CVE-2022-3422 Improper Privilege Management in tooljet/tooljet

Account Takeover :: when see the info i can see the hash pass i can creaked it ............... Account Takeover :: when see the info i can see the forgotpasswordtoken the hacker can send the request and changed the pass...

ToolJet 访问控制错误漏洞

ToolJet is an extensible low-code framework for building business applications from ToolJet. ToolJet suffers from an Access Control Error vulnerability that stems from allowing an attacker via a forgotten password token to be able to take over the account of any comment that can be seen in the...

Pagekit Weak Password Recovery Mechanism for Forgotten Password

An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug toolbar is enabled. The password is successfully recovered using this exploit. The SecureLayer7 ID is SL7PGKT01...

CVE-2022-0777

Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to 1.3...

CVE-2022-0777 Weak Password Recovery Mechanism for Forgotten Password in microweber/microweber

Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to 1.3...

Weak Password Recovery Mechanism for Forgotten Password

Description: There is no rate limit sent unlimited email victim or any email address. Proof of Concept: There is no rate limit return-password , attacker to send unlimited email to victim or any email address. Impact: Attacker can sent unlimited email to any mail address . Solution: Add 'throttle...

forgotten-north.com Cross Site Scripting vulnerability OBB-2380269

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Xwiki Platform licensing issue vulnerability (CNVD-2022-13405)

Xwiki Platform is a wiki platform for creating web collaboration applications from the French company Xwiki. XWiki Platform is vulnerable to an authorization issue, which stems from the fact that even if the wiki is closed to visitors, it is possible to guess whether a user has an account on the...

CVE-2021-46362

A Server-Side Template Injection SSTI vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted payload entered into the fullname parameter...

Sql injection

A Server-Side Template Injection SSTI vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted payload entered into the fullname parameter...

PT-2022-12670 · Magnolia · Magnolia

Name of the Vulnerable Software and Affected Versions: Magnolia versions prior to 6.2.3 Description: A Server-Side Template Injection SSTI issue in the Registration and Forgotten Password forms allows attackers to execute arbitrary code via a crafted payload entered into the fullname parameter...

Xwiki Platform 授权问题漏洞

Xwiki Platform is a wiki platform for creating web collaboration applications from the French company Xwiki. XWiki Platform is vulnerable to an authorization issue, which stems from the fact that even if the wiki is closed to visitors, it is possible to guess whether a user has an account on the...

Schneider Electric Modicon Weak Password Recovery Mechanism for Forgotten Password (CVE-2018-7811)

An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the change password function of the web server This plugin only works with Tenable.ot. Please visit...

Schneider Electric Modicon Weak Password Recovery Mechanism for Forgotten Password (CVE-2018-7809)

An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the password delete function of the web server. This plugin only works with Tenable.ot. Please visit...

Schneider Electric PowerLogic PM55xx and PowerLogic PM8ECC Weak Password Recovery Mechanism For Forgotten Password (CVE-2021-22763)

A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 see security notification for version infromation that could allow an attacker administrator level access to a device. This plug...

CVE-2021-27654

Forgotten password reset functionality for local accounts can be used to bypass local authentication checks...

Default credentials

Forgotten password reset functionality for local accounts can be used to bypass local authentication checks...

Pegasystems Pega 授权问题漏洞

Pegasystems Pega is a Java-based business process management tool from the U.S. company Pegasystems. It is used to build enterprise applications. A security vulnerability exists in Pegasystems Pega, which stems from a forgotten password reset feature for local accounts that can be used to bypass...

Time based username enumeration

Back in the day, it used to be easy to enumerate email addresses from forgotten password forms. Differences in the response made it easy to check if accounts existed. After that, you could brute force the password if there weren’t lockouts in place, or if there were, you could lockout a lot of us...

Weak Password Recovery Mechanism for Forgotten Password

In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password...