13557 matches found
GHSA-CR49-FX2V-9P57 Symfony Denial of Service Via Long Password Hashing
The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service CPU consumption via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a...
JRuby denial of service via Hash Collision
JRuby computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service CPU consumption via crafted input to an application that maintains a hash table, as demonstrated by a universal...
GHSA-FMMQ-J7PQ-F85C JRuby denial of service via Hash Collision
JRuby computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service CPU consumption via crafted input to an application that maintains a hash table, as demonstrated by a universal...
GHSA-52J9-V3JC-9XGC Tryton allows users to read the hashed password
Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to discover user password hashes via unspecified vectors...
phpMyAdmin XSS Vulnerability
An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10. This issue is resolved by using a copy of a hash to avoid a race condition. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to 4.0.10.18 are...
CVE-2022-30126
creationtimestamp| type| source ---|---|--- 2022-05-16 20:40:16+00:00| seen| https://t.me/cibsecurity/42763 2022-05-31 18:18:50+00:00| seen| https://t.me/cibsecurity/43564 2022-06-28 02:35:07+00:00| seen| https://t.me/cibsecurity/45253...
PT-2022-3368
Name of the Vulnerable Software and Affected Versions Dominion Voting Systems ImageCast X affected versions not specified Description The issue concerns the on-screen application hash display feature, audit log export, and application export functionality of Dominion Voting Systems ImageCast X,...
Improper Input Validation in Apache Tomcat
Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service CPU consumption by sending many crafted parameters...
Exposure of Sensitive Information to an Unauthorized Actor in Apache Jasypt
jasypt before 1.9.2 allows a timing attack against the password hash comparison...
GHSA-R5C2-RXH2-F5H2 Exposure of Sensitive Information to an Unauthorized Actor in Apache Jasypt
jasypt before 1.9.2 allows a timing attack against the password hash comparison...
i18n Vulnerable to Denial of Service Attack
Hashslice in lib/i18n/coreext/hash.rb in the i18n gem before 0.8.0 for Ruby allows remote attackers to cause a denial of service application crash via a call in a situation where :somekey is present in keepkeys but not present in the hash...
GHSA-34HF-G744-JW64 i18n Vulnerable to Denial of Service Attack
Hashslice in lib/i18n/coreext/hash.rb in the i18n gem before 0.8.0 for Ruby allows remote attackers to cause a denial of service application crash via a call in a situation where :somekey is present in keepkeys but not present in the hash...
Improper Input Validation in Jetty
Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service CPU consumption by sending many crafted parameters...
GHSA-QXP4-27VX-XMM3 Improper Input Validation in Jetty
Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service CPU consumption by sending many crafted parameters...
GHSA-579V-MP3V-RRW5 jQuery vulnerable to Cross-Site Scripting (XSS)
Cross-site scripting XSS vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag...
Weak Password Recovery Mechanism for Forgotten Password
Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten Password via an empty confirmhash value to verify.php. Remediation Upgrade mantisbt/mantisbt to version 1.3.10, 2.2.4, 2.3.1 or higher. References...
GHSA-V3H8-RW48-H4GR Apache Geronimo Hash Collisions Cause DoS
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service CPU consumption by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461...
Apache Geronimo Hash Collisions Cause DoS
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service CPU consumption by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461...
Cisco Firepower Threat Defense Software < 6.6.1 sftunnel MitM (cisco-sa-ftdfmc-sft-mitm-tc8AzFs2)
A vulnerability in the sftunnel functionality of Cisco Firepower Management Center FMC Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to obtain the device registration hash. The vulnerability is due to insufficient sftunnel negotiation...
