Improper Access Control

typo3/cms is vulnerable to improper access control. The expiration time of a password reset link has never been evaluated, which allows an authenticated attacker to use the password reset link to perform a password reset even if the default expiry time of two hours has been exceeded...

PT-2022-24572 · Feehicms · Feehicms

Name of the Vulnerable Software and Affected Versions: Feehi CMS version 2.1.1 Description: A Host Header Injection issue may allow an attacker to spoof a particular header, potentially exploiting this by abusing password reset emails. Recommendations: For Feehi CMS version 2.1.1, consider...

FeehiCMS 注入漏洞

FeehiCMS is a Php-based CMS website builder by Liufee Personal Developer. A security vulnerability exists in FeehiCMS version 2.1.1, which stems from the fact that it may allow an attacker to implement spoofing of specific headers via host header injection. This can be abused for password reset...

CVE-2022-36106

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be used to perform a password reset even ...

Default credentials

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be used to perform a password reset even ...

CVE-2022-36106 Missing check for expiration time of password reset token in TYPO3

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be used to perform a password reset even ...

CVE-2022-36106 Missing check for expiration time of password reset token in TYPO3

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be used to perform a password reset even ...

CVE-2022-36106 Missing check for expiration time of password reset token in TYPO3

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be used to perform a password reset even ...

CVE-2022-36106

TYPO3 CMS password reset tokens for backend users lack a validated expiration check. The CVE-2022-36106 entry notes that the expiration time was never evaluated, allowing a password reset link to be used even after the default two-hour expiry. Affected software is TYPO3 CMS (backend) and the root...

BackupBuddy WordPress plugin vulnerable to exploitation, update now!

Users of WordPress may need to perform an urgent update related to the popular BackupBuddy plugin. BackupBuddy is a plugin which offers backup solutions designed to combat "hacks, malware, user error, deleted files, and running bad commands". Unfortunately, running an older version of BackupBuddy...

TYPO3-CORE-SA-2022-008: Missing check for expiration time of password reset token for backend users

More info at https://typo3.org/security/advisory/typo3-core-sa-2022-008...

TYPO3-CORE-SA-2022-008: Missing check for expiration time of password reset token for backend users

More info at https://typo3.org/security/advisory/typo3-core-sa-2022-008...

TYPO3 授权问题漏洞

TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Association in Switzerland. TYPO3 suffers from an authorization issue vulnerability that stems from never evaluating the expiration time of the password reset link for TYPO3 back-end users...

PT-2022-23196 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 10.4.32 TYPO3 versions prior to 11.5.16 Description: The expiration time of a password reset link for TYPO3 backend users has never been evaluated, allowing a password reset link to be used even after the default expir...

The North Face hit by credential stuffing attack

The North Face clothing brand, which specialises in outdoor and heavy weather outerwear, has experienced a "large-scale" credential stuffing attack. This has resulted in no fewer than 194,905 accounts being compromised. What is credential stuffing, and how did it affect The North Face customers?...

Password Reset Poisoning

Description Humhub uses the HTTP Host-Header in a password reset request to generate the password reset link that is sent to the user in an email without any filters or checks. This allows an attacker to craft a password reset request using a manipulated host header, resulting in reset-token...

The vulnerability of the utils.generateUUID function in the NodeBB Forum Software allows a violator to elevate their privileges.

The vulnerability of the utilsGenerateUUID function in the NodeBB Forum Software is related to errors in the code for generating pseudo-random numbers for password reset codes. Exploiting this vulnerability could allow an attacker to increase their privileges remotely...

Nextcloud: Missing rate limiting on password reset functionality allows to send lot of emails

A missing rate limiting on password reset functionality in Nextcloud allowed an attacker to send a large number of emails, potentially resulting in financial loss and service disruption. The vulnerability was exploited using the IP rotate extension of Burp Suite. The issue was resolved by adding ...

CVE-2022-36045

NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It utilizes web sockets for instant interactions and real-time notifications. utils.generateUUID, a helper function available in essentially all versions of NodeBB as far back as v1.0.1 and...

CVE-2022-36045 Account takeover via cryptographically weak PRNG in NodeBB Forum

NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It utilizes web sockets for instant interactions and real-time notifications. utils.generateUUID, a helper function available in essentially all versions of NodeBB as far back as v1.0.1 and...