CVE-2024-48282

A SQL Injection vulnerability was found in /password-recovery.php of PHPGurukul User Registration & Login and User Management System 3.2, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the femail parameter in a POST HTTP request...

PT-2024-33068 · Unknown · Phpgurukul User Registration & Login/User Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul User Registration & Login and User Management System version 3.2 Description: A SQL Injection issue was found in the /password-recovery.php file, allowing remote attackers to execute arbitrary SQL commands and gain unauthorized...

CVE-2024-9907 QileCMS Verification Code Forget.php sendEmail password recovery

A vulnerability classified as problematic was found in QileCMS up to 1.1.3. This vulnerability affects the function sendEmail of the file /qilecms/user/controller/Forget.php of the component Verification Code Handler. The manipulation leads to weak password recovery. The attack can be initiated...

CVE-2024-9907 QileCMS Verification Code Forget.php sendEmail password recovery

A vulnerability classified as problematic was found in QileCMS up to 1.1.3. This vulnerability affects the function sendEmail of the file /qilecms/user/controller/Forget.php of the component Verification Code Handler. The manipulation leads to weak password recovery. The attack can be initiated...

CVE-2024-9907

CVE-2024-9907 affects QileCMS up to version 1.1.3, specifically the Verification Code Handler’s sendEmail functionality in /qilecms/user/controller/Forget.php. The issue allows manipulation that results in weak password recovery. Attacks are described as remote, with high attack complexity and di...

QileCMS 授权问题漏洞

QileCMS is an open source community e-commerce system from QileCMS Open Source. An authorization issue vulnerability exists in QileCMS 1.1.3 and earlier versions, which stems from the sendEmail function in file /qilecms/user/controller/Forget.php can lead to weak password recovery...

Security Bulletin: IBM Security SOAR password recovery is vulnerable (CVE-2024-45670)

Summary The password reset function in IBM Security QRadar SOAR had vulnerabilities that could allow hackers to exploit and take over user privileges. An update has been released which addresses these issues. It is recommended upgrading to Version 51.0.2.0 or later of IBM Security SOAR...

Synology DiskStation Manager Weak Password Recovery Mechanism for Forgotten Password (CVE-2018-8916)

Unverified password change vulnerability in Change Password in Synology DiskStation Manager DSM before 6.2-23739 allows remote authenticated users to reset password without verification. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

CVE-2024-8449

Certain switch models from PLANET Technology have a Hard-coded Credential in the password recovering functionality, allowing an unauthenticated attacker to connect to the device via the serial console and use this credential to reset any user's password...

CVE-2024-8449

CVE-2024-8449 affects PLANET Technology switch models, where the password recovery function contains a hard-coded credential. An unauthenticated attacker with physical access can use the serial console to reset any user’s password. The CVE entry notes hard-coded credential as the root cause and h...

PT-2024-39019 · Planet Technology · Planet Technology Switch

Name of the Vulnerable Software and Affected Versions: PLANET Technology switches affected versions not specified Description: The issue concerns a hard-coded credential in the password recovering functionality of certain switch models from PLANET Technology. This allows an unauthenticated attack...

PLANET switch devices 信任管理问题漏洞

PLANET switch devices are a family of switch devices from PLANET Corporation in China. A trust management issue vulnerability exists in PLANET switch devices that stems from hard-coded credentials in the password recovery feature, allowing an unauthenticated attacker to connect to the device via...

CVE-2024-8878

The password recovery mechanism for the forgotten password in Riello Netman 204 allows an attacker to reset the admin password and take over control of the device.This issue affects Netman 204: through 4.05...

RIELLO UPS NetMan SQL注入漏洞

RIELLO UPS NetMan is a network adapter from RIELLO UPS, Italy. A security vulnerability exists in RIELLO UPS NetMan version 204 4.05, which stems from a forgotten password recovery mechanism that allows an attacker to reset the administrator password and take over control of the device...

CVE-2024-8878 Unauthenticated Password Reset

The password recovery mechanism for the forgotten password in Riello Netman 204 allows an attacker to reset the admin password and take over control of the device.This issue affects Netman 204: through 4.05...

CVE-2024-8878

CVE-2024-8878 concerns Riello NetMan 204. The vulnerability allows an unauthenticated password reset via the endpoint /recoverpassword.html, enabling an attacker to obtain the device’s netmanid and compute a recovery code to reset the admin password (admin:admin). Affected software is NetMan 204 ...

PT-2024-39296 · Riello · Riello Netman 204

Name of the Vulnerable Software and Affected Versions: Riello Netman 204 versions through 4.05 Description: The password recovery mechanism for the forgotten password in Riello Netman 204 allows an attacker to reset the admin password and take over control of the device. Recommendations: For...

CVE-2024-8692

A vulnerability classified as critical was found in TDuckCloud TDuckPro up to 6.3. Affected by this vulnerability is an unknown functionality. The manipulation leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The...

CVE-2024-8692

A vulnerability classified as critical was found in TDuckCloud TDuckPro up to 6.3. Affected by this vulnerability is an unknown functionality. The manipulation leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The...

CVE-2024-8692 TDuckCloud TDuckPro password recovery

A vulnerability classified as critical was found in TDuckCloud TDuckPro up to 6.3. Affected by this vulnerability is an unknown functionality. The manipulation leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The...