CallBackery before 0.62.0 has password and session flaws
The note describes unsalted HMAC-SHA1 passwords, cookie forgery via rand(), and session cookies accepted at any age.
Stories per day · 30 days
3 RSS
2 stories, newest first · one card per story
Stories tagged #password-hashing
Rockwell Automation OTTO Fleet Manager
CISA warns Rockwell Automation OTTO Fleet Manager (CVE-2026-75112, CVSS 6.8) uses insufficiently costly password hashing, easing offline brute-force attacks.