There is a NULL pointer dereference in hash() in yasm version 1.3.0

...

Linux Distros Unpatched Vulnerability : CVE-2024-45691

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Moodle. When restricting access to a lesson activity with a password, certain passwords could be bypassed or less secure due to a loose...

The __hash_open function in hash.c:229 in Mozilla Network Security Services (NSS) allows context-dependent attackers to cause a denial of service (floating point exception and crash) via a crafted cert8.db file.

...

vLLM using built-in hash() from Python 3.12 leads to predictable hash collisions in vLLM prefix cache

...

Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.

...

CVE-2025-52494

creationtimestamp| type| source ---|---|--- 2025-09-03 18:25:37+00:00| seen| Telegram/ZR7laBj-HKIBV0kl3AEDBBs5fnHcuUcIhEHXjYh-o9wNYY...

CVE-2025-9824 User Enumeration via Response Timing

ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks. PatchesThis vulnerability has been patched, implementing a timing-safe form login...

CVE-2025-9824 User Enumeration via Response Timing

ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks. PatchesThis vulnerability has been patched, implementing a timing-safe form login...

CVE-2025-9824

The CVE-2025-9824 issue stems from different login response times for existing versus non-existent users in Mautic, enabling user enumeration and potential brute-force attempts. Technical details describe that valid usernames trigger password hashing while invalid ones do not; the fix adds a Timi...

PT-2025-35774

Name of the Vulnerable Software and Affected Versions: versions prior to the patched version Description: The attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute for...

SourceCodester Android Corona Virus Tracker App for India – Security Vulnerabilities

SourceCodester Android Corona Virus Tracker App for India is a new virus tracking app from SourceCodester open source. A security vulnerability exists in the SourceCodester Android Corona Virus Tracker App for India version 1.0, which stems from the use of MD5 for digest authentication, which cou...

CVE-2025-56608

The SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in OkHttpClientWrapper.java. The handleDigest function employs MessageDigest.getInstance"MD5" to hash credentials. MD5 is a broken cryptographic algorithm known to allow hash collisions...

PT-2025-35777

Name of the Vulnerable Software and Affected Versions: Corona Virus Tracker App India version 1.0 Description: The Android application uses MD5 for digest authentication. The handleDigest function utilizes MessageDigest.getInstance"MD5" to hash credentials. MD5 is a cryptographic algorithm...

Flashrom to Hexedit to Root: DEF CON 33 IoT Village Exercise

Each year at DEF CON’s IoT Village, Rapid7 researchers showcase their skills in penetration testing, hardware hacking, and more. At DEF CON 33, Principal Security Researcher, IoT, Deral Heiland took attendees step by step through a brand-new, hands-on exercise that pushed past last year’s lessons...

CVE-2025-52543

E3 Site Supervisor Control firmware version 2.31F01 application services MGW and RCI uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash...

CVE-2025-52543

E3 Site Supervisor Control firmware version 2.31F01 application services MGW and RCI uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash...

CVE-2025-52543 Login to the application services using only the password hash

E3 Site Supervisor Control firmware version 2.31F01 application services MGW and RCI uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash...

CVE-2025-52543

CVE-2025-52543 affects E3 Site Supervisor Control (firmware versions prior to 2.31F01) and its application services MGW/RCI. The root cause is use of client-side hashing for authentication, enabling an attacker to authenticate by obtaining only a password hash. Public references consistently desc...

CVE-2025-52543 Login to the application services using only the password hash

E3 Site Supervisor Control firmware version 2.31F01 application services MGW and RCI uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash...

kernel: crypto: algif_hash - fix double free in hash_accept

In the Linux kernel, the following vulnerability has been resolved: crypto: algifhash - fix double free in hashaccept If accept2 is called on socket type algifhash with MSGMORE flag set and cryptoahashimport fails, sk2 is freed. However, it is also freed in afalgrelease, leading to...