CVE-2022-1073 Automatic Question Paper Generator password recovery

A vulnerability was found in Automatic Question Paper Generator 1.0. It has been declared as critical. An attack leads to privilege escalation. The attack can be launched remotely...

GHSA-W267-M9C4-8555 Shopware user session is not logged out if the password is reset via password recovery

Impact User session is not logged out if the password is reset via password recovery Patches Fixed in 6.4.8.1, maintainers recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview...

Default credentials

Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved in version 6.4.8.1. For older versions of 6.1, 6.2, and 6.3...

CVE-2022-24744

CVE-2022-24744 – Shopware Affected: Shopware (open commerce platform based on Symfony and Vue) where, in affected versions, user sessions remain active after a password reset via the recovery flow. Root cause (as described in security docs): insufficient session expiration management allowing a u...

CVE-2022-24744 Insufficient Session Expiration in shopware

Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved in version 6.4.8.1. For older versions of 6.1, 6.2, and 6.3...

Shopware 代码问题漏洞

Shopware is a German Shopware company's open source e-commerce software. A code issue vulnerability exists in Shopware that stems from the fact that in the affected version, a user session is not logged off if the password is reset via password recovery. An attacker could exploit the vulnerabilit...

CVE-2022-0777

Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to 1.3...

CVE-2022-0777

Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to 1.3...

Default credentials

Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to 1.3...

CVE-2022-0777

CVE-2022-0777 affects microweber/microweber prior to version 1.3. The issue is a weak password recovery mechanism caused by a missing rate limit on password reset emails, as described by the connected advisories (e.g., GHSA-7R79-MRP6-8MHQ and related Red Hat/NVD entries). The documented impact is...

CVE-2022-0777 Weak Password Recovery Mechanism for Forgotten Password in microweber/microweber

Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to 1.3...

CVE-2022-0777 Weak Password Recovery Mechanism for Forgotten Password in microweber/microweber

Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to 1.3...

Weak Password Recovery Mechanism for Forgotten Password

Description: There is no rate limit sent unlimited email victim or any email address. Proof of Concept: There is no rate limit return-password , attacker to send unlimited email to victim or any email address. Impact: Attacker can sent unlimited email to any mail address . Solution: Add 'throttle...

Schneider Electric Modicon Weak Password Recovery Mechanism for Forgotten Password (CVE-2018-7811)

An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the change password function of the web server This plugin only works with Tenable.ot. Please visit...

Schneider Electric PowerLogic PM55xx and PowerLogic PM8ECC Weak Password Recovery Mechanism For Forgotten Password (CVE-2021-22763)

A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 see security notification for version infromation that could allow an attacker administrator level access to a device. This plug...

Schneider Electric Modicon Weak Password Recovery Mechanism for Forgotten Password (CVE-2018-7809)

An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the password delete function of the web server. This plugin only works with Tenable.ot. Please visit...

Mageia: Security Advisory (MGASA-2019-0229)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Narthex - Modular Personalized Dictionary Generator

Narthex Greek: Νάρθηξ, νάρθηκας is a modular & minimal dictionary generator for Unix and Unix-like operating system written in C and Shell. It contains autonomous Unix-style programs for the creation of personalised dictionaries that can be used for password recovery & security assessment. The...

CVE-2021-36750

ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVault users across USB drives sold under multiple brand names...

Enc Security Enc DataVault 信息泄露漏洞

Enc Security Enc DataVault is a solution from the Dutch company Enc Security. Turns any Usb drive into a secure removable disk for important files. An information disclosure vulnerability exists in Enc Security ENC DataVault 7.1.1W, which stems from VaultAPI v67 incorrectly handling key derivatio...