CVE-2012-2122-Home-Lab

以下是英文版本 CVE-2012-2122 MySQL 认证绕过家庭实验环境 本实验室演示漏洞 CVE-2012-2122 - MySQL 认证绕过 该漏洞由 MySQL 5.5.23 或更低版本在密码比较时出现的错误引起 当攻击者反复多次发送错误密码时，MySQL 可能意外地允许登录 特点 基于 vulhub/mysql:5.5.23 包含自动生成 flag 的 entrypoint.sh 脚本 flag 位于 /tmp/flag.txt 每次 docker restart 后 flag 都会更新 适用于渗透测试 / 红队 / CTF 训练 使用方法 1 构建并运行...

Oracle-mysql-CVE-2012-2122

Mysql 認証バイパス脆弱性 CVE-2012-2122 MariaDB/MySQL に接続する際、入力されたパスワードと期待される正しいパスワードが比較されます。不適切な処理により、memcmp が非ゼロを返した場合でも、MySQL は両方のパスワードが同一であると見なします。つまり、ユーザー名さえ分かれば、繰り返し試行することで SQL データベースに直接ログインできます。 影響を受けるバージョン： MariaDB バージョン 5.1.62、5.2.12、5.3.6、5.5.23 は対象外です。 MySQL バージョン 5.1.63、5.5.24、5.6.6 は対象外です。...

CVE-2026-42393

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

ALPINE-CVE-2026-42393

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

AZL-98310 CVE-2026-42393 affecting package dovecot 2.3.20-1

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

EUVD-2026-67676

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

CVE-2026-42393

CVE-2026-42393 affects the doveadm service in Open-Xchange's Dovecot implementation. The password and API key comparison is not fully timing-safe, allowing a network-adjacent attacker who can make repeated requests and accurately measure response times to learn the length of the configured secret...

CVE-2026-42393

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

CVE-2026-42393

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

CVE-2026-42393

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

UBUNTU-CVE-2026-42393

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

PT-2026-83069

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description The comparison process for the doveadm password and API key is not fully timing safe. This allows an attacker on the same network as the doveadm service to determine the length of the configured...

CVE-2026-42393

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

Oracle Linux 10 : pam (ELSA-2026-59379)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-59379 advisory. 1.6.1-9.1 - pamuserdb: fix password comparison timing leak. Resolves: CVE-2026-54411 and RHEL-191704 Tenable has extracted the preceding description block...

pam security update

1.6.1-9.1 - pamuserdb: fix password comparison timing leak. Resolves: CVE-2026-54411 and RHEL-191704...

GHSA-8FXQ-53RX-PH5F Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

Summary userpassword.Compare substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash nonexistent users and SSO-only users and a subsequent login-type check returned an HTTP 40...

Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

Summary userpassword.Compare substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash nonexistent users and SSO-only users and a subsequent login-type check returned an HTTP 40...

pam security update

1.3.1-40.0.1 - pamlimits: fix use after free in pamsmopensession Orabug: 36272695 1.3.1-40 - pamuserdb: fix password comparison timing leak. Resolves: CVE-2026-54411 and RHEL-191699...

BIT-APR-UTIL-2025-49506 Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...

AZL-94628 CVE-2025-49506 affecting package apr-util for versions less than 1.6.3-3

APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...