CVE-2018-12420

IceHrm before 23.0.1.OS has a risky usage of a hashed password in a request.

• CWE-327

• https://github.com/gamonoid/icehrm/commit/025a8283ab5d679ff99a6b82398e4c8efed1ad9dPatch, Third Party Advisory
• https://github.com/gamonoid/icehrm/releases/tag/v23.0.1.OSRelease Notes, Third Party Advisory
• https://github.com/gamonoid/icehrm/commit/025a8283ab5d679ff99a6b82398e4c8efed1ad9dPatch, Third Party Advisory
• https://github.com/gamonoid/icehrm/releases/tag/v23.0.1.OSRelease Notes, Third Party Advisory

Published

Jun 14, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-12414The Rendezvous Routing Daemon (rvrd), Rendezvous Secure Rout…7.5
• CVE-2018-12415The Central Administration server (emsca) component of TIBCO…7.5
• CVE-2018-12416The GridServer Broker and GridServer Director components of …7.1
• CVE-2018-12417Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-12418Archive.java in Junrar before 1.0.1, as used in Apache Tika …
• CVE-2018-1242Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoi…
• CVE-2018-12421LTB (aka LDAP Tool Box) Self Service Password before 1.3 all…
• CVE-2018-12422addressbook/backends/ldap/e-book-backend-ldap.c in Evolution…
• CVE-2018-12423In Synapse before 0.31.2, unauthorised users can hijack room…
• CVE-2018-12426The WP Live Chat Support Pro plugin before 8.0.07 for WordPr…
• CVE-2018-12429JEESNS through 1.2.1 allows XSS attacks by ordinary users wh…
• CVE-2018-1243Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, vers…7.5