meesho-android-improper-encryption-cve-2026-5682

🔐 概念验证：Meesho 安卓应用 – 不安全的加密实现（AES-CBC 无完整性保护 + 弱密钥派生） 作者： Soyam Arya（又名 honestcorrupt） 发现日期： 2026 年 3 月 受影响应用： Meesho 安卓应用（com.meesho.supply） 状态： 验证中 类别： 加密不足 / 数据完整性失败 🎯 摘要 本报告记录了 Meesho 安卓应用中的一个加密漏洞，该应用使用 AES/CBC/PKCS5Padding 加密敏感数据，但未提供完整性保护，且加密密钥通过不安全的 MD5 哈希算法 派生。 该应用以如下格式构造加密载荷：...

hassh

"HASSH" - SSHクライアントおよびサーバーのプロファイリング手法。 注記：このCorelightリポジトリは、元のリポジトリがメンテナンスされていないSalesforceからの要請に応じて、積極的にメンテナンスできるように作成されました。 "HASSH" は、特定のSSHクライアントおよびサーバー実装を識別するために使用できるネットワークフィンガープリンティング標準です。フィンガープリントは、MD5フィンガープリントの形式で簡単に保存、検索、共有できます。 HASSHでできること：...

Security update for wget

This update for wget fixes the following issue: CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE bsc1276962. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the comman...

Security update for wget

This update for wget fixes the following issue: CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE bsc1276962. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the comman...

Security update for wget

This update for wget fixes the following issue: CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE bsc1276962. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the comman...

EUVD-2026-72163

Authen::SASL::Perl::DIGESTMD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in serverstep. serverstart generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the nonce the client returns. serverstep...

PT-2026-86564

Name of the Vulnerable Software and Affected Versions Authen::SASL::Perl::DIGEST MD5 versions prior to 2.2100 Description An issue exists where the software accepts replayed authentication responses due to an unverified nonce in the server step function. While server start generates a fresh nonce...

CVE-2026-86187

WWBN AVideo generates passwords for external-login accounts using rand instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover plaintext passwords in minutes through offline brute-force attacks due to unsalted MD5-based hashing...

EUVD-2026-72008

WWBN AVideo generates passwords for external-login accounts using rand instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover plaintext passwords in minutes through offline brute-force attacks due to unsalted MD5-based hashing...

CVE-2026-86187

WWBN AVideo is vulnerable to password recovery via weak PRNG in its external-login account creation process. Passwords are generated using rand() rather than a cryptographically secure generator, yielding only 31-bit integers that are further weakened by unsalted MD5 hashing. An attacker with acc...

CVE-2026-86187 WWBN AVideo Weak PRNG Password Generation via External Login

WWBN AVideo generates passwords for external-login accounts using rand instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover plaintext passwords in minutes through offline brute-force attacks due to unsalted MD5-based hashing...

CVE-2026-86187 WWBN AVideo Weak PRNG Password Generation via External Login

WWBN AVideo generates passwords for external-login accounts using rand instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover plaintext passwords in minutes through offline brute-force attacks due to unsalted MD5-based hashing...

CVE-2026-80114

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a hard-coded credentials vulnerability in DirectIo64.sys that allows local attackers to perform arbitrary physical memory writes by extracting an 8-byte key embedded ...

CVE-2026-82591

A security vulnerability has been detected in Open Asset Import Library Assimp up to 6.0.2. The impacted element is the function MD5Importer::MakeDataUnique of the file code/AssetLib/MD5/MD5Loader.cpp. The manipulation of the argument iNewIndex leads to heap-based buffer overflow. The attack can...

UBUNTU-CVE-2026-82591

A security vulnerability has been detected in Open Asset Import Library Assimp up to 6.0.2. The impacted element is the function MD5Importer::MakeDataUnique of the file code/AssetLib/MD5/MD5Loader.cpp. The manipulation of the argument iNewIndex leads to heap-based buffer overflow. The attack can...

CVE-2026-80211

FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5$POST'password' to adduser and updateuserpassword, admin/changecurrentuserpassword.php does the same when a user changes their own password, the forgotten-password path in...

CVE-2026-80211

FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5$POST'password' to adduser and updateuserpassword, admin/changecurrentuserpassword.php does the same when a user changes their own password, the forgotten-password path in...

CVE-2026-80211

FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests . The admin/users.php, admin/change_current_user_password.php, and includes/current_user.inc files all pass md5($password) without any per-password salt or adaptive hash (no password_hash()/password_verify()...

CVE-2026-80211 FrontAccounting through 2.4.20 Use of Unsalted MD5 for Password Storage

FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5$POST'password' to adduser and updateuserpassword, admin/changecurrentuserpassword.php does the same when a user changes their own password, the forgotten-password path in...

EUVD-2026-67145

FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5$POST'password' to adduser and updateuserpassword, admin/changecurrentuserpassword.php does the same when a user changes their own password, the forgotten-password path in...