Monthly
Authentication bypass in Omnispace Agora Project before 26.10.0 allows anyone holding a user's stored bcrypt password hash to log in as that user - including administrators - by replaying the hash inside the legacy AGORAP_LOG/AGORAP_PASS cookies, never needing the plaintext password. The flaw maps to CWE-836 (use of a password hash instead of the password) and is scored 9.1 in CVSS 4.0 with PR:N, meaning no application login is required to launch the attack; however, the practical gate is a prerequisite credential disclosure, since the attacker must first obtain a valid hash from the Agora credential store (database compromise, exposed backup, or SQL injection), which is why the AC:H assessment applies. The vendor addressed it in release 26.10.0 (vendor-released patch: 26.10.0); no public exploit code has been identified at time of analysis and no EPSS score was supplied.
Authentication bypass in the Setracker2 Android companion app (com.tgelec.setracker) versions 3.1.5 and prior lets an attacker who possesses a user's stored password hash authenticate directly to the backend and gain full account access. Because the backend treats the password hash itself as the secret credential, the hash is password-equivalent and does not need to be cracked back to plaintext. No public exploit identified at time of analysis; the issue was disclosed through CISA/ICS-CERT (advisory VA-26-176-01) and carries a high CVSS 4.0 score of 9.2.
Use of password hash instead of password for authentication vulnerability in SonicWall GMS and Analytics allows Pass-the-Hash attacks.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
CEWE PHOTO SHOW 6.4.3 contains a denial of service vulnerability that allows attackers to crash the application by submitting an excessively long buffer to the password field. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FortiWeb appliances running versions 8.0.0-8.0.1, 7.6.0-7.6.5, 7.4.0-7.4.10, 7.2.0-7.2.11, or 7.0.0-7.0.11 accept a stored password hash as a direct authentication credential, enabling an attacker who has obtained a valid hash out-of-band (e.g., from a leaked configuration or backup) to authenticate as that user via crafted HTTP/HTTPS requests without knowing the cleartext password. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (base 7.5 HIGH) indicates a network-reachable, low-complexity, unauthenticated flaw with high integrity impact; the primary hurdle is acquiring the hash, and the primary exposure is a network-reachable FortiWeb management interface. No public exploit identified at time of analysis.
E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The TeleMessage service through 2025-05-05 relies on the client side (e.g., the TM SGNL app) to do MD5 hashing, and then accepts the hash as the authentication credential. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authentication bypass in Omnispace Agora Project before 26.10.0 allows anyone holding a user's stored bcrypt password hash to log in as that user - including administrators - by replaying the hash inside the legacy AGORAP_LOG/AGORAP_PASS cookies, never needing the plaintext password. The flaw maps to CWE-836 (use of a password hash instead of the password) and is scored 9.1 in CVSS 4.0 with PR:N, meaning no application login is required to launch the attack; however, the practical gate is a prerequisite credential disclosure, since the attacker must first obtain a valid hash from the Agora credential store (database compromise, exposed backup, or SQL injection), which is why the AC:H assessment applies. The vendor addressed it in release 26.10.0 (vendor-released patch: 26.10.0); no public exploit code has been identified at time of analysis and no EPSS score was supplied.
Authentication bypass in the Setracker2 Android companion app (com.tgelec.setracker) versions 3.1.5 and prior lets an attacker who possesses a user's stored password hash authenticate directly to the backend and gain full account access. Because the backend treats the password hash itself as the secret credential, the hash is password-equivalent and does not need to be cracked back to plaintext. No public exploit identified at time of analysis; the issue was disclosed through CISA/ICS-CERT (advisory VA-26-176-01) and carries a high CVSS 4.0 score of 9.2.
Use of password hash instead of password for authentication vulnerability in SonicWall GMS and Analytics allows Pass-the-Hash attacks.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
CEWE PHOTO SHOW 6.4.3 contains a denial of service vulnerability that allows attackers to crash the application by submitting an excessively long buffer to the password field. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FortiWeb appliances running versions 8.0.0-8.0.1, 7.6.0-7.6.5, 7.4.0-7.4.10, 7.2.0-7.2.11, or 7.0.0-7.0.11 accept a stored password hash as a direct authentication credential, enabling an attacker who has obtained a valid hash out-of-band (e.g., from a leaked configuration or backup) to authenticate as that user via crafted HTTP/HTTPS requests without knowing the cleartext password. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (base 7.5 HIGH) indicates a network-reachable, low-complexity, unauthenticated flaw with high integrity impact; the primary hurdle is acquiring the hash, and the primary exposure is a network-reachable FortiWeb management interface. No public exploit identified at time of analysis.
E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The TeleMessage service through 2025-05-05 relies on the client side (e.g., the TM SGNL app) to do MD5 hashing, and then accepts the hash as the authentication credential. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.