GO-2023-1719 Answer vulnerable to account takeover because password reset links do not expire in github.com/answerdev/answer

Answer vulnerable to account takeover because password reset links do not expire in github.com/answerdev/answer...

Apache Answer Security Bypass Vulnerability

Apache Answer is a community platform of the Apache USA Foundation. A security bypass vulnerability exists in Apache Answer 1.3.5 and earlier versions, which can be exploited by an attacker to cause the link to be abused or hijacked, due to a security bypass vulnerability that stems from the...

Apache Answer Security Bypass Vulnerability (CNVD-2024-35661)

Apache Answer is a community platform of the Apache USA Foundation. A security bypass vulnerability exists in Apache Answer version 1.3.5 and prior versions, which originates when a user sends multiple password reset emails, each of which contains a valid link, and can be exploited by an attacker...

GO-2024-3064 Apache Answer: The link to reset the user's password will remain valid after sending a new link in github.com/apache/incubator-answer

Apache Answer: The link to reset the user's password will remain valid after sending a new link in github.com/apache/incubator-answer...

Security Bulletin: IBM OpenPages may write sensitive information with System tracing enabled (CVE-2024-35117)

Summary IBM OpenPages may write sensitive data to server log files when the 'UI API' tracing is enabled per the System Tracing feature. Vulnerability Details CVEID:CVE-2024-35117 DESCRIPTION: IBM OpenPages may write sensitive information, under specific configurations, in clear text to the system...

CVE-2024-6788

A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password...

CVE-2024-6788

A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password...

CVE-2024-6788 Phoenix Contact: update feature from CHARX controller can be used to reset a low privilege user password

A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password...

CVE-2024-6788 Phoenix Contact: update feature from CHARX controller can be used to reset a low privilege user password

A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password...

CVE-2024-6788

CVE-2024-6788 affects Phoenix Contact CHARX SEC family (CHARX SEC-3000/3050/3100/3150). A remote unauthenticated attacker can abuse the LAN firmware-update feature to reset the low-privilege user “user-app” password to the default. Root cause is described as insecure default resource initializati...

Missing Release Of Resource After Effective Lifetime

github.com/apache/incubator-answer is vulnerable to Missing Release of Resource after Effective Lifetime. The vulnerability is due to improper handling of password reset links. An attacker can misuse or hijack the link by accessing it within its validity period, even after a new link has been...

Resource Leakage

github.com/apache/incubator-answer is vulnerable to Resource Leakage. The vulnerability is due to improper management of the password reset link's validity, allowing it to remain active and reusable even after it has been used...

PT-2024-7101 · Phoenix Contact · Phoenix Contact Charx Sec-3000

Name of the Vulnerable Software and Affected Versions: Phoenix Contact CHARX SEC-3000 versions up to 1.6.2 Description: A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user user-app t...

PHOENIX CONTACT CHARX SEC 安全漏洞

PHOENIX CONTACT CHARX SEC is a series of AC charge controllers from PHOENIX CONTACT, Germany. A security vulnerability exists in PHOENIX CONTACT CHARX SEC. An attacker could use the firmware update function on the LAN interface of the device to reset the password of the user with low privileges...

U.S. Dept Of Defense: CSRF Attack on changing security questions leads to full Account TakeOver

The CSRF vulnerability in the security questions and password reset functionality of the website allowed an attacker to change a victim's security questions and answers, and then leverage this to reset the victim's password and gain full control of the account...

GHSA-V3X9-WRQ5-868J Apache Answer: The link for resetting user password is not Single-Use

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. The password reset link remains valid within its expiration period even after it has been used. This could potentially lead to the link being misused or hijacked...

Apache Answer: The link for resetting user password is not Single-Use

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. The password reset link remains valid within its expiration period even after it has been used. This could potentially lead to the link being misused or hijacked...

GHSA-GVPV-R32V-9737 Apache Answer: The link to reset the user's password will remain valid after sending a new link

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. User sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused o...

Apache Answer: The link to reset the user's password will remain valid after sending a new link

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. User sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused o...

CVE-2024-7659

A vulnerability, which was classified as problematic, was found in projectsend up to r1605. Affected is the function generaterandomstring of the file includes/functions.php of the component Password Reset Token Handler. The manipulation leads to insufficiently random values. It is possible to...