CVE-2023-5296 Xinhu RockOA Password password recovery

A vulnerability was found in Xinhu RockOA 1.1/2.3.2/15.X3amdi and classified as problematic. Affected by this issue is some unknown functionality of the file api.php?m=reimplat&a=index of the component Password Handler. The manipulation leads to weak password recovery. The attack may be launched...

RockOA Authorization Issues Vulnerability

RockOA Xinhu is an open source office OA system. An authorization issue vulnerability exists in Xinhu RockOA version 1.1, version 2.3.2, and version 15.X3amdi. An attacker could exploit this vulnerability to cause weak password recovery...

CVE-2023-43650 Non-MFA account takeover via brute-force attack on weak password reset code in jumpserver

JumpServer is an open source bastion host. The verification code for resetting user's password is vulnerable to brute-force attacks due to the absence of rate limiting. JumpServer provides a feature allowing users to reset forgotten passwords. Affected users are sent a 6-digit verification code,...

CVE-2023-43650 Non-MFA account takeover via brute-force attack on weak password reset code in jumpserver

JumpServer is an open source bastion host. The verification code for resetting user's password is vulnerable to brute-force attacks due to the absence of rate limiting. JumpServer provides a feature allowing users to reset forgotten passwords. Affected users are sent a 6-digit verification code,...

CVE-2023-41878

MeterSphere is a one-stop open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing and performance testing. The Selenium VNC config used in Metersphere is using a weak password by default, attackers can login to vnc and obtain high...

Design/Logic Flaw

MeterSphere is a one-stop open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing and performance testing. The Selenium VNC config used in Metersphere is using a weak password by default, attackers can login to vnc and obtain high...

CVE-2023-41878 Weak password of selenium VNC in MeterSphere

MeterSphere is a one-stop open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing and performance testing. The Selenium VNC config used in Metersphere is using a weak password by default, attackers can login to vnc and obtain high...

CVE-2023-41878

MeterSphere’s CVE-2023-41878 describes a vulnerability in the Selenium VNC configuration where a weak default password allows unauthenticated access to VNC and can grant high-level privileges. Affected product: MeterSphere (Selenium VNC config). Root cause: default weak password enabling unauthor...

CVE-2023-41878 Weak password of selenium VNC in MeterSphere

MeterSphere is a one-stop open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing and performance testing. The Selenium VNC config used in Metersphere is using a weak password by default, attackers can login to vnc and obtain high...

The vulnerability of the InPlant SCADA system, related to insufficient calculation of password hashes, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the InPlant SCADA system is related to insufficient calculation of password hashes during the loading of project files. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information...

CVE-2023-4096

Weak password recovery mechanism vulnerability in Fujitsu Arconte Áurea version 1.5.0.0, which exploitation could allow an attacker to perform a brute force attack on the emailed PIN number in order to change the password of a legitimate user...

CVE-2023-4096

Weak password recovery mechanism vulnerability in Fujitsu Arconte Áurea version 1.5.0.0, which exploitation could allow an attacker to perform a brute force attack on the emailed PIN number in order to change the password of a legitimate user...

CVE-2023-4096 Weak password recovery mechanism vulnerability in Fujitsu Arconte Áurea

Weak password recovery mechanism vulnerability in Fujitsu Arconte Áurea version 1.5.0.0, which exploitation could allow an attacker to perform a brute force attack on the emailed PIN number in order to change the password of a legitimate user...

CVE-2023-4096

CVE-2023-4096 affects Fujitsu Arconte Áurea v1.5.0.0. Multiple sources describe a weak password recovery mechanism that could enable an attacker to brute‑force the emailed PIN to change a legitimate user’s password. Affected component appears to be the password recovery flow (PIN delivery/validat...

Supcon InPlant SCADA Security Vulnerability

Supcon InPlant SCADA is a SCADA program from China Zhongguancun Technology Supcon. A security vulnerability exists in Supcon InPlant SCADA that stems from the presence of an unknown function in Project.xml that results in an under-computed password hash...

PT-2023-5277 · Supcon · Supcon Inplant Scada

Name of the Vulnerable Software and Affected Versions: Supcon InPlant SCADA up to 20230901 Description: A problematic vulnerability was found in the Supcon InPlant SCADA system, related to insufficient computational effort in password hash when loading project files. This could allow an attacker ...

CVE-2023-37756

I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation. Attackers are able to easily guess users' passwords via a bruteforce attack...

i-doit Security Vulnerabilities

i-doit is a configuration management database software from i-doit Inc. A security vulnerability exists in i-doit pro and i-doit open that stems from the use of a weak password policy when creating an administrator account, which allows an attacker to guess a user's password via a brute force...

CVE-2023-37756

CVE-2023-37756 affects i-doit Pro/Open versions 25 and below. The root cause is a weak administrator password policy that allows brute-force guessing, enabling unauthorized access. Some connected sources also describe a secondary path where a crafted plugin upload could enable remote code executi...

Default credentials

Soar Cloud Ltd. HR Portal has a weak Password Recovery Mechanism for Forgotten Password. The reset password link sent out through e-mail, and the link will remain valid after the password has been reset and after the expected expiration date. An attacker with access to the browser history or has...