13587 matches found
CVE-2021-23400
creationtimestamp| type| source ---|---|--- 2021-06-29 16:28:47+00:00| seen| https://t.me/cibsecurity/25779...
Improper Verification of Cryptographic Signature
Impact The verifyWithMessage method of tEnvoyNaClSigningKey always returns true for any signature of a SHA-512 hash matching the SHA-512 hash of the message even if the signature is invalid. Patches Upgrade to v7.0.3 immediately to resolve this issue. Since the vulnerability lies within the...
Shopware信息泄露漏洞
Shopware is an open source e-commerce platform. An unauthorized access vulnerability exists in Shopware versions prior to 6.4.1.1. An attacker can exploit the vulnerability to gain direct access to private files stored at a cloud storage provider with a known hash url...
SUSE Manager和SUSE Linux Enterprise Server 授权问题漏洞
SUSE Manager and SUSE Linux Enterprise Server are both products of SUSE, Germany.SUSE Manager is a Linux server management system. SUSE Manager is a Linux server management system that provides automated software management, system configuration, and monitoring.SUSE Linux Enterprise Server is an...
GHSA-X3WR-V4WX-5QPC Prototype Pollution
Prototype pollution vulnerability in ‘expand-hash’ versions 0.1.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution...
sealious (>=0.9.4, <=0.12.6) potentially affected by CVE-2021-25948 via expand-hash (1.0.1)
expand-hash NPM version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on expand-hash and may be impacted: - sealious =0.9.4, =0.12.6 Source cves: CVE-2021-25948 Source advisory: OSV:GHSA-X3WR-V4WX-5QPC...
Prototype Pollution
Prototype pollution vulnerability in ‘expand-hash’ versions 0.1.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution...
NamedPipePTH - Pass The Hash To A Named Pipe For Token Impersonation
This project is a PoC code to use Pass-the-Hash for authentication on a local Named Pipe user Impersonation. There also is a blog post for explanation: https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/ It is heavily based on the code from the projects Invoke-SMBExec.ps1 and RoguePotato. I faced...
Arch Linux 资源管理错误漏洞
Arch Linux is an application system from Arch Open Source. A lightweight and flexible Linux® distribution that tries to keep it simple. Arch Linux suffers from a Resource Management Error vulnerability that stems from improper internal resource management in naive's keyless hash function. A remot...
CVE-2020-25752
An issue was discovered on Enphase Envoy R3.x and D4.x devices. There are hardcoded web-panel login passwords for the installer and Enphase accounts. The passwords for these accounts are hardcoded values derived from the MD5 hash of the username and serial number mixed with some static strings. T...
Hardcoded credentials
An issue was discovered on Enphase Envoy R3.x and D4.x devices. There are hardcoded web-panel login passwords for the installer and Enphase accounts. The passwords for these accounts are hardcoded values derived from the MD5 hash of the username and serial number mixed with some static strings. T...
Authentication flaw
An issue was discovered on Enphase Envoy R3.x and D4.x devices. There is a custom PAM module for user authentication that circumvents traditional user authentication. This module uses a password derived from the MD5 hash of the username and serial number. The serial number can be retrieved by an...
CVE-2020-25754
An issue was discovered on Enphase Envoy R3.x and D4.x devices. There is a custom PAM module for user authentication that circumvents traditional user authentication. This module uses a password derived from the MD5 hash of the username and serial number. The serial number can be retrieved by an...
CVE-2020-25754
CVE-2020-25754 affects Enphase Energy Envoy R3.x and D4.x devices. A custom PAM module for user authentication bypasses standard login by deriving a password from the MD5 hash of the username and serial number, with the serial number obtainable by an unauthenticated user at /info.xml. Attempts to...
tEnvoy Data Forgery Issue Vulnerability
tEnvoy is an open source package. Used in node.js and the browser PGP, NaCl and PBKDF2 hash , random , encryption, decryption, signatures, conversion. A vulnerability exists in tEnvoy versions prior to 7.0.3 for data forgery issues. No detailed vulnerability details are provided at this time...
The vulnerability of the client’s execution file airhost.exe allows unauthorized access to protected information when conducting real-time audio and video conferences using Zoom Client for Meetings.
The vulnerability of the airhost.exe executable file used by clients for real-time audio and video conferencing with Zoom Client for Meetings is related to the rigid encoding of registration data when using the SHA-256 hashing algorithm. Exploiting this vulnerability can allow a malicious...
in hascheksolutions/pictshare
BUG ========== sha1 comparision bypass DETAILS ============= There is vulnerable code which can bypass file sha1 hash checking bypass function sha1Exists$sha1 $handle = fopenROOT.DS.'data'.DS.'sha1.csv', "r"; if $handle while $line = fgets$handle !== false ifsubstr$line,0,40==$sha1 return...
CVE-2021-25948
Prototype pollution vulnerability in 'expand-hash' versions 0.1.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution...