PT-2021-2875

Name of the Vulnerable Software and Affected Versions NETGEAR JGS516PE/GS116Ev2 version 2.6.0.43 Description The hashing algorithm used for NSDP password authentication is insecure, allowing attackers with network capture access to generate collisions and infer parts of the original password, or...

GHSA-H362-M8F2-5X7C Password Hashing: Do not use MD5

Impact User passwords are stored in the database using the rather outdated and cryptographically insecure MD5 hash algorithm. Furthermore, the hashes are salted using the username instead of a random salt, causing hashes for users with the same username and password to collide which is problemati...

Insufficient Entropy

parsel is susceptible to suffering from insufficient entropy. It uses an insecure key derivation function SHA256 hashing with keys of arbitrary lengths, resulting in keys having insufficient entropy with inappropriate key stretching...

Code injection

Cloud Foundry Bits Service Release, versions prior to 2.14.0, uses an insecure hashing algorithm to sign URLs. A remote malicious user may obtain a signed URL and extract the signing key, allowing them complete read and write access to the the Bits Service storage...

CVE-2018-15796

Cloud Foundry Bits Service Release, versions prior to 2.14.0, uses an insecure hashing algorithm to sign URLs. A remote malicious user may obtain a signed URL and extract the signing key, allowing them complete read and write access to the the Bits Service storage...

CVE-2018-15796 Signing Key Extraction in Bits Service Release

Cloud Foundry Bits Service Release, versions prior to 2.14.0, uses an insecure hashing algorithm to sign URLs. A remote malicious user may obtain a signed URL and extract the signing key, allowing them complete read and write access to the the Bits Service storage...

PT-2018-13212

Name of the Vulnerable Software and Affected Versions Cloud Foundry Bits Service versions prior to 2.14.0 Description The issue concerns the use of an insecure hashing algorithm to sign URLs, which could allow a remote malicious user to obtain a signed URL, extract the signing key, and gain...

Default credentials

DISPUTED An issue was discovered in SMA Solar Technology products. The inverters make use of a weak hashing algorithm to encrypt the password for REGISTER requests. This hashing algorithm can be cracked relatively easily. An attacker will likely be able to crack the password using offline cracker...

Insecure Hashing

github.com/google/keytransparency is vulnerable to insecure hashing. The library does not hash the unique identifier. This unique idenitifer is used to verify the randomness of the values produced. This means that its easier for an attacker to forge a valid hash...

Alerton Webtalk 2.5 / 3.3 Hash Disclosure / CSRF / Command Injection

Security Issues in Alerton Webtalk ================================== Introduction ------------ Vulnerabilities were identified in the Alerton Webtalk Software supplied by Alerton. This software is used for the management of building automation systems. These were discovered during a black box...

Medium: gnutls

Issue Overview: It was found that GnuTLS did not check activation and expiration dates of CA certificates. This could cause an application using GnuTLS to incorrectly accept a certificate as valid when its issuing CA is already expired. CVE-2014-8155 It was found that GnuTLS did not verify whethe...

PT-2008-2977

Name of the Vulnerable Software and Affected Versions Plone CMS versions 3.x through 3.1.x Description The issue allows remote attackers to gain permanent access to an account by sniffing the network, due to the use of invariant data when calculating an HMAC-SHA1 value for an authentication cooki...