CVE-2022-40621

Because the WAVLINK Quantum D4G WN531G3 running firmware version M31G3.V5030.200325 and earlier communicates over HTTP and not HTTPS, and because the hashing mechanism does not rely on a server-supplied key, it is possible for an attacker with sufficient network access to capture the hashed...

Design/Logic Flaw

Because the WAVLINK Quantum D4G WN531G3 running firmware version M31G3.V5030.200325 and earlier communicates over HTTP and not HTTPS, and because the hashing mechanism does not rely on a server-supplied key, it is possible for an attacker with sufficient network access to capture the hashed...

CVE-2022-40621

The CVE-2022-40621 entry concerns WAVLINK Quantum D4G (WN531G3). Affected firmware versions M31G3.V5030.200325 and earlier communicate over HTTP (not HTTPS), and the device’s authentication hashing does not rely on a server-supplied key. This enables an attacker with sufficient network access to ...

CVE-2022-40621 WAVLINK Quantum D4G (WN531G3) Pass-The-Hash

Because the WAVLINK Quantum D4G WN531G3 running firmware version M31G3.V5030.200325 and earlier communicates over HTTP and not HTTPS, and because the hashing mechanism does not rely on a server-supplied key, it is possible for an attacker with sufficient network access to capture the hashed...

Description of the security update for Visio 2013: September 13, 2022 (KB5002017)

Description of the security update for Visio 2013: September 13, 2022 KB5002017 Summary This security update resolves a Microsoft Office Visio remote code execution vulnerability. To learn more about the vulnerability, see Microsoft Common Vulnerabilities and Exposures CVE-2022-38010. Note: To...

Description of the security update for Office 2016: September 13, 2022 (KB5002178)

None None...

CVE-2021-23841: Null pointer deref in X509_issuer_and_serial_hash()

Security Advisory ID : BSA-2022-1303 Component : OpenSSL Revision : 1.0 The OpenSSL public API function X509issuerandserialhash attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors...

PT-2022-25422 · Wavlink · Wavlink Quantum D4G

Name of the Vulnerable Software and Affected Versions: WAVLINK Quantum D4G WN531G3 versions M31G3.V5030.200325 and earlier Description: The issue arises because the WAVLINK Quantum D4G WN531G3 communicates over HTTP instead of HTTPS, and its hashing mechanism does not rely on a server-supplied ke...

WAVLINK WN531G3 安全漏洞

The WAVLINK WN531G3 is a wireless router from China-based RuiYin Technology WAVLINK. A security vulnerability exists in the WAVLINK WN531G3 firmware version M31G3.V5030.200325 and earlier versions, which originates from communication over HTTP instead of HTTPS, and because the hashing mechanism...

CVE-2022-40621: Authentication Bypass by Capture-replay

Because the WAVLINK Quantum D4G WN531G3 running firmware version M31G3.V5030.200325 and earlier communicates over HTTP and not HTTPS, and because the hashing mechanism does not rely on a server-supplied key, it is possible for an attacker with sufficient network access to capture the hashed...

The vulnerability of the libbfd library’s bfd_hash_lookup function in the GNU Binutils development environment allows a attacker to cause a service failure.

The vulnerability of the libbfd library’s bfdhashlookup function in the GNU Binutils development environment is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure...

User Enumeration via Response Timing

Description There is a significant timing difference in the login functionality for valid and invalid usernames. Proof of Concept Steps to reproduce: 1. Attempt a Login with a valid user and an invalid user and observe the difference in the response time Here is a small test script alternatively ...

PT-2022-37273 · Git +1 · Hunspell

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash reported by OSS-Fuzz, with a Segv on an unknown address. The crash occurs in the HashMgr class, specifically in the add...

CVE-2022-37163

Bminusl IHateToBudget v1.5.7 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Additionally, user passwords are hashed without a salt or pepper making it much easier for tools like hashcat to crack the hashes...

CVE-2022-37163

Bminusl IHateToBudget v1.5.7 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Additionally, user passwords are hashed without a salt or pepper making it much easier for tools like hashcat to crack the hashes...

Design/Logic Flaw

Inoda OnTrack v3.4 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Additionally, user passwords are hashed without a salt or pepper making it much easier for tools like hashcat to crack the hashes...

CVE-2022-37164

Inoda OnTrack v3.4 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Additionally, user passwords are hashed without a salt or pepper making it much easier for tools like hashcat to crack the hashes...

CVE-2022-37163

CVE-2022-37163 affects Bminusl IHateToBudget v1.5.7. The root cause is a weak password policy and password hashes stored without a salt or pepper, making brute-force access feasible and hash cracking easier with tools like hashcat. Impact is unauthorized access to the application. Publicly docume...

Exploit for Use of a One-Way Hash with a Predictable Salt in Redux Gutenberg_Template_Library_\&_Redux_Framework

CVE-2021-38314 Python Exploit Detail...

Security Bulletin: Multiple Denial of Service vulnerabilities with Expat may affect IBM HTTP Server

Summary There are several vulnerabilities that may affect IBM HTTP Server that is used by WebSphere Application Server. Vulnerability Details CVEID: CVE-2012-0876 DESCRIPTION: Expat is vulnerable to a denial of service, caused by insufficient randomization of hash data structures. By sending...