: An attacker can capture an authenticating hash and utilize it to create new sessions. The hash is also a poorly salted MD5 hash, which could result in a successful brute force password attack. Recommendation...

Honeywell Alerton 安全漏洞

Honeywell Alerton is a solution from Honeywell USA. A security vulnerability exists in Honeywell Alerton BCM-WEB version 3.3.X. The vulnerability can be exploited by an attacker to capture an authentication hash and use it to create a new session. An attacker could exploit the vulnerability to...

CVE-2023-33243

RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext password. While storing password hashes instead of cleartext passwords in an application's database generally has become be...

Bruhn NewTech CBRN-Analysis 代码问题漏洞

Bruhn NewTech CBRN-Analysis is an advanced, off-the-shelf CBRN defense knowledge management software application from Bruhn NewTech. It provides knowledge management, hazard prediction, and warning and reporting W&R capabilities to support operational planning and execution. A security...

DRUPAL-CONTRIB-2021-030

This module enables you to create an individual hash for each user. These hashes can be used for authentication instead of the user's password, e.g. for views exporters. The module doesn't sufficiently invalidate page output when the page\cache module is used. This vulnerability is mitigated by t...

SAP NetWeaver Application Server 信息泄露漏洞

SAP Netweaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. An information disclosure vulnerability exists in SAP NetWeaver Application Server for Java versions 7.30, 7.31,...

The vulnerability of Skype for Business and Microsoft Lync messaging programs, related to deficiencies in access control, allows attackers to steal authentication hash codes.

The vulnerability of Skype for Business and Microsoft Lync instant messaging programs is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to steal the authentication hash code which can be reused, using a specially created user profile...

PT-2017-3101

Name of the Vulnerable Software and Affected Versions Skype for Business versions in Microsoft Lync 2013 SP1 and Skype for Business 2016 Description The issue is related to how Skype for Business handles authentication requests, allowing an attacker to steal an authentication hash that can be...

CVE-2017-14971

Infocus Mondopad 2.2.08 is vulnerable to a Hashed Credential Disclosure vulnerability. The attacker provides a crafted Microsoft Office document containing a link that has a UNC pathname associated with an attacker-controller server. In one specific scenario, the attacker provides an Excel...