2138 matches found
PT-2022-4129 · Schneider Electric · Modicon M340 Cpu +3
Name of the Vulnerable Software and Affected Versions: EcoStruxure Control Expert versions V15.0 SP1 and prior EcoStruxure Process Expert versions V2021 and prior Modicon M340 CPU versions V3.40 and prior Modicon M580 CPU versions V3.20 and prior Description: A Weak Password Recovery Mechanism fo...
CVE-2022-34989
Fruits Bazar v1.0 was discovered to contain a SQL injection vulnerability via the recoveremail parameter at userpasswordrecover.php...
PT-2022-22473 · Unknown · Fruits Bazar
Name of the Vulnerable Software and Affected Versions: Fruits Bazar version 1.0 Description: A SQL injection issue was found in Fruits Bazar via the recover email parameter at the "user password recover.php" endpoint. Recommendations: For Fruits Bazar version 1.0, as a temporary workaround,...
"Loss protection disabled" Warning in GUI
Challenge When configuring backup file encryption, the following warning is shown: Loss protection disabled Creating Encrypted Configuration Backups Backup Job Encryption Cause This warning appears when the Veeam Backup & Replication installation is not managed by a Veeam Backup Enterprise Manage...
The vulnerability of the Countly-server data analysis software, which allows a hacker to change the password of an arbitrary user and increase their privileges.
The vulnerability of the Countly-server data analysis software Countly is related to the lack of a password recovery mechanism. Exploiting this vulnerability allows a malicious actor to change the password of an arbitrary user and increase their privileges...
The vulnerability of Trendnet TEW-831DR router microprogramming software, related to the lack of a password recovery mechanism, allows attackers to gain unauthorized access to protected information.
The vulnerability of Trendnet TEW-831DR router microprogramming software is related to the lack of a password recovery mechanism. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to protected information...
HTML Injection
typo3/cms is vulnerable to HTML injection. The vulnerability exists due to the lack of sanitization used in the receiverName parameter in PasswordRecovery.html, allowing an attacker to inject and execute malicious html content on the web page...
CVE-2021-3754
A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password recovery email in case the user forgets the password. Mitigation The workaround is to enable "Email as username" flag ...
Weak Password Recovery Mechanism for Forgotten Password
Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten Password via an empty confirmhash value to verify.php. Remediation Upgrade mantisbt/mantisbt to version 1.3.10, 2.2.4, 2.3.1 or higher. References...
GHSA-382V-GXJ9-FFHC Moodle uses predictable password-recovery tokens
lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 relies on the PHP mtrand function to implement the randomstring and complexrandomstring functions, which makes it easier for remote attackers to predict password-recovery tokens via a...
Moodle uses predictable password-recovery tokens
lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 relies on the PHP mtrand function to implement the randomstring and complexrandomstring functions, which makes it easier for remote attackers to predict password-recovery tokens via a...
GHSA-2PHX-W35G-X9VM Moodle Weak Password Recovery Mechanism for Forgotten Password
In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed...
Moodle Weak Password Recovery Mechanism for Forgotten Password
In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed...
GHSA-RP89-32RP-QPQ2 Pagekit Weak Password Recovery Mechanism for Forgotten Password
An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug toolbar is enabled. The password is successfully recovered using this exploit. The SecureLayer7 ID is SL7PGKT01...
Pagekit Weak Password Recovery Mechanism for Forgotten Password
An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug toolbar is enabled. The password is successfully recovered using this exploit. The SecureLayer7 ID is SL7PGKT01...
GHSA-CQ6M-74R4-X77G Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password
Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry PCF Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire password reset links...
Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password
Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry PCF Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire password reset links...
Shopware Code Problem Vulnerability (CNVD-2022-31768)
Shopware is a German Shopware company's open source e-commerce software. A code issue vulnerability exists in Shopware that stems from the fact that in the affected version, a user session is not logged off if the password is reset via password recovery. An attacker could exploit the vulnerabilit...
pearweb authorization issue vulnerability
pearweb is a PHP extension and application repository. pearweb has a security vulnerability that stems from a weak password recovery mechanism in include/users/passwordmanage.php, and no details of the vulnerability are currently available...
