Lucene search
+L

819 matches found

OSV
OSV
added 2024/08/20 8:26 p.m.12 views

GO-2023-1551 Answer subject to Cross-site Scripting vulnerability in github.com/answerdev/answer

Answer subject to Cross-site Scripting vulnerability in github.com/answerdev/answer...

9CVSS8.8AI score0.00745EPSS
SaveExploits1References4
CNVD
CNVD
added 2024/08/14 12:0 a.m.4 views

Apache Answer Security Bypass Vulnerability

Apache Answer is a community platform of the Apache USA Foundation. A security bypass vulnerability exists in Apache Answer 1.3.5 and earlier versions, which can be exploited by an attacker to cause the link to be abused or hijacked, due to a security bypass vulnerability that stems from the...

5.3CVSS6.9AI score0.01222EPSS
SaveExploits0References1
zdt
zdt
added 2024/08/14 12:0 a.m.175 views

WordPress Light Poll 1.0.0 Cross Site Request Forgery Vulnerability

Exploit Title: Light Poll history.pushState'', '', '/'; document.forms0.submit; Reference: https://wpscan.com/vulnerability/d598eabd-a87a-4e3e-be46-a5c5cc3f130e/ Exploit Title: Light Poll and are valid: https://example.com/wp-admin/admin.php?page=pollsettings&task=r...

7.4AI score
SaveExploits0
CNVD
CNVD
added 2024/08/14 12:0 a.m.8 views

Apache Answer Security Bypass Vulnerability (CNVD-2024-35661)

Apache Answer is a community platform of the Apache USA Foundation. A security bypass vulnerability exists in Apache Answer version 1.3.5 and prior versions, which originates when a user sends multiple password reset emails, each of which contains a valid link, and can be exploited by an attacker...

5.3CVSS6.9AI score0.01149EPSS
SaveExploits0References1
OSV
OSV
added 2024/08/12 3:30 p.m.13 views

GHSA-V3X9-WRQ5-868J Apache Answer: The link for resetting user password is not Single-Use

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. The password reset link remains valid within its expiration period even after it has been used. This could potentially lead to the link being misused or hijacked...

6.3CVSS5.2AI score0.01222EPSS
SaveExploits0References5
Github Security Blog
Github Security Blog
added 2024/08/12 3:30 p.m.20 views

Apache Answer: The link for resetting user password is not Single-Use

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. The password reset link remains valid within its expiration period even after it has been used. This could potentially lead to the link being misused or hijacked...

5.3CVSS7AI score0.01222EPSS
SaveExploits0References5Affected Software1
OSV
OSV
added 2024/08/12 3:30 p.m.22 views

GHSA-GVPV-R32V-9737 Apache Answer: The link to reset the user's password will remain valid after sending a new link

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. User sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused o...

6.3CVSS5.2AI score0.01149EPSS
SaveExploits0References5
Github Security Blog
Github Security Blog
added 2024/08/12 3:30 p.m.28 views

Apache Answer: The link to reset the user's password will remain valid after sending a new link

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. User sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused o...

5.3CVSS7AI score0.01149EPSS
SaveExploits0References5Affected Software1
NVD
NVD
added 2024/08/12 1:38 p.m.30 views

CVE-2024-41888

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. The password reset link remains valid within its expiration period even after it has been used. This could potentially lead to the link being misused or hijacked...

5.3CVSS0.01222EPSS
SaveExploits0References2
NVD
NVD
added 2024/08/12 1:38 p.m.29 views

CVE-2024-41890

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. User sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused o...

5.3CVSS0.01149EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2024/08/09 2:55 p.m.51 views

CVE-2024-41888 Apache Answer: The link for resetting user password is not Single-Use

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. The password reset link remains valid within its expiration period even after it has been used. This could potentially lead to the link being misused or hijacked...

0.01222EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2024/08/09 2:55 p.m.14 views

CVE-2024-41888 Apache Answer: The link for resetting user password is not Single-Use

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. The password reset link remains valid within its expiration period even after it has been used. This could potentially lead to the link being misused or hijacked...

7.3AI score0.01222EPSS
SaveExploits0References1
CVE
CVE
added 2024/08/09 2:55 p.m.66 views

CVE-2024-41888

The CVE-2024-41888 issue affects Apache Answer through version 1.3.5, where the password-reset link remains valid after use (not single-use), allowing potential misuse or hijacking. The impact is limited to authentication flow abuse as described; affected components are the password reset mechani...

5.3CVSS6.7AI score0.01222EPSS
SaveExploits0References2Affected Software1
OSV
OSV
added 2024/08/09 2:55 p.m.19 views

CVE-2024-41888 Apache Answer: The link for resetting user password is not Single-Use

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. The password reset link remains valid within its expiration period even after it has been used. This could potentially lead to the link being misused or hijacked...

5.3CVSS5.8AI score
SaveExploits0References4
Cvelist
Cvelist
added 2024/08/09 2:53 p.m.36 views

CVE-2024-41890 Apache Answer: The link to reset the user's password will remain valid after sending a new link

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. User sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused o...

0.01149EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2024/08/09 2:53 p.m.21 views

CVE-2024-41890 Apache Answer: The link to reset the user's password will remain valid after sending a new link

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. User sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused o...

7.3AI score0.01149EPSS
SaveExploits0References1
OSV
OSV
added 2024/08/09 2:53 p.m.18 views

CVE-2024-41890 Apache Answer: The link to reset the user's password will remain valid after sending a new link

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. User sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused o...

5.3CVSS5.9AI score
SaveExploits0References4
CVE
CVE
added 2024/08/09 2:53 p.m.80 views

CVE-2024-41890

CVE-2024-41890 affects Apache Answer up to version 1.3.5. The root issue is Missing Release of Resource after Effective Lifetime: password reset links issued in succession can remain valid during the link’s validity period, enabling potential misuse or hijacking of a previously issued link. A fix...

5.3CVSS6.7AI score0.01149EPSS
SaveExploits0References2Affected Software1
Positive Technologies
Positive Technologies
added 2024/08/09 12:0 a.m.6 views

PT-2024-29619 · Apache · Apache Answer

Name of the Vulnerable Software and Affected Versions: Apache Answer versions through 1.3.5 Description: The password reset link remains valid within its expiration period even after it has been used, potentially leading to misuse or hijacking. Recommendations: For Apache Answer versions through...

6.3CVSS7.4AI score0.01222EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
added 2024/08/09 12:0 a.m.7 views

PT-2024-29621 · Apache · Apache Answer

Name of the Vulnerable Software and Affected Versions: Apache Answer versions through 1.3.5 Description: The issue affects Apache Answer, where a user can send multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link...

6.3CVSS7.4AI score0.01149EPSS
SaveExploits0References9
Rows per page
Query Builder