CVE-2024-43190 IBM Engineering Requirements Management DOORS weak authentication

IBM Engineering Requirements Management DOORS 9.7.2.9, under certain configurations, could allow a remote attacker to obtain password reset instructions of a legitimate user using man in the middle techniques...

CVE-2024-43190 IBM Engineering Requirements Management DOORS weak authentication

IBM Engineering Requirements Management DOORS 9.7.2.9, under certain configurations, could allow a remote attacker to obtain password reset instructions of a legitimate user using man in the middle techniques...

CVE-2024-43190

CVE-2024-43190 affects IBM Engineering Requirements Management DOORS 9.7.2.9. Description and connected IBM advisory confirm a weak authentication issue that, under certain configurations, could allow a remote attacker to obtain password reset instructions for a legitimate user via man-in-the-mid...

CVE-2025-43932

JobCenter through 7e7b0b2 allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...

CVE-2025-43933

fblog through 983bede allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...

CVE-2025-43931

flask-boilerplate through a170e7c allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...

CVE-2025-53373 Natours has a 1 Click Account take over on reset password via Host Header injection

Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server domain in the Host header when requesting the /forgetpassword endpoint. This vulnerability is fixed with commit 7401793a8d9ed0f0c250c4e0ee2815d685d7a70b...

CVE-2025-53373

Natours (Tour Booking API) has a Host header injection vulnerability in the /forgetpassword endpoint that lets an attacker take over a victim's account by supplying an attacker-controlled server domain. The issue is mitigated by the fix in commit 7401793a8d9ed0f0c250c4e0ee2815d685d7a70b. Affected...

CVE-2025-43930

Hashview 0.8.1 allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...

CVE-2025-47227

In the Production Environment extension in Netmake ScriptCase through 9.12.006 23, the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeov...

IBM Engineering Requirements Management DOORS 授权问题漏洞

IBM Engineering Requirements Management DOORS is a requirements management tool from International Business Machines IBM. An authorization issue vulnerability exists in IBM Engineering Requirements Management DOORS version 9.7.2.9, which stems from a misconfiguration that could lead to a...

JobCenter 安全漏洞

JobCenter is a task center application by NoardGuo Personal Developer. A security vulnerability exists in JobCenter 7e7b0b2 and prior versions that stems from an unconfigured SERVERNAME causing the password reset feature to rely on the Host HTTP header, which could lead to account takeover...

CVE-2025-43932

Summary: JobCenter before patch 7e7b0b2 is vulnerable to account takeover via the password reset flow because SERVER_NAME is not configured, making the reset rely on the Host HTTP header. This root cause enables an attacker to abuse the reset mechanism, with CVSS v3.1 metrics indicating high impa...

PT-2025-28174 · Pypi · Flask-Boilerplate

Name of the Vulnerable Software and Affected Versions: flask-boilerplate versions through a170e7c Description: The issue allows account takeover via the password reset feature. This is because the SERVER NAME is not configured, and thus the password reset depends on the Host HTTP header...

Blog 安全漏洞

Blog is a personal blogging system by the individual developers of Xuzijia in China. A security vulnerability exists in Blog 983bede and prior versions, which stems from an unconfigured SERVERNAME causing the password reset function to rely on the Host HTTP header, which could lead to an account...

PT-2025-28176 · Fblog · Fblog

Name of the Vulnerable Software and Affected Versions: fblog versions through 983bede Description: The issue allows account takeover via the password reset feature because the SERVER NAME is not configured, causing the reset to depend on the Host HTTP header. Recommendations: For versions through...

CVE-2025-43933

fblog through 983bede allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...

PT-2025-28228 · Ibm · Ibm Engineering Requirements Management Doors

Name of the Vulnerable Software and Affected Versions: IBM Engineering Requirements Management DOORS version 9.7.2.9 Description: The issue allows a remote attacker to obtain password reset instructions of a legitimate user using man-in-the-middle techniques under certain configurations...

CVE-2025-43933

Summary (CVE-2025-43933): The issue affects fblog versions up to and including 983bede. A misconfigured SERVER_NAME causes the password reset flow to depend on the Host HTTP header, enabling account takeover via password reset. The root cause is that server name information is not validated, allo...

PT-2025-28173 · Hashview · Hashview

Name of the Vulnerable Software and Affected Versions: Hashview version 0.8.1 Description: The issue allows for account takeover via the password reset feature. This is because the SERVER NAME is not configured, causing the password reset to depend on the Host HTTP header. Recommendations: For...