CVE-2021-26091

A use of a cryptographically weak pseudo-random number generator vulnerability in the authenticator of the Identity Based Encryption service of FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to infer parts of users authentication tokens and reset thei...

CVE-2021-26091

A use of a cryptographically weak pseudo-random number generator vulnerability in the authenticator of the Identity Based Encryption service of FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to infer parts of users authentication tokens and reset thei...

CVE-2025-1796

A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts, by exploiting a weak pseudo-random number generator PRNG used for generating password reset codes. The application uses random.randint for this purpose, which is not suitable...

CVE-2024-12776

In langgenius/dify v0.10.1, the /forgot-password/resets endpoint does not verify the password reset code, allowing an attacker to reset the password of any user, including administrators. This vulnerability can lead to a complete compromise of the application...

CVE-2024-12039

langgenius/dify version v0.10.1 contains a vulnerability where there are no limits applied to the number of code guess attempts for password reset. This allows an unauthenticated attacker to reset owner, admin, or other user passwords within a few hours by guessing the six-digit code, resulting i...

CVE-2024-12295

The BoomBox Theme Extensions plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.8.0. This is due to the plugin not properly validating a user's identity prior to updating their password through the 'boomboxajaxresetpassword'...

The vulnerability of the ice_reset VF() function in the drivers/net/ethernet/intel/ice/ice VF_lib.c module of the Linux kernel allows a hacker to cause a service failure.

The vulnerability of the icereset VF function in the drivers/net/ethernet/intel/ice/ice VFlib.c module of the Linux kernel is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the mt7921_mac_reset_work() function in the drivers/net/wireless/mediatek/mt76/mt7921/mac.c module of the Linux kernel allows a hacker to cause a service failure.

The vulnerability of the mt7921macresetwork function in the drivers/net/wireless/mediatek/mt76/mt7921/mac.c module of the Linux kernel is related to insufficient locking of resources. Exploiting this vulnerability could allow an attacker to cause a service failure...

Cross-site Request Forgery (CSRF)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF through the endpoints /rag/api/v1/reset, /rag/api/v1/reset/db, /api/v1/memories/reset, and /rag/api/v1/reset/uploads. An attacker can manipulate the application's state and...

CVE-2024-12776

In langgenius/dify v0.10.1, the /forgot-password/resets endpoint does not verify the password reset code, allowing an attacker to reset the password of any user, including administrators. This vulnerability can lead to a complete compromise of the application...

CVE-2024-12039

langgenius/dify version v0.10.1 contains a vulnerability where there are no limits applied to the number of code guess attempts for password reset. This allows an unauthenticated attacker to reset owner, admin, or other user passwords within a few hours by guessing the six-digit code, resulting i...

CVE-2024-12776

CVE-2024-12776 affects langgenius/dify v0.10.1. The issue is that the /forgot-password/resets endpoint does not verify the password reset code, enabling an attacker to reset the password of any user, including administrators, potentially leading to full compromise of the application. Root cause: ...

CVE-2024-12776 Authentication Bypass in langgenius/dify

In langgenius/dify v0.10.1, the /forgot-password/resets endpoint does not verify the password reset code, allowing an attacker to reset the password of any user, including administrators. This vulnerability can lead to a complete compromise of the application...

CVE-2024-12776 Authentication Bypass in langgenius/dify

In langgenius/dify v0.10.1, the /forgot-password/resets endpoint does not verify the password reset code, allowing an attacker to reset the password of any user, including administrators. This vulnerability can lead to a complete compromise of the application...

CVE-2024-12776 Authentication Bypass in langgenius/dify

In langgenius/dify v0.10.1, the /forgot-password/resets endpoint does not verify the password reset code, allowing an attacker to reset the password of any user, including administrators. This vulnerability can lead to a complete compromise of the application...

CVE-2024-12039 Improper Restriction of Excessive Authentication Attempts in langgenius/dify

langgenius/dify version v0.10.1 contains a vulnerability where there are no limits applied to the number of code guess attempts for password reset. This allows an unauthenticated attacker to reset owner, admin, or other user passwords within a few hours by guessing the six-digit code, resulting i...

CVE-2024-12039 Improper Restriction of Excessive Authentication Attempts in langgenius/dify

langgenius/dify version v0.10.1 contains a vulnerability where there are no limits applied to the number of code guess attempts for password reset. This allows an unauthenticated attacker to reset owner, admin, or other user passwords within a few hours by guessing the six-digit code, resulting i...

CVE-2024-12039

The CVE-2024-12039 entry concerns langgenius/dify v0.10.1, where the password-reset flow has no limit on code-guess attempts. An unauthenticated attacker can brute-force a six-digit code to reset passwords (owner/admin/other users), leading to complete compromise of the application. Root cause: l...

CVE-2024-12039 Improper Restriction of Excessive Authentication Attempts in langgenius/dify

langgenius/dify version v0.10.1 contains a vulnerability where there are no limits applied to the number of code guess attempts for password reset. This allows an unauthenticated attacker to reset owner, admin, or other user passwords within a few hours by guessing the six-digit code, resulting i...

CVE-2025-1796 Admin account takeover through weak Pseudo-Random number generator used in generating password reset codes in langgenius/dify

A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts, by exploiting a weak pseudo-random number generator PRNG used for generating password reset codes. The application uses random.randint for this purpose, which is not suitable...