CVE-2024-29417

Insecure Permissions vulnerability in e-trust Horacius 1.0, 1.1, and 1.2 allows a local attacker to escalate privileges via the password reset function...

CVE-2024-29417

Insecure Permissions vulnerability in e-trust Horacius 1.0, 1.1, and 1.2 allows a local attacker to escalate privileges via the password reset function...

CVE-2024-29417

Insecure Permissions vulnerability in e-trust Horacius 1.0, 1.1, and 1.2 allows a local attacker to escalate privileges via the password reset function...

E-TRUST Horacius 安全漏洞

E-TRUST Horacius is a comprehensive IAM system from E-TRUST Corporation. A security vulnerability exists in E-TRUST Horacius versions 1.0, 1.1, and 1.2 that originates from a vulnerability that allows a local attacker to escalate privileges via the password reset feature...

CVE-2024-29417

CVE-2024-29417 concerns an insecure permissions flaw in e-trust Horacius 1.0, 1.1, and 1.2 that enables a local attacker to escalate privileges via the password reset function. Affected component is the password reset workflow, with root cause described as inappropriate/insufficient permissions o...

GitLab 16.1 < 16.7.6 / 16.8 < 16.8.3 / 16.9 < 16.9.1 (CVE-2024-1525)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. Unde...

Dropbox Sign customer data accessed in breach

Dropbox is reporting a recent "security incident" in which an attacker gained unauthorized access to the Dropbox Sign formerly HelloSign production environment. During this access, the attacker had access to Dropbox Sign customer information. Dropbox Sign is a platform that allows customers to...

CISA Warns of Active Exploitation of Severe GitLab Password Reset Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added a critical flaw impacting GitLab to its Known Exploited Vulnerabilities KEV catalog, owing to active exploitation in the wild. Tracked as CVE-2023-7028 CVSS score: 10.0, the maximum severity vulnerability could facilitate...

Login with phone number < 1.7.17 - Unauthorized Account Password Change to Privilege Escalation

Description The Login with phone number plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.16. This is due to the plugin not properly verifying the identity of a user who is trying to reset a password. This makes it possible for authenticated...

PT-2024-22887 · Entrust · E-Trust Horacius

Name of the Vulnerable Software and Affected Versions: e-trust Horacius versions 1.0 through 1.2 Description: The issue allows a local attacker to escalate privileges via the password reset function. It is described as an Insecure Permissions vulnerability, enabling unauthenticated privilege...

Logic Flaw Vulnerability in Zhengfang Service Management Platform of Zhengfang Software Co.

hereinafter referred to as "Zhengfang", founded in January 1999, is a software enterprise and a high-tech enterprise specializing in consulting, planning, construction and service in the field of education informatization in colleges and universities. A logic flaw exists in the Zhengfang Service...

CVE-2024-3777

The password reset feature of Ai3 QbiBot lacks proper access control, allowing unauthenticated remote attackers to reset any user's password...

CVE-2024-3777

CVE-2024-3777 affects Ai3 QbiBot where the password reset feature has broken access control, allowing unauthenticated remote reset of any user’s password. Public sources indicate the vulnerability exists in Ai3 QbiBot v8.0.4 and earlier. The CVSS‑3.1 base score is 9.8 (CRITICAL) with network acce...

CVE-2024-3777 Ai3 QbiBot - Broken Access Control

The password reset feature of Ai3 QbiBot lacks proper access control, allowing unauthenticated remote attackers to reset any user's password...

CVE-2024-3777 Ai3 QbiBot - Broken Access Control

The password reset feature of Ai3 QbiBot lacks proper access control, allowing unauthenticated remote attackers to reset any user's password...

Ai3 QbiBot 访问控制错误漏洞

Ai3 QbiBot is an intelligent customer service from the Chinese company Ai3. An access control error vulnerability exists in Ai3 QbiBot v8.0.4 and earlier versions, which stems from an access control error vulnerability in the password reset feature. An attacker can exploit this vulnerability to...

PT-2024-27741 · Ai3 · Ai3 Qbibot

Name of the Vulnerable Software and Affected Versions: Ai3 QbiBot affected versions not specified Description: The password reset feature lacks proper access control, allowing unauthenticated remote attackers to reset any user's password. Recommendations: At the moment, there is no information...

Ubuntu: Security Advisory (USN-6722-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-28270

An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resetPassword...

USN-6722-1 python-django vulnerability

Simon Charette discovered that the password reset functionality in Django used a Unicode case insensitive query to retrieve accounts associated with an email address. An attacker could possibly use this to obtain password reset tokens and hijack accounts...