CVE-2024-5277

In lunary-ai/lunary version 1.2.4, a vulnerability exists in the password recovery mechanism where the reset password token is not invalidated after use. This allows an attacker who compromises the recovery token to repeatedly change the password of a victim's account. The issue lies in the...

CVE-2024-5277

In lunary-ai/lunary version 1.2.4, a vulnerability exists in the password recovery mechanism where the reset password token is not invalidated after use. This allows an attacker who compromises the recovery token to repeatedly change the password of a victim's account. The issue lies in the...

CVE-2024-5277 Weak Password Recovery Mechanism in lunary-ai/lunary

In lunary-ai/lunary version 1.2.4, a vulnerability exists in the password recovery mechanism where the reset password token is not invalidated after use. This allows an attacker who compromises the recovery token to repeatedly change the password of a victim's account. The issue lies in the...

CVE-2024-5277

CVE-2024-5277 affects lunary-ai/lunary 1.2.4. The reset password mechanism does not invalidate the token after use, allowing reuse of a compromised recovery token to repeatedly change a victim’s password. Impact described as unauthorized account access with high confidentiality/integrity impact; ...

Lunary 信息泄露漏洞

lunary is a production toolkit for LLM. An information disclosure vulnerability exists in lunary that stems from exposing a password recovery token in an API response. An attacker could exploit this vulnerability to cause an information disclosure...

Breaking a Password Manager

Interesting story of breaking the security of the RoboForm password manager in order to recover a cryptocurrency wallet password. Grand and Bruno spent months reverse engineering the version of the RoboForm program that they thought Michael had used in 2013 and found that the pseudo-random number...

CVE-2024-5404

An unauthenticated remote attacker can change the admin password in a moneo appliance due to weak password recovery mechanism...

CVE-2024-5404 ifm: moneo prone to weak password recovery mechanism

An unauthenticated remote attacker can change the admin password in a moneo appliance due to weak password recovery mechanism...

CVE-2024-5404 ifm: moneo prone to weak password recovery mechanism

An unauthenticated remote attacker can change the admin password in a moneo appliance due to weak password recovery mechanism...

SUSE CVE-2024-33901

Issue in KeePassXC 2.7.7 allows an attacker who has the privileges of the victim to recover some passwords stored in the .kdbx database via a memory dump. NOTE: the vendor disputes this because memory-management constraints make this unavoidable in the current design and other realistic designs...

CVE-2024-33901

Issue in KeePassXC 2.7.7 allows an attacker who has the privileges of the victim to recover some passwords stored in the .kdbx database via a memory dump. NOTE: the vendor disputes this because memory-management constraints make this unavoidable in the current design and other realistic designs...

CVE-2024-33901

Issue in KeePassXC 2.7.7 allows an attacker who has the privileges of the victim to recover some passwords stored in the .kdbx database via a memory dump. NOTE: the vendor disputes this because memory-management constraints make this unavoidable in the current design and other realistic designs...

UBUNTU-CVE-2024-33901

DISPUTED Issue in KeePassXC 2.7.7 allows an attacker who has the privileges of the victim to recover some passwords stored in the .kdbx database via a memory dump. NOTE: the vendor disputes this because memory-management constraints make this unavoidable in the current design and other realistic...

CVE-2024-33901

Issue in KeePassXC 2.7.7 allows an attacker who has the privileges of the victim to recover some passwords stored in the .kdbx database via a memory dump. NOTE: the vendor disputes this because memory-management constraints make this unavoidable in the current design and other realistic designs...

CVE-2024-33901

KeePassXC 2.7.7 is affected by CVE-2024-33901: an attacker with the victim’s privileges can recover some passwords stored in the .kdbx database via a memory dump. The vendor disputes the claim, citing unavoidable memory-management constraints in the current design. A Proof-of-Concept repo demonst...

KeePass 安全漏洞

KeePass is an open source password manager. A security vulnerability exists in KeePassXC version 2.7.7, which stems from a vulnerability that allows an attacker to recover some passwords stored in the .kdbx database...

PT-2024-25537 · Keepassxc · Keepassxc

Name of the Vulnerable Software and Affected Versions: KeePassXC version 2.7.7 Description: The issue allows an attacker, who has the privileges of the victim, to recover some passwords stored in the .kdbx database via a memory dump. The vendor disputes this, citing memory-management constraints...

CVE-2024-32042

The key used to encrypt passwords stored in the database can be found in the CyberPower PowerPanel application code, allowing the passwords to be recovered...

CVE-2024-32042

CVE-2024-32042 affects CyberPower PowerPanel Business Edition (PowerPanel business). Root cause: the cryptographic key used to encrypt passwords stored in the database is present in the PowerPanel application code, allowing recovery of those passwords (Storing Passwords in a Recoverable Format). ...

Cyber Power Systems PowerPanel Business Edition 安全漏洞

Cyber Power Systems PowerPanel Business Edition is a suite of power management software from Cyber Power Systems, USA. The software automates the shutdown of physical and virtual infrastructures, and monitors and manages CyberPower UPS systems and network-connected PDUs Power Distribution Units. ...