Lennoncmj

**Nome do software vulnerável e versões afetadas: DoraCMS versões 2.1.1 e anteriores Descrição: O problema está relacionado à codificação fraca das senhas, o que as torna suscetíveis a ataques de dicionário devido à ausência de um salt aleatório ou IV na criptografia AES-CBC. Isso permite que invasores obtenham informações confidenciais. Recomendações: Para as versões 2.1.1 e anteriores, atualize para uma versão que implemente um método seguro de criptografia de senhas, utilizando um salt aleatório ou IV para a criptografia AES-CBC, a fim de prevenir ataques de dicionário.

**Name of the Vulnerable Software and Affected Versions** CMSWing version 1.3.7 **Description** The issue concerns the password hashing mechanism in CMSWing, where the global.encryptPassword function in bootstrap/global.js relies on multiple MD5 operations. This could potentially lead to security weaknesses. **Recommendations** For CMSWing version 1.3.7, consider updating the password hashing mechanism to use a more secure algorithm, as relying on multiple MD5 operations may not provide sufficient security. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Hotels Server versions through 2018-11-05 **Description** The issue concerns password storage protection in Hotels Server. It relies on base64 encoding, which is insufficient for secure password storage. **Recommendations** For versions through 2018-11-05, consider implementing a secure password hashing algorithm to protect password storage, as relying on base64 encoding is not sufficient. At the moment, there is no information about a newer version that contains a fix for this vulnerability.