CVE-2022-39307 Grafana subject to Exposure of Sensitive Information resulting in User enumeration via forget password

Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the /api/user/password/sent-reset-email URL. When the username or email does not exist, a JSON response contains a “user not found” message. This leaks...

Desdev DedeCMS 跨站请求伪造漏洞

Desdev DedeCMS Dream Weaving Content Management System is a PHP-based open-source content management system CMS of China Zhuozhuo network Desdev company. The system has content publishing , content management , content editing and content retrieval functions. Desdev DedeCMS cross-site request...

User enumeration via forget password

Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the /api/user/password/sent-reset-email URL. When the username or email does not exist, a JSON response contains a “user not found” message. This leaks...

Username and email enumeration via Forgot password feature

📜 Description User enumeration is when a malicious actor can use brute-force techniques to either guess or confirm valid users in a system. The malicious actor is looking for differences in the server's response based on the validity of submitted credentials. The differences can be inside the...

CVE-2022-38168

Broken Access Control in User Authentication in Avaya Scopia Pathfinder 10 and 20 PTS version 8.3.7.0.4 allows remote unauthenticated attackers to bypass the login page, access sensitive information, and reset user passwords via URL modification...

CVE-2022-38168

Broken Access Control in User Authentication in Avaya Scopia Pathfinder 10 and 20 PTS version 8.3.7.0.4 allows remote unauthenticated attackers to bypass the login page, access sensitive information, and reset user passwords via URL modification...

PT-2022-24254 · Avaya · Avaya Scopia Pathfinder

Name of the Vulnerable Software and Affected Versions: Avaya Scopia Pathfinder 10 and 20 PTS version 8.3.7.0.4 Description: The issue allows remote unauthenticated attackers to bypass the login page, access sensitive information, and reset user passwords via URL modification. This is a result of...

CVE-2022-43364

An access control issue in the password reset page of IP-COM EW9 V15.11.0.149732 allows unauthenticated attackers to arbitrarily change the admin password...

CVE-2022-43364

An access control issue in the password reset page of IP-COM EW9 V15.11.0.149732 allows unauthenticated attackers to arbitrarily change the admin password...

Default credentials

An access control issue in the password reset page of IP-COM EW9 V15.11.0.149732 allows unauthenticated attackers to arbitrarily change the admin password...

IP-COM EW9 安全漏洞

The IP-COM EW9 is a wireless router from IP-COM. A security vulnerability exists in the IP-COM EW9 version V15.11.0.149732 that stems from an access control issue on the password reset page that allows an unauthenticated attacker to arbitrarily change the administrator password...

PT-2022-26872 · Ip Com · Ip-Com Ew9

Name of the Vulnerable Software and Affected Versions: IP-COM EW9 version 15.11.0.149732 Description: The issue is related to an access control problem in the password reset page, allowing unauthenticated attackers to change the admin password arbitrarily. Recommendations: For IP-COM EW9 version...

CVE-2022-43364

CVE-2022-43364 affects IP-COM EW9 (firmware V15.11.0.14(9732)). An access-control flaw on the password-reset page allows unauthenticated attackers to arbitrarily change the admin password. CVSSv3.1 metrics in NVD/CVE entries: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (base score 7.5, HIGH). Attack vect...

CVE-2022-43364

An access control issue in the password reset page of IP-COM EW9 V15.11.0.149732 allows unauthenticated attackers to arbitrarily change the admin password...

CVE-2022-39360

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 single sign on SSO users were able to do password resets on Metabase, which could allow a user access without going through the SSO IdP. This issue is patched in versions...

CVE-2022-39360

Metabase SSO password-reset flaw allows bypassing IdP for specific older releases. Affected versions include Metabase before 0.44.5/1.44.5, 0.43.7/1.43.7, 0.42.6/1.42.6, and 0.41.9/1.41.9. The root cause enables SSO users to reset passwords without going through the SSO IdP, potentially granting ...

CVE-2022-39360 Metabase SSO users able to circumvent IdP login by doing password reset

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 single sign on SSO users were able to do password resets on Metabase, which could allow a user access without going through the SSO IdP. This issue is patched in versions...

Metabase 授权问题漏洞

Metabase is an open source data analytics platform from the US-based Metabase Inc. A security vulnerability exists in Metabase that stems from the ability of single sign-on SSO users to reset their passwords on Metabase, which could allow users to access it without going through the SSO IdP...

PT-2022-24928 · Metabase · Metabase

Name of the Vulnerable Software and Affected Versions: Metabase versions prior to 0.41.9 and 1.41.9 Metabase versions prior to 0.42.6 and 1.42.6 Metabase versions prior to 0.43.7 and 1.43.7 Metabase versions prior to 0.44.5 and 1.44.5 Description: The issue allows single sign on SSO users to...

CVE-2022-39360 Metabase SSO users able to circumvent IdP login by doing password reset

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 single sign on SSO users were able to do password resets on Metabase, which could allow a user access without going through the SSO IdP. This issue is patched in versions...