2933 matches found
CVE-2022-22110 DayByDay CRM - Weak Password Requirements in Update User
In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. This may allow an attacker to brute-force users’...
CVE-2022-22110 DayByDay CRM - Weak Password Requirements in Update User
In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. This may allow an attacker to brute-force users’...
CVE-2022-22110
CVE-2022-22110 affects Daybyday CRM; versions 1.1–2.2.0 are impacted due to weak password validation in the user-password update flow. The underlying issue is insufficient enforcement of password strength during password changes performed by users with update privileges, enabling the use of very ...
23
Handle 0v3rf10w Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps --- The...
CVE-2021-24998
The CVE-2021-24998 entry concerns the WordPress plugin Simple JWT Login (pre-3.3.0). The root cause is the plugin’s password generation using PHP’s non-cryptographically secure functions, specifically the use of str_shuffle to create new user passwords. This enables creation of new WordPress user...
PT-2021-16397 · WordPress · Simple Jwt Login
Name of the Vulnerable Software and Affected Versions: Simple JWT Login WordPress plugin versions prior to 3.3.0 Description: The issue allows creation of new WordPress user accounts with a randomly generated password. The password generation uses the str shuffle PHP function, which does not...
The vulnerability of the microprogrammed Ethernet module software WISE-4060, Adam-6050 D, and Adam.NET Utility lies in their weak password requirements, allowing attackers to compromise user credentials.
The vulnerability of the microprogrammed Ethernet module WISE-4060, Adam-6050 D, and Adam.NET Utilit is related to weak password requirements. Exploiting this vulnerability could allow a malicious actor to compromise user credentials through brute-force attacks...
ASG2100 has weak password vulnerability
ASG2100 is an Internet behavior management product. ASG2100 is vulnerable to a weak password vulnerability. An attacker could exploit this vulnerability to obtain sensitive information...
PT-2021-09: Possibility of authorization in Remote Password mechanism using password hash
The vulnerability of the FX5UC CPU and FX5UJ CPU modules of Mitsubishi Electric FA products is associated with the possibility of using a weak password hash. Exploiting the vulnerability may allow an attacker to use the resulting hash value to recover the password value. Advisory status 15.12.202...
PT-2021-6785 · Mitsubishi · Melsec Q Series Q03/04/06/13/26Udvcpu +20
Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric MELSEC iQ-F series FX5UC CPU all versions Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU all versions Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU all versions Mitsubishi Electric MELSEC iQ-R series...
Belloo Permissions and Access Control Issues Vulnerability
Belloo, a "high quality" dating software from Belloo, is vulnerable to permission and access control issues due to a weak password reset mechanism in requestsuser.php, which could be exploited to bypass authentication vulnerabilities and take over an account...
CVE-2021-41696
An authentication bypass account takeover vulnerability exists in Premiumdatingscript 4.2.7.7 due to a weak password reset mechanism in requests\user.php...
CVE-2021-41696
An authentication bypass account takeover vulnerability exists in Premiumdatingscript 4.2.7.7 due to a weak password reset mechanism in requests\user.php...
CVE-2021-41696
An authentication bypass account takeover vulnerability exists in Premiumdatingscript 4.2.7.7 due to a weak password reset mechanism in requests\user.php...
Authentication flaw
An authentication bypass account takeover vulnerability exists in Premiumdatingscript 4.2.7.7 due to a weak password reset mechanism in requests\user.php...
CVE-2021-41696
An authentication bypass account takeover vulnerability exists in Premiumdatingscript 4.2.7.7 due to a weak password reset mechanism in requests\user.php...
Belloo 权限许可和访问控制问题漏洞
Belloo, a "high quality" dating software from Belloo, is vulnerable to permission and access control issues due to a weak password reset mechanism in requestsuser.php, which could be exploited to bypass authentication vulnerabilities and take over an account...
Unitrends Backup SNMP weak password vulnerability
Unitrends Backup is eliminating data loss, ransomware, and risk. versions prior to Unitrends Backup 10.5.5 have an SNMP weak password vulnerability that stems from the SNMP daemon being configured with a weak silent group name, which can be exploited by an attacker to gain snmp control privileges...
Hitachi Energy XMC20 and FOX61x
1. EXECUTIVE SUMMARY CVSS v3 9.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: XMC20 and FOX61x Vulnerabilities: Weak Password Requirements, Missing Handler 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to...