395 matches found
UBUNTU-CVE-2022-22976
Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor 31, the encoder does not perform any salt rounds, due to an integer overflow error. The default...
CVE-2022-22976
Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor 31, the encoder does not perform any salt rounds, due to an integer overflow error. The default...
CVE-2022-22976
CVE-2022-22976 affects Spring Security: when using BCrypt with maximum work factor (31), the encoder skips salt rounds due to an integer overflow. Affected: Spring Security 5.5.x before 5.5.7 and 5.6.x before 5.6.4 (plus unsupported earlier versions). Default settings are not affected. Remediatio...
CVE-2022-22976
Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor 31, the encoder does not perform any salt rounds, due to an integer overflow error. The default...
CVE-2022-22976: Integer Overflow or Wraparound
Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor 31, the encoder does not perform any salt rounds, due to an integer overflow error. The default...
CVE-2022-22976
A flaw was found in Spring Framework. The encoder does not perform any salt rounds when using the BCrypt class with the maximum work factor 31 due to an integer overflow error...
CVE-2022-22976: BCrypt skips salt rounds for work factor of 31
Spring Security 5.7.0, 5.6.4, 5.5.7 were released to fix CVE-2022-22976: BCrypt skips salt rounds for work factor of 31. Please update as soon as possible...
DoS due to unrestricted hashing
Description The application accepts strings of any size as passwords and processes hashes the string to check in the database if the user exists, for example upon login. Being the hashing process resource-intensive, it can be possible to cause Denial of Service without particular processing power...
node_exporter -- bypass security with cache poisoning
Prometheus team reports: Prometheus and its exporters can be secured by a web.yml file that specifies usernames and hashed passwords for basic authentication. Passwords are hashed with bcrypt, which means that even if you have access to the hash, it is very hard to find the original password back...
Access Restriction Bypass
py-bcrypt is vulnerable to Improper Access Control. The vulnerability exists due to improper handling of concurrent memory access in py-bcrypt module which triggers password hash overwriting, allowing an attacker to bypass security restrictions...
Improper Restriction of Excessive Authentication Attempts in py-bcrypt
The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten...
GHSA-R838-Q6JP-58XX Improper Restriction of Excessive Authentication Attempts in py-bcrypt
The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten...
FreeBSD : bouncycastle15 -- bcrypt password checking vulnerability (70e71a24-0151-11ec-bf0c-080027eedc6a)
The Bouncy Castle team reports : The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...
PHP Site's User Database Was Hacked In Recent Source Code Backdoor Attack
The maintainers of the PHP programming language have issued an update regarding the security incident that came to light late last month, stating that the actors may have gotten hold of a user database containing their passwords to make unauthorized changes to the repository. "We no longer believ...
SharpDPAPI - A C# Port Of Some Mimikatz DPAPI Functionality
SharpDPAPI is a C port of some DPAPI functionality from @gentilkiwi's Mimikatz project. I did not come up with this logic, it is simply a port from Mimikatz in order to better understand the process and operationalize it to fit our workflow. The SharpChrome subproject is an adaptation of work fro...
bouncycastle15 -- bcrypt password checking vulnerability
The Bouncy Castle team reports: The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different...
acme-dns-rust (>=1.0.0, <=1.0.6), aerospike (>=0.4.0, <=1.3.0) +93 more potentially affected by unknown CVE via block-cipher (>=0.7.1, <=0.8.0)
block-cipher CARGO version =0.7.1, =1.0.0, =0.4.0, =0.4.0, =0.7.0, =0.1.0, =0.1.1, =0.1.1, =0.8.1, =0.2.0, =0.5.0, =0.2.0, =0.7.0, =0.8.0 - chacha20 0.5.0 - chacha20poly1305 0.6.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2020-0057...
MonoCMS Blog Information Disclosure Vulnerability
Mono is a free and open source project hosted by Xamarin previously Novell, first Ximian. A security vulnerability exists in version 1.0 of MonoCMS Blog, which stems from storing a hard-coded administrative hash in the log.xml file in the source file of MonoCMS Blog, with hash type bcrypt and has...
