CVE-2023-38949

An issue in a hidden API in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to arbitrarily reset the Administrator password via a crafted web request...

ZKTeco BioTime 安全漏洞

ZKTeco BioTime is a powerful web-based time and attendance management software from ZKTeco, China. A password reset vulnerability exists in ZKTeco BioTime, which can be exploited by an attacker to arbitrarily reset the administrator's password via a crafted web request...

PT-2023-4123 · Zkteco · Zkteco Biotime

Name of the Vulnerable Software and Affected Versions: ZKTeco BioTime version 8.5.5 Description: The issue is related to a hidden API in the ZKTeco BioTime platform, which allows unauthenticated attackers to reset the Administrator password via a crafted web request. This can be exploited by a...

PT-2023-23713 · Silverstripe · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: Silverstripe Framework versions prior to 4.13.4 Silverstripe Framework versions prior to 5.0.13 Description: The issue arises when a new member record is created without setting a password, resulting in an empty encrypted password. If an...

CVE-2023-3897 Bypassing CAPTCHA & Enumerating Usernames via Password Reset Page

Username enumeration is possible through Bypassing CAPTCHA in On-premise SureMDM Solution on Windows deployment allows attacker to enumerate local user information via error message. This issue affects SureMDM On-premise: 6.31 and below version...

CVE-2023-35134

Weintek Weincloud v0.13.6 could allow an attacker to reset a password with the corresponding account’s JWT token only...

CVE-2023-35134

Weintek Weincloud v0.13.6 could allow an attacker to reset a password with the corresponding account’s JWT token only...

Default credentials

Weintek Weincloud v0.13.6 could allow an attacker to reset a password with the corresponding account’s JWT token only...

PT-2023-25159 · Weintek · Weintek Weincloud

Name of the Vulnerable Software and Affected Versions: Weintek Weincloud version 0.13.6 Description: The issue allows an attacker to reset a password using the corresponding account's JWT token only. No information is provided about the estimated number of potentially affected devices worldwide o...

Weintek Weincloud 授权问题漏洞

Weintek Weincloud is a cloud-based monitoring platform from Weintek, Inc. An authorization issue vulnerability exists in Weintek Weincloud version v0.13.6, which stems from a vulnerability that could allow an attacker to reset passwords using only the JWT token of the corresponding account...

CVE-2023-3591

Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created...

Default credentials

Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created...

CVE-2023-3591 Lack of previous password reset tokens on new token creation

Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created...

CVE-2023-3591 Lack of previous password reset tokens on new token creation

Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created...

CVE-2023-3591 Lack of previous password reset tokens on new token creation

Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created...

CVE-2023-3591

Mattermost is affected by CVE-2023-3591: the system fails to invalidate previously generated password reset tokens when a new token is created. The issue concerns password reset token handling in Mattermost (no specific versions or components provided in the documents beyond the general descripti...

PT-2023-25374 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue is related to Mattermost failing to invalidate previously generated password reset tokens when a new reset token is created. This allows potentially unauthorized access through...

DRUPAL-CONTRIB-2023-030

This module enables you to allow and/or require users to use a second authentication method in addition to password authentication. The module doesn't sufficiently ensure all core login routes, including the password reset page, require a second factor credential. This vulnerability is mitigated ...

Two-factor Authentication (TFA) - Critical - Access bypass - SA-CONTRIB-2023-030

This module enables you to allow and/or require users to use a second authentication method in addition to password authentication. The module doesn't sufficiently ensure all core login routes, including the password reset page, require a second factor credential. This vulnerability is mitigated ...

The vulnerability of cloud-based software for creating and using Nextcloud storage solutions lies in the improper limitation on excessive authentication attempts, which allows a hacker to compromise the target system.

The vulnerability of cloud-based software for creating and using Nextcloud storage solutions is related to the lack of protection against brute-force attacks during password reset procedures. Exploiting this vulnerability could allow a malicious actor to crack the password reset links remotely...