1943 matches found
CVE-2024-22892
OpenSlides 4.0.15 was discovered to be using a weak hashing algorithm to store passwords...
CVE-2024-22892
OpenSlides 4.0.15 was discovered to be using a weak hashing algorithm to store passwords...
PT-2024-19600 · Unknown · Openslides
Name of the Vulnerable Software and Affected Versions: OpenSlides version 4.0.15 Description: The issue is related to the use of a weak hashing algorithm for storing passwords. Recommendations: For OpenSlides version 4.0.15, update to a version that uses a secure password hashing algorithm to...
CVE-2024-22892
OpenSlides 4.0.15 is affected by a vulnerability due to using a weak hashing algorithm for password storage. The CVE-2024-22892 entry, with a CVSS v3.1 base score of 7.5 (HIGH), indicates network attack potential with low complexity and no privileges required. The issue targets the password hashi...
OpenSlides 安全漏洞
OpenSlides is a free, web-based presentation and assembly system from OpenSlides Open Source. It is used to manage and project agendas, motions and elections for assemblies. A security vulnerability exists in OpenSlides version 4.0.15 that stems from the use of a weak hash algorithm to store...
Apache Answer 安全漏洞
Apache Answer is a community platform of the Apache USA Foundation. A security vulnerability exists in Apache Answer version 1.3.5 and prior versions, which stems from the fact that accessing Gravatar using the MD5 value of a user's email is insecure and could lead to the disclosure of the user's...
Loki: a new private agent for the popular Mythic framework
In July 2024, we discovered the previously unknown Loki backdoor, which was used in a series of targeted attacks. By analyzing the malicious file and open sources, we determined that Loki is a private version of an agent for the open-source Mythic framework. One of the agent's decrypted strings O...
PT-2024-9166 · Nextcloud +2 · Nextcloud Server +2
Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 28.0.10 Nextcloud Server versions prior to 29.0.7 Nextcloud Server versions prior to 30.0.0 Description: The issue is related to the use of a reversible one-way hash function in Nextcloud Server, which...
DRUPAL-CONTRIB-2024-033
This module enables you to cache pages for logged in users at the Varnish level. The Varnish bin names may be guessable when no hashing noise configuration is set on the module configuration page, which would ultimately allow any user to view cached pages that were intended for other roles when...
DiCal-RED 4009 Weak Hashing
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2024-037 Product: DiCal-RED Manufacturer: Swissphone Wireless AG Affected Versions: Unknown Tested Versions: 4009 Vulnerability Type: Use of Password Hash With Insufficient Computational Effort CWE-916 Risk Level: Medium Solution...
In the Linux kernel before 5.1.7 a device can be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g. UDP and ICMP). When such traffic is sent to multiple destination IP addresses it is possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). An attack may be conducted by hosting a crafted web page that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses.
...
CISA Warns of Hackers Exploiting Legacy Cisco Smart Install Feature
The U.S. Cybersecurity and Infrastructure Security Agency CISA has disclosed that threat actors are abusing the legacy Cisco Smart Install SMI feature with the aim of accessing sensitive data. The agency said it has seen adversaries "acquire system configuration files by leveraging available...
Best Practices for Cisco Device Configuration
In recent incidents, CISA has seen malicious cyber actors acquire system configuration files by leveraging available protocols or software on devices, such as abusing the legacy Cisco Smart Install feature. CISA recommends organizations disable Smart Install and review NSA’s Smart Install Protoco...
GO-2024-3029 Navidrome uses MD5 hashing algorithm in github.com/navidrome/navidrome
Navidrome uses MD5 hashing algorithm in github.com/navidrome/navidrome...
ROS-20240806-13
Vulnerability in the implementation of the bcrypt hashing algorithm of the Prometheus system file export library Exporter Toolkit is related to authentication bypass during web.yml file processing. Exploitation of the vulnerability could allow an attacker to bypass security restrictions and gain...
Account Manipulation
github.com/navidrome/navidrome is vulnerable to Account Manipulation. The vulnerability is due to the insecure usage of the MD5 hashing algorithm to generate Gravatar URLs, which allows attackers to change another user's information under a controlled email address...
GHSA-HRMX-8JJV-G758 Navidrome uses MD5 hashing algorithm
Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account information...
Navidrome uses MD5 hashing algorithm
Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account information...
