CVE-2019-10641

Contao contains a session invalidation flaw: existing user sessions are not properly invalidated when a password is changed. Affected versions include Contao 3.* up to 3.5.38 and Contao 4.x up to 4.7.2, with the fix released in Contao 3.5.39, 4.4.37, or 4.7.3. The issue, identified in CVE-2019-10...

CVE-2019-10641: Weak Password Recovery Mechanism for Forgotten Password

Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password...

CVE-2018-0696: Weak Password Recovery Mechanism for Forgotten Password

OpenAM Open Source Edition 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the security questions and reset the login password via unspecified vectors...

CVE-2018-1000812

Artica Integria IMS version 5.0 MR56 Package 58, likely earlier versions contains a CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability in Password recovery process, line 45 of general/passwordrecovery.php that can result in IntegriaIMS web app user accounts can be take...

Design/Logic Flaw

Artica Integria IMS version 5.0 MR56 Package 58, likely earlier versions contains a CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability in Password recovery process, line 45 of general/passwordrecovery.php that can result in IntegriaIMS web app user accounts can be take...

CVE-2018-1000812

Artica Integria IMS version 5.0 MR56 Package 58, likely earlier versions contains a CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability in Password recovery process, line 45 of general/passwordrecovery.php that can result in IntegriaIMS web app user accounts can be take...

CVE-2018-1000812

The CVE-2018-1000812 entry concerns Artica Integria IMS (versions around 5.0 MR56 Package 58 and likely earlier) with a CWE-640 Weak Password Recovery Mechanism in the Password recovery process. The vulnerability in general/password_recovery.php (line 45) can allow takeover of IntegriaIMS web app...

CVE-2018-1000812: Weak Password Recovery Mechanism for Forgotten Password

Artica Integria IMS version 5.0 MR56 Package 58, likely earlier versions contains a CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability in Password recovery process, line 45 of general/passwordrecovery.php that can result in IntegriaIMS web app user accounts can be take...

CVE-2018-12315: Weak Password Recovery Mechanism for Forgotten Password

Missing verification of a password in ASUSTOR ADM version 3.1.1 allows attackers to change account passwords without entering the current password...

CVE-2018-7811: Weak Password Recovery Mechanism for Forgotten Password

An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the change password function of the web server...

CVE-2018-17298: Weak Password Recovery Mechanism for Forgotten Password

An issue was discovered in Enalean Tuleap before 10.5. Reset password links are not invalidated after a user changes its password...

CVE-2018-12421: Weak Password Recovery Mechanism for Forgotten Password

LTB aka LDAP Tool Box Self Service Password before 1.3 allows a change to a user password without knowing the old password via a crafted POST request, because the ldapbind return value is mishandled and the PHP data type is not constrained to be a string...

CVE-2018-11134: Weak Password Recovery Mechanism for Forgotten Password

In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue managed that runs with root privileges and only allows a set of commands. One of the available commands allows changing any user's password including root. A...

CVE-2017-8916: Weak Password Recovery Mechanism for Forgotten Password

In Center for Internet Security CIS-CAT Pro Dashboard before 1.0.4, an authenticated user is able to change an administrative user's e-mail address and send a forgot password email to themselves, thereby gaining administrative access...

CVE-2017-1000141: Weak Password Recovery Mechanism for Forgotten Password

An issue was discovered in Mahara before 18.10.0. It mishandled user requests that could discontinue a user's ability to maintain their own account changing username, changing primary email address, deleting account. The correct behavior was to either prompt them for their password and/or send a...

CVE-2015-5172: Weak Password Recovery Mechanism for Forgotten Password

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry PCF Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire password reset links...

CVE-2015-4689: Weak Password Recovery Mechanism for Forgotten Password

Ellucian formerly SunGard Banner Student 8.5.1.2 through 8.7 allows remote attackers to reset arbitrary passwords via unspecified vectors, aka "Weak Password Reset."...

CVE-2017-8613: Weak Password Recovery Mechanism for Forgotten Password

Azure AD Connect Password writeback, if misconfigured during enablement, allows an attacker to reset passwords and gain unauthorized access to arbitrary on-premises AD privileged user accounts aka "Azure AD Connect Elevation of Privilege Vulnerability."...

CVE-2017-7629: Weak Password Recovery Mechanism for Forgotten Password

QNAP QTS before 4.2.6 build 20170517 has a flaw in the change password function...

CVE-2017-9543: Weak Password Recovery Mechanism for Forgotten Password

register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1 allows remote attackers to reset arbitrary passwords via a crafted POST request to registresult.htm...