PT-2026-96205

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7 Description The software fails to redact password hashes in the '/user/info' endpoint. This allows authenticated users to retrieve unsalted MD5 password digests for any user by supplying specific user IDs. These...

CVE-2026-82723

AshAuthentication (the Elixir authentication library by team-alembic) stores full actor records—including the hashed_password attribute—into audit log entries via the audit_log add-on's build_extra_data/4 function. The :actor value from the action callback context is deposited verbatim, bypassing...

CVE-2026-82723: Insertion of Sensitive Information into Log File

Insertion of Sensitive Information into Log File vulnerability in team-alembic AshAuthentication allows disclosure of user password digests to readers of the audit store. The auditlog add-on builds each entry's extradata in AshAuthentication.AddOn.AuditLog.Auditor.buildextradata/4, which takes...

PT-2026-94295

Name of the Vulnerable Software and Affected Versions ash authentication versions 4.12.0 through 4.14.x ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.1 Description AshAuthentication allows the disclosure of user password digests to readers of the audit store. The audit log add-on builds...

SUSE CVE-2021-45083

An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobble...

PT-2022-12304

Name of the Vulnerable Software and Affected Versions Cobbler versions prior to 3.3.1 Description An issue was discovered where files in /etc/cobbler are world readable, exposing sensitive information to local users with non-privileged access. The users.digest file contains the sha2-512 digest of...