Malicious code in grand-whitelisted-hashes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0376424aef04154e0957721651e9e4066a8869bdcd687406f4984bc25c18f4e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-30231

A vulnerability has been identified in SICAM GridEdge Classic All versions V2.6.6. The affected application discloses password hashes of other users upon request. This could allow an authenticated user to retrieve another user's password hash...

Timing Attacks

ezsystems/ezpublish-kernel is vulnerable to timing attacks. The vulnerability exists because the library does not compare hashes in constant time, allowing an attacker to progressively use the timing of the request to identify a valid hash...

CVE-2022-29731

An access control issue in ICT Protege GX/WX 2.08 allows attackers to leak SHA1 password hashes of other users...

CVE-2022-29731

An access control issue in ICT Protege GX/WX 2.08 allows attackers to leak SHA1 password hashes of other users...

CVE-2022-29731

An access control issue in ICT Protege GX/WX 2.08 allows attackers to leak SHA1 password hashes of other users...

CVE-2022-1949

An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows...

Design/Logic Flaw

An access control issue in ICT Protege GX/WX 2.08 allows attackers to leak SHA1 password hashes of other users...

UBUNTU-CVE-2022-1949

An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows...

CVE-2022-29731

An access control issue in ICT Protege GX/WX 2.08 allows attackers to leak SHA1 password hashes of other users...

CVE-2022-29731

CVE-2022-29731 affects ICT Protege GX/WX version 2.08. The issue is an improper access control that allows an authenticated operator to disclose SHA-1 password hashes of other users (client-side hashes). The vulnerability has been documented in ZSL-2022-5700 with a PoC and vendor notifications; p...

Insertion of Sensitive Information into Log File in Elasticsearch

Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emitrequestbody option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch...

GHSA-CQGV-256R-M9R8 Insertion of Sensitive Information into Log File in Elasticsearch

Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emitrequestbody option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch...

Containous Traefik Exposes Password Hashes

types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without sufficient access control which is contrary to the API documentation, allows remote authenticated users to discover password hashes by reading the Basic HTT...

GHSA-R3FQ-CMMW-CPMM Containous Traefik Exposes Password Hashes

types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without sufficient access control which is contrary to the API documentation, allows remote authenticated users to discover password hashes by reading the Basic HTT...

CVE-2019-14666

GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any use...

CVE-2020-16231

The affected Bachmann Electronic M-Base Controllers of version MSYS v1.06.14 and later use weak cryptography to protect device passwords. Affected controllers that are actively supported include MX207, MX213, MX220, MC206, MC212, MC220, and MH230 hardware controllers, and affected end-of-life...

CVE-2020-16231

The affected Bachmann Electronic M-Base Controllers of version MSYS v1.06.14 and later use weak cryptography to protect device passwords. Affected controllers that are actively supported include MX207, MX213, MX220, MC206, MC212, MC220, and MH230 hardware controllers, and affected end-of-life...

CVE-2020-16231 All Bachmann M1 System Processor Modules - Use of Password Hash with Insufficient Computational Effort

The affected Bachmann Electronic M-Base Controllers of version MSYS v1.06.14 and later use weak cryptography to protect device passwords. Affected controllers that are actively supported include MX207, MX213, MX220, MC206, MC212, MC220, and MH230 hardware controllers, and affected end-of-life...

Apache Rave information disclosure vulnerability

The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response...