CVE-2024-55891 Information Disclosure via Exception Handling/Logger in TYPO3

TYPO3 is a free and open source Content Management Framework. It has been discovered that the install tool password has been logged as plaintext in case the password hashing mechanism used for the password was incorrect. Users are advised to update to TYPO3 versions 13.4.3 ELTS which fixes the...

GHSA-38X7-CC6W-J27Q TYPO3 Information Disclosure via Exception Handling/Logger

Problem It has been discovered that the install tool password has been logged as plaintext in case the password hashing mechanism used for the password was incorrect. Solution Update to TYPO3 versions 13.4.3 LTS that fixes the problem described. Credits Thanks to TYPO3 core & security team member...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow due to improper handling of attacker-controlled checksum lengths s2length in the code. An anonymous client can leverage this overflow, together with the stack memory exposure described in CVE-2024-12085 to...

PT-2025-3142 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 13.4.3 ELTS Description: A problem has been discovered where the install tool password is logged as plaintext if the password hashing mechanism used for the password was incorrect. There are no known workarounds for th...

TYPO3 日志信息泄露漏洞

TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Association. A log information disclosure vulnerability exists in TYPO3 that stems from an incorrect password hashing mechanism used for passwords, where the installation tool password will be recorde...

CVE-2024-5743

An attacker could exploit the 'Use of Password Hash With Insufficient Computational Effort' vulnerability in EveHome Eve Play to execute arbitrary code. This issue affects Eve Play: through 1.1.42...

CVE-2024-5743

CVE-2024-5743 affects Eve Play (EveHome) up to version 1.1.42. Root cause: use of a password hash with insufficient computational effort, enabling an attacker to execute arbitrary code. Impact is high across confidentiality, integrity, and availability per the CVE metrics. Remediation: upgrade to...

CVE-2025-21604 LangChain4j-AIDeepin Using MD5 to Hash files may cause file upload conflicts

LangChain4j-AIDeepin is a Retrieval enhancement generation RAG project. Prior to 3.5.0, LangChain4j-AIDeepin uses MD5 to hash files, which may cause file upload conflicts. This issue is fixed in 3.5.0...

CVE-2025-21604

CVE-2025-21604 affects LangChain4j-AIDeepin before version 3.5.0. The root cause is the use of MD5 to hash files, which may cause file upload conflicts. The issue is fixed in 3.5.0. Remediation: upgrade to 3.5.0 (or later). Exploitation details are not provided in the available documents.

CVE-2025-21604 LangChain4j-AIDeepin Using MD5 to Hash files may cause file upload conflicts

LangChain4j-AIDeepin is a Retrieval enhancement generation RAG project. Prior to 3.5.0, LangChain4j-AIDeepin uses MD5 to hash files, which may cause file upload conflicts. This issue is fixed in 3.5.0...

CVE-2025-21604 LangChain4j-AIDeepin Using MD5 to Hash files may cause file upload conflicts

LangChain4j-AIDeepin is a Retrieval enhancement generation RAG project. Prior to 3.5.0, LangChain4j-AIDeepin uses MD5 to hash files, which may cause file upload conflicts. This issue is fixed in 3.5.0...

PT-2025-4294 · Unknown · Langchain4J-Aideepin

Name of the Vulnerable Software and Affected Versions: LangChain4j-AIDeepin versions prior to 3.5.0 Description: LangChain4j-AIDeepin is a Retrieval enhancement generation RAG project. Prior to version 3.5.0, it used MD5 to hash files, which may cause file upload conflicts. Recommendations: For...

LangChain4j-AIDeepin 安全漏洞

LangChain4j-AIDeepin is an AI-based work efficiency improvement tool by moyangzhan's personal developer. It can be used to assist enterprises/teams in technical research and development, product design, personnel/financial/IT information consulting, system/commodity consulting, customer service...

CVE-2024-56516

free-one-api allows users to access large language model reverse engineering libraries through the standard OpenAI API format. In versions up to and including 1.0.1, MD5 is used to hash passwords before sending them to the backend. MD5 is a cryptographically broken hashing algorithm and is no...

CVE-2024-56516 free-one-api uses md5 for password storage

free-one-api allows users to access large language model reverse engineering libraries through the standard OpenAI API format. In versions up to and including 1.0.1, MD5 is used to hash passwords before sending them to the backend. MD5 is a cryptographically broken hashing algorithm and is no...

CVE-2024-56516

CVE-2024-56516 affects free-one-api up to version 1.0.1, where MD5 is used to hash passwords before sending to the backend. This hashing approach is cryptographically broken and vulnerable to collision attacks, exposing potential credential compromise. The available connected documents specify th...

PT-2024-36826 · Unknown · Free-One-Api

Name of the Vulnerable Software and Affected Versions: free-one-api versions up to and including 1.0.1 Description: The issue concerns the use of MD5, a cryptographically broken hashing algorithm, to hash passwords before sending them to the backend. This makes it vulnerable to collision attacks...

RLSA-2024:10379 Important: pam security update

Pluggable Authentication Modules PAM provide a system to set up authentication policies without the need to recompile programs to handle authentication. Security Fixes: pam: libpam: Libpam vulnerable to read hashed password CVE-2024-10041 pam: Improper Hostname Interpretation in pamaccess Leads t...

Use Of A Broken Or Risky Cryptographic Algorithm

github.com/beego/beego is vulnerable to Use of a Broken or Risky Cryptographic Algorithm. The vulnerability is due to the use of MD5 as a hashing algorithm, which allows two different inputs to produce the same hash value...

PT-2024-38521 · Percona +1 · Percona-Toolkit +1

Name of the Vulnerable Software and Affected Versions: percona-toolkit version 3.6.0 Description: The issue affects percona-toolkit, allowing encryption brute forcing due to the use of a password hash with insufficient computational effort. This enables an attacker to potentially crack passwords...