8160 matches found
CVE-2023-46393
gougucms v4.08.18 was discovered to contain a password reset poisoning vulnerability which allows attackers to arbitrarily reset users' passwords via a crafted packet...
Spoofing
gougucms v4.08.18 was discovered to contain a password reset poisoning vulnerability which allows attackers to arbitrarily reset users' passwords via a crafted packet...
CVE-2023-46393
gougucms v4.08.18 was discovered to contain a password reset poisoning vulnerability which allows attackers to arbitrarily reset users' passwords via a crafted packet...
gougucms Security Vulnerabilities
gougucms gougucms CMS is a Chinese hook open source open source based on ThinkPHP6 Layui MySql to create a lightweight general-purpose back-end management framework . gougucms v4.08.18 version of a security vulnerability , the vulnerability stems from allowing an attacker to arbitrarily reset the...
CVE-2023-46393
Summary: Gougucms v4.08.18 contains a password reset poisoning vulnerability that lets an attacker arbitrarily reset user passwords via a crafted packet. This affects gougucms CMS version 4.08.18. The underlying issue is a mismanaged password-reset flow (password reset poisoning). Impact as per s...
CVE-2023-46393
gougucms v4.08.18 was discovered to contain a password reset poisoning vulnerability which allows attackers to arbitrarily reset users' passwords via a crafted packet...
PT-2023-29999 · Gougucms · Gougucms
Name of the Vulnerable Software and Affected Versions: gougucms version 4.08.18 Description: The issue allows attackers to arbitrarily reset users' passwords via a crafted packet, exploiting a password reset poisoning vulnerability. Recommendations: For gougucms version 4.08.18, update to a versi...
Design/Logic Flaw
Engelsystem is a shift planning system for chaos events. If a users' password is compromised and an attacker gained access to a users' account, i.e., logged in and obtained a session, an attackers' session is not terminated if the users' account password is reset. This vulnerability has been fixe...
CVE-2023-45659 Session is not expiring after password reset in Engelsystem
Engelsystem is a shift planning system for chaos events. If a users' password is compromised and an attacker gained access to a users' account, i.e., logged in and obtained a session, an attackers' session is not terminated if the users' account password is reset. This vulnerability has been fixe...
CVE-2023-45659 Session is not expiring after password reset in Engelsystem
Engelsystem is a shift planning system for chaos events. If a users' password is compromised and an attacker gained access to a users' account, i.e., logged in and obtained a session, an attackers' session is not terminated if the users' account password is reset. This vulnerability has been fixe...
Engelsystem Code Issue Vulnerability
Engelsystem is an open source shift planning system from Engelsystem. Engelsystem has a code issue vulnerability that stems from the current session not expiring after a password reset...
Exploit for Improper Authentication in Fit2Cloud Jumpserver
BlackJump Chinese |...
GHSA-V683-RCXX-VPFF ZITADEL's password reset does not respect the "Ignoring unknown usernames" setting
Impact ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. While this settings was properly working during the authentication process it did not work correctly on the password reset flow. This meant th...
ZITADEL's password reset does not respect the "Ignoring unknown usernames" setting
Impact ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. While this settings was properly working during the authentication process it did not work correctly on the password reset flow. This meant th...
Uptime Kuma has Persistentent User Sessions
Summary Attackers with access to a users' device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity-periods. Details uptime-kuma sets JWT tokens for users after successful authentication. These tokens have...
CVE-2023-44399 ZITADEL's password reset does not respect the "Ignoring unknown usernames" setting
ZITADEL provides identity infrastructure. In versions 2.37.2 and prior, ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. While this settings was properly working during the authentication process it...
CVE-2023-44399 ZITADEL's password reset does not respect the "Ignoring unknown usernames" setting
ZITADEL provides identity infrastructure. In versions 2.37.2 and prior, ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. While this settings was properly working during the authentication process it...
CVE-2023-44399 ZITADEL's password reset does not respect the "Ignoring unknown usernames" setting
ZITADEL provides identity infrastructure. In versions 2.37.2 and prior, ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. While this settings was properly working during the authentication process it...
CVE-2023-43623
A vulnerability has been identified in Mendix Forgot Password Mendix 10 compatible All versions V5.4.0, Mendix Forgot Password Mendix 7 compatible All versions V3.7.3, Mendix Forgot Password Mendix 8 compatible All versions V4.1.3, Mendix Forgot Password Mendix 9 compatible All versions V5.4.0...