8170 matches found
CVE-2022-24110
Kiteworks MFT 7.5 may allow an unauthorized user to reset other users' passwords. This is fixed in version 7.6 and later...
Code injection
Kiteworks MFT 7.5 may allow an unauthorized user to reset other users' passwords. This is fixed in version 7.6 and later...
CVE-2022-24110
CVE-2022-24110 affects Kiteworks MFT 7.5, where an unauthorized user could reset other users’ passwords. The issue is resolved in version 7.6 and later. The connected Red Hat, NVD, and other entries corroborate that the vulnerability exists in 7.5 and the remediation is upgrading to 7.6+; no expl...
Snipe-IT 信息泄露漏洞
Snipe-IT is an open source IT asset/license management system. snipe-it suffers from an information disclosure vulnerability that stems from the existence of two different responses for unregistered and registered email addresses in the password reset page. An attacker could use this vulnerabilit...
PT-2022-16471 · Kiteworks · Kiteworks Mft
Name of the Vulnerable Software and Affected Versions: Kiteworks MFT version 7.5 Description: The issue allows an unauthorized user to reset other users' passwords. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents...
Exposure of Sensitive Information to an Unauthorized Actor in snipe/snipe-it
Description An attacker can enumerate users through the response message in the password reset page. When you visit the password reset page, you will be provided with the option to enter your email address. Let's use two different emails, one will be a valid address, and another will be an invali...
in snipe/snipe-it
Description An attacker can enumerate users through the response time in the password reset page. When you visit the password reset page, you will be provided with the option to enter your email address. Let's use two different emails, one will be a valid address, and another will be an invalid...
"Zero-Days" Without Incident - Compromising Angular via Expired npm Publisher Email Domains
NOTE: If you’re just looking for the high level points, see the “The TL;DR Summary & High-Level Points” section of this post. Recently I took an interest in the npm registry due to it’s critical role in the security of managing packages for all of JavaScript and Node. After registering an account...
CVE-2021-42000
When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallel reset flows, an existing user can reset another existing users password...
CVE-2021-42000
When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallel reset flows, an existing user can reset another existing users password...
CVE-2021-42000
When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallel reset flows, an existing user can reset another existing users password...
Default credentials
When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallel reset flows, an existing user can reset another existing users password...
CVE-2021-42000 Ping Identity PingFederate Password Reset and Password Change Mishandling with an authentication policy in parallel reset flows
When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallel reset flows, an existing user can reset another existing users password...
CVE-2021-42000
CVE-2021-42000 affects Ping Identity PingFederate. The issue arises when a password reset or password change flow uses an authentication policy and the policy’s adapter supports multiple parallel reset flows. This can allow an existing user to reset the password of another existing user, represen...
CVE-2021-45901
The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists...
CVE-2021-45901
The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists...
CVE-2021-45901
The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists...
Authentication flaw
The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists...
CVE-2021-45901
The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists...
CVE-2021-45901
The CVE-2021-45901 issue affects ServiceNow Orlando, where the password-reset form returns different responses for invalid authentication depending on username existence, enabling unauthenticated username enumeration. The connected documents include an exploit script and PoC code demonstrating ho...