CVE-2022-37163
Bminusl IHateToBudget v1.5.7 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brut...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Bminusl IHateToBudget v1.5.7 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Additionally, user passwords are hashed without a salt or pepper making it much easier for tools like hashcat to crack the hashes.
Références
- advisory github.com
- advisory nvd.nist.gov
- report github.com
- web gainsec.com