Autolab Misconfigured Reset Password Permissions

Impact For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their passwords. Patches This is fixed in v3.0.1. Workarounds No workarounds. For more information If you have any questions or comments about this...

GHSA-V46J-H43H-RWRM Autolab Misconfigured Reset Password Permissions

Impact For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their passwords. Patches This is fixed in v3.0.1. Workarounds No workarounds. For more information If you have any questions or comments about this...

CVE-2024-48428

An issue in Olive VLE allows an attacker to obtain sensitive information via the reset password function...

CVE-2024-49376

Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their...

CVE-2024-49376

Autolab CVE-2024-49376 affects version 3.0.0 and involves a misconfiguration of reset password permissions for email-based accounts. The issue could allow users with insufficient privileges to reset passwords and potentially access privileged users’ accounts. It is fixed in version 3.0.1. Remedia...

CVE-2024-49376 Autolab Has Misconfigured Reset Password Permissions

Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their...

CVE-2024-49376 Autolab Has Misconfigured Reset Password Permissions

Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their...

CVE-2024-49376 Autolab Has Misconfigured Reset Password Permissions

Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their...

Autolab 授权问题漏洞

Autolab is a course management service open-sourced by Autolab. It supports automatically graded programming assignments. An authorization issue vulnerability exists in Autolab version 3.0.0 that stems from a misconfiguration of the reset password permission...

Olive VLE 安全漏洞

Olive VLE is a virtual learning environment from Olive that digitally transforms traditional lecture formats into high-end interactive learning experiences. A security vulnerability exists in Olive VLE that stems from allowing an attacker to gain access to sensitive information through the reset...

CVE-2024-48428

An issue in Olive VLE allows an attacker to obtain sensitive information via the reset password function...

Autolab Misconfigured Reset Password Permissions

For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their passwords...

PT-2024-33108 · Olive Vle · Olive Vle

Name of the Vulnerable Software and Affected Versions: Olive VLE affected versions not specified Description: An issue in Olive VLE allows an attacker to obtain sensitive information via the reset password function. Recommendations: At the moment, there is no information about a newer version tha...

CVE-2024-3938

The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patch, and as such it cannot be demonstrated via Demo site link. Those interested to see the vulnerability may spin up a...

CVE-2024-3938

The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patch, and as such it cannot be demonstrated via Demo site link. Those interested to see the vulnerability may spin up a...

PT-2024-28478 · Dotadmin · Dotadmin

Name of the Vulnerable Software and Affected Versions: dotAdmin affected versions not specified Description: The "reset password" login page accepted an HTML injection via URL parameters. This issue has already been rectified via a patch. The vulnerability can be demonstrated by accessing the...

PocketBase performs password auth and OAuth2 unverified email linking

In order to be exploited you must have both OAuth2 and Password auth methods enabled. A possible attack scenario could be: - a malicious actor register with the targeted user's email it is unverified - at some later point in time the targeted user stumble on your app and decides to sign-up with...

CVE-2024-38351 Password auth and OAuth2 unverified email linking

Pocketbase is an open source web backend written in go. In affected versions a malicious user may be able to compromise other user accounts. In order to be exploited users must have both OAuth2 and Password auth methods enabled. A possible attack scenario could be: 1. a malicious actor register...

CVE-2024-38468

Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized password resets via the resetPassword API...

Unauthorized Password Reset

cartalyst/sentry is vulnerable to Unauthorized Password Reset. The vulnerability is due to improper handling of password reset checks in the Sentry authentication framework, which allows attackers to reset passwords for users who have NULL in their resetpasswordcode column...