CVE-2023-41353

Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of weak password requirements. A remote attacker with regular user privilege can easily infer the administrator password from system information after logging system, resulting in admin access and performing arbitrary system operations or disrup...

GHSA-6F58-J323-6472 pimcore/admin-ui-classic-bundle Unverified Password Change

Impact As old password can be set as new password , it is considered as password policy violation. Pimcore is not enforcing strict password policy which allow attacker to set old password as new password Proof of Concept 1. Go to Admin link 2. login and click on - "User | My Profile". 3. Go to...

pimcore/admin-ui-classic-bundle Unverified Password Change

Impact As old password can be set as new password , it is considered as password policy violation. Pimcore is not enforcing strict password policy which allow attacker to set old password as new password Proof of Concept 1. Go to Admin link 2. login and click on - "User | My Profile". 3. Go to...

PT-2023-32375 · Pimcore · Pimcore Admin Classic Bundle

Name of the Vulnerable Software and Affected Versions: pimcore/admin-ui-classic-bundle versions prior to 1.2.0 Description: The issue concerns an unverified password change in the GitHub repository pimcore/admin-ui-classic-bundle. This allows an attacker to set an old password as a new password,...

Take an Offensive Approach to Password Security by Continuously Monitoring for Breached Passwords

Passwords are at the core of securing access to an organization's data. However, they also come with security vulnerabilities that stem from their inconvenience. With a growing list of credentials to keep track of, the average end-user can default to shortcuts. Instead of creating a strong and...

i-doit Security Vulnerabilities

i-doit is a configuration management database software from i-doit Inc. A security vulnerability exists in i-doit pro and i-doit open that stems from the use of a weak password policy when creating an administrator account, which allows an attacker to guess a user's password via a brute force...

Weak Password Requirements

github.com/answerdev/answer is vulnerable due to Weak Password Requirements. The vulnerability exists because the password policy mechanism in the account registration allows users to create weak passwords, even with spaces, which could result in account takeovers...

answer Security breach

answer is an open source knowledge-based community software. A security vulnerability exists in versions of answer prior to 1.1.0 that stems from a weak password policy when creating an account...

IBM Planning Analytics Encryption Problem Vulnerability (CNVD-2023-68783)

IBM Planning Analytics is a suite of business planning analytics solutions from International Business Machines IBM. The solution supports automated execution of processes such as business planning, budgeting and analysis. Planning Analytics Cartridge for Cloud Pak for Data version v4.0 suffers...

CVE-2023-27877

IBM Planning Analytics Cartridge for Cloud Pak for Data 4.0 connects to a CouchDB server. An attacker can exploit an insecure password policy to the CouchDB server and collect sensitive information from the database. IBM X-Force ID: 247905...

CVE-2023-27877

CVE-2023-27877 affects IBM Planning Analytics Cartridge for IBM Cloud Pak for Data 4.0. The issue arises from an insecure CouchDB password policy over the network, allowing an attacker to disclose sensitive data stored in CouchDB. Documents consistently identify the affected component as the Cart...

IBM Planning Analytics 授权问题漏洞

IBM Planning Analytics is a suite of business planning analytics solutions from International Business Machines IBM. The solution supports automated execution of processes such as business planning, budgeting, and analysis. A security vulnerability exists in IBM Planning Analytics Cartridge for...

msLDAPDump - LDAP Enumeration Tool

msLDAPDump simplifies LDAP enumeration in a domain environment by wrapping the lpap3 library from Python in an easy-to-use interface. Like most of my tools, this one works best on Windows. If using Unix, the tool will not resolve hostnames that are not accessible via eth0 currently. Binding...

The app allows to set new password same as old password

Description 1/ Access and login to the demo website: https://demo.openitcockpit.io 2/ At changing password function, set new password as same as old password. 3/ Logout and re-login to check, it's successful. Proof of Concept Link video PoC:...

Weak Password Requirements

org.apache.inlong is vulnerable to Weak Password Requirements. The vulnerability is due to a lack of a password policy, such as allowing a simple password with any character or symbol because the UserRequest.java does not properly limit the length, which would allow an attacker to brute force the...

Weak Password policy on account registration

Description It was observed that application allows to create account with Blank spaces as password Proof of Concept 1. Go to https://meta.answer.dev/users/register 2. Create account with 10 blank spaces as password Result: Application allows to create user account with blank spaces as password...

Bypass change password policy

Description I tested your demo site and discovered a vulnerability that could bypass password length and password complexity validation in your account's password change function. Proof of Concept link video PoC https://drive.google.com/file/d/1r2TAeFdLAeEREUccDoE86Yacavv79VR/view?usp=sharing...

PYSEC-2023-34

Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0...

modoboa 安全漏洞

modoboa is an email hosting and management platform for individual developers. A security vulnerability exists in modoboa versions prior to 2.1.0, which can be exploited to bypass a strong password policy by removing specific parameters and setting the password to 1...

PT-2023-18286 · Modoboa · Modoboa

Name of the Vulnerable Software and Affected Versions: modoboa/modoboa versions prior to 2.1.0 Description: The issue is related to weak password requirements in the modoboa/modoboa GitHub repository. Users can set unsafe passwords, such as 1 or HACK. This issue is fixed in version 2.1.0...