Apache Archiva Security Feature Issue Vulnerability

Apache Archiva is a suite of software from the Apache Foundation for managing one or more remote stores. The software provides remote Repository agents, role-based security access management, and usage reporting. Apache Archiva is vulnerable to a security feature issue that can be exploited by an...

Missing Authorization in Apache Archiva

In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8...

GHSA-5HQC-X78W-3CMW Missing Authorization in Apache Archiva

In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8...

CVE-2022-29405

In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8...

CVE-2022-29405

In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8...

Default credentials

In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8...

CVE-2022-29405 Apache Archiva Arbitrary user password reset vulnerability

In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8...

CVE-2022-29405 Apache Archiva Arbitrary user password reset vulnerability

In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8...

CVE-2022-29405

CVE-2022-29405 concerns Apache Archiva. Affected: Archiva; Issue: any registered user can reset the password for any user due to improper authorization. Impact stated as password reset capability for other users. Mitigation: upgrade to Archiva 2.2.8 (fix mentioned in release notes). If details va...

PT-2022-19580 · Apache · Apache Archiva

Name of the Vulnerable Software and Affected Versions: Apache Archiva versions prior to 2.2.8 Description: The issue allows any registered user to reset the password for any other user. Recommendations: For versions prior to 2.2.8, update to version 2.2.8 to resolve the issue...

Apache Archiva 安全特征问题漏洞

Apache Archiva is a suite of software from the Apache USA Foundation for managing one or more remote repositories. The software provides features such as remote Repository agents, role-based secure access management, and usage reporting. Apache Archiva suffers from a security vulnerability that...

GHSA-VWJ8-4GRF-3R8V Liferay Portal and Liferay DXP fails to invalidate password reset tokens after use

In implementation for the portal services before 5.7.3 in Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to...

Liferay Portal and Liferay DXP fails to invalidate password reset tokens after use

In implementation for the portal services before 5.7.3 in Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to...

GHSA-34CX-HVM4-VX7J Mattermost Server password reset email requests can be sent to attacker-provided email addresses

An issue was discovered in Mattermost Server before 4.0.0, 3.10.1, and 3.9.1. A password reset request was sometimes sent to an attacker-provided e-mail address...

Mattermost Server password reset email requests can be sent to attacker-provided email addresses

An issue was discovered in Mattermost Server before 4.0.0, 3.10.1, and 3.9.1. A password reset request was sometimes sent to an attacker-provided e-mail address...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the password-reset link. An attacker can gain unauthorized access to user accounts by reusing a previously issued password-reset link. Remediation Upgrade github.com/mattermost/mattermost/model to version 3.0...

GHSA-J26G-95PH-2MWV Mattermost Server: Insufficient Password-Reset Link Invalidation

An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused...

Mattermost Server: Insufficient Password-Reset Link Invalidation

An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused...

GHSA-CF8F-W2C5-P5JR keycloak vulnerable to unauthorized login via mail server setup

A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be '[email protected]'...

Popular PyPI Package 'ctx' and PHP Library 'phpass' Hijacked to Steal AWS Keys

Two trojanized Python and PHP packages have been uncovered in what's yet another instance of a software supply chain attack targeting the open source ecosystem. One of the packages in question is "ctx," a Python module available in the PyPi repository. The other involves "phpass," a PHP package...