CVE-2023-33243

在STARFACE中使用密码哈希登录的概念验证（CVE-2023-33243） 详情请参阅我们的 公告。 在相应的博客 文章中， 漏洞CVE-2023-33243被用作示例，描述我们通常如何分 析认证机制，并指出在渗透测试中遇到的常见误解。 依赖 安装Python库 requests 和 click。 用法 python3 login.py --url URL --login Login ID --pwhash SHA512 Password Hash...

EUVD-2020-2968

Malware in sbrugna...

CVE-2023-33243

RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext password. While storing password hashes instead of cleartext passwords in an application's database generally has become be...

CVE-2020-10515

STARFACE UCC Client before 6.7.1.204 on WIndows allows binary planting to execute code with System rights, aka usd-2020-0006...

CVE-2023-33243

RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext password. While storing password hashes instead of cleartext passwords in an application's database generally has become be...

CVE-2023-33243

RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext password. While storing password hashes instead of cleartext passwords in an application's database generally has become be...

Design/Logic Flaw

RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext password. While storing password hashes instead of cleartext passwords in an application's database generally has become be...

CVE-2023-33243

RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext password. While storing password hashes instead of cleartext passwords in an application's database generally has become be...

CVE-2023-33243

Summary: CVE-2023-33243 affects STARFACE web interface and REST API, where authentication is possible using the SHA-512 password hash instead of the cleartext password. The issue originates from allowing hash-based authentication rather than requiring the actual password, enabling potential accou...

CVE-2023-33243: Use of Password Hash With Insufficient Computational Effort

RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext password. While storing password hashes instead of cleartext passwords in an application's database generally has become be...

STARFACE 安全漏洞

STARFACE is an IP telephony system for digital communications from STARFACE, Inc. A security vulnerability exists in STARFACE version 7.3.0.10 and prior versions that originates from allowing authentication using password hashes...

STARFACE 7.3.0.10 - Authentication with Password Hash Possible

Exploit Title: STARFACE 7.3.0.10 - Authentication with Password Hash Possible Affected Versions: 7.3.0.10 and earlier versions Fixed Versions: - Vulnerability Type: Broken Authentication Security Risk: low Vendor URL: https://www.starface.de Vendor Status: notified Advisory URL:...

PT-2023-24239 · Starface · Starface

Name of the Vulnerable Software and Affected Versions: STARFACE affected versions not specified Description: The web interface and REST API of STARFACE allow authentication using the SHA512 hash of the password instead of the cleartext password. This practice renders the protection of storing...

STARFACE 7.3.0.10 Broken Authentication Exploit

RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext password. While storing password hashes instead of cleartext passwords in an application's database generally has become be...

STARFACE 7.3.0.10 Broken Authentication

Advisory: STARFACE: Authentication with Password Hash Possible RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext password. While storing password hashes instead of cleartext...

STARFACE UCC Client Code Issue Vulnerability

STARFACE UCC Client is a desktop client application for telephone systems from the German company STARFACE. A security vulnerability exists in STARFACE UCC Client versions prior to 6.7.1.204 WIndows. An attacker can exploit the vulnerability to execute code with System privileges...

CVE-2020-10515

STARFACE UCC Client before 6.7.1.204 on WIndows allows binary planting to execute code with System rights, aka usd-2020-0006...

CVE-2020-10515

STARFACE UCC Client before 6.7.1.204 on WIndows allows binary planting to execute code with System rights, aka usd-2020-0006...

Code injection

STARFACE UCC Client before 6.7.1.204 on WIndows allows binary planting to execute code with System rights, aka usd-2020-0006...

CVE-2020-10515

STARFACE UCC Client for Windows is vulnerable before 6.7.1.204 to binary planting that allows code execution with SYSTEM privileges. Affected product: STARFACE UCC Client (Windows). Root cause: binary planting in the installer/loader path as described in CVE-2020-10515. Impact: remote code execut...