13377 matches found
ksmbd: fix null pointer dereference in alloc_preauth_hash()
...
Null pointer deref in X509_issuer_and_serial_hash()
...
There is a NULL pointer dereference in hash() in yasm version 1.3.0
...
Linux Distros Unpatched Vulnerability : CVE-2024-45691
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Moodle. When restricting access to a lesson activity with a password, certain passwords could be bypassed or less secure due to a loose...
The __hash_open function in hash.c:229 in Mozilla Network Security Services (NSS) allows context-dependent attackers to cause a denial of service (floating point exception and crash) via a crafted cert8.db file.
...
vLLM using built-in hash() from Python 3.12 leads to predictable hash collisions in vLLM prefix cache
...
Missing type checks leading to hash rewind and passing on crafted data
...
Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.
...
CVE-2025-52494
creationtimestamp| type| source ---|---|--- 2025-09-03 18:25:37+00:00| seen| Telegram/ZR7laBj-HKIBV0kl3AEDBBs5fnHcuUcIhEHXjYh-o9wNYY...
CVE-2025-9824 User Enumeration via Response Timing
ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks. PatchesThis vulnerability has been patched, implementing a timing-safe form login...
CVE-2025-9824 User Enumeration via Response Timing
ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks. PatchesThis vulnerability has been patched, implementing a timing-safe form login...
CVE-2025-9824
The CVE-2025-9824 issue stems from different login response times for existing versus non-existent users in Mautic, enabling user enumeration and potential brute-force attempts. Technical details describe that valid usernames trigger password hashing while invalid ones do not; the fix adds a Timi...
PT-2025-35774
Name of the Vulnerable Software and Affected Versions: versions prior to the patched version Description: The attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute for...
SourceCodester Android Corona Virus Tracker App for India 安全漏洞
SourceCodester Android Corona Virus Tracker App for India is a new virus tracking app from SourceCodester open source. A security vulnerability exists in the SourceCodester Android Corona Virus Tracker App for India version 1.0, which stems from the use of MD5 for digest authentication, which cou...
CVE-2025-56608
The SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in OkHttpClientWrapper.java. The handleDigest function employs MessageDigest.getInstance"MD5" to hash credentials. MD5 is a broken cryptographic algorithm known to allow hash collisions...
PT-2025-35777
Name of the Vulnerable Software and Affected Versions: Corona Virus Tracker App India version 1.0 Description: The Android application uses MD5 for digest authentication. The handleDigest function utilizes MessageDigest.getInstance"MD5" to hash credentials. MD5 is a cryptographic algorithm...
Flashrom to Hexedit to Root: DEF CON 33 IoT Village Exercise
Each year at DEF CON’s IoT Village, Rapid7 researchers showcase their skills in penetration testing, hardware hacking, and more. At DEF CON 33, Principal Security Researcher, IoT, Deral Heiland took attendees step by step through a brand-new, hands-on exercise that pushed past last year’s lessons...
CVE-2025-52543
E3 Site Supervisor Control firmware version 2.31F01 application services MGW and RCI uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash...
CVE-2025-52543
E3 Site Supervisor Control firmware version 2.31F01 application services MGW and RCI uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash...
CVE-2025-52543 Login to the application services using only the password hash
E3 Site Supervisor Control firmware version 2.31F01 application services MGW and RCI uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash...