Schneider Electric PowerLogic PM55xx and PowerLogic PM8ECC Weak Password Recovery Mechanism For Forgotten Password (CVE-2021-22763)

A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 see security notification for version infromation that could allow an attacker administrator level access to a device. This plug...

Schneider Electric Modicon Weak Password Recovery Mechanism for Forgotten Password (CVE-2018-7809)

An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the password delete function of the web server. This plugin only works with Tenable.ot. Please visit...

CVE-2021-27654

Forgotten password reset functionality for local accounts can be used to bypass local authentication checks...

Default credentials

Forgotten password reset functionality for local accounts can be used to bypass local authentication checks...

Pegasystems Pega 授权问题漏洞

Pegasystems Pega is a Java-based business process management tool from the U.S. company Pegasystems. It is used to build enterprise applications. A security vulnerability exists in Pegasystems Pega, which stems from a forgotten password reset feature for local accounts that can be used to bypass...

Time based username enumeration

Back in the day, it used to be easy to enumerate email addresses from forgotten password forms. Differences in the response made it easy to check if accounts existed. After that, you could brute force the password if there weren’t lockouts in place, or if there were, you could lockout a lot of us...

Weak Password Recovery Mechanism for Forgotten Password

In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password...

CVE-2021-25957

In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password...

CVE-2021-22763

A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 see security notification for version infromation that could allow an attacker administrator level access to a device...

CVE-2021-22763

A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 see security notification for version infromation that could allow an attacker administrator level access to a device...

CVE-2021-22763

A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 see security notification for version infromation that could allow an attacker administrator level access to a device...

PT-2021-15201

Name of the Vulnerable Software and Affected Versions PowerLogic PM55xx affected versions not specified PowerLogic PM8ECC affected versions not specified PowerLogic EGX100 affected versions not specified PowerLogic EGX300 affected versions not specified Description A Weak Password Recovery...

CVE-2020-13859

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. A format error in /etc/shadow, coupled with a logic bug in the LuCI - OpenWrt Configuration Interface framework, allows the undocumented system account mofidev to login to the cgi-bin/luci/quick/wizard management interfac...

CVE-2020-13859

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. A format error in /etc/shadow, coupled with a logic bug in the LuCI - OpenWrt Configuration Interface framework, allows the undocumented system account mofidev to login to the cgi-bin/luci/quick/wizard management interfac...

Design/Logic Flaw

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. A format error in /etc/shadow, coupled with a logic bug in the LuCI - OpenWrt Configuration Interface framework, allows the undocumented system account mofidev to login to the cgi-bin/luci/quick/wizard management interfac...

CVE-2020-13859

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. A format error in /etc/shadow, coupled with a logic bug in the LuCI - OpenWrt Configuration Interface framework, allows the undocumented system account mofidev to login to the cgi-bin/luci/quick/wizard management interfac...

CVE-2021-3118

EVOLUCARE ECSIMAGING aka ECS Imaging through 6.21.5 has multiple SQL Injection issues in the login form and the password-forgotten form such as /reqpassworduser.php?email=. This allows an attacker to steal data in the database and obtain access to the application. The database component runs as...

Sql injection

UNSUPPORTED WHEN ASSIGNED EVOLUCARE ECSIMAGING aka ECS Imaging through 6.21.5 has multiple SQL Injection issues in the login form and the password-forgotten form such as /reqpassworduser.php?email=. This allows an attacker to steal data in the database and obtain access to the application. The...

CVE-2021-3118

EVOLUCARE ECSIMAGING aka ECS Imaging through 6.21.5 has multiple SQL Injection issues in the login form and the password-forgotten form such as /reqpassworduser.php?email=. This allows an attacker to steal data in the database and obtain access to the application. The database component runs as...

CVE-2021-3118

EVOLUCARE ECSIMAGING (aka ECS Imaging) vulnerable up to version 6.21.5 due to multiple SQL Injection flaws in the login form and the password-forgotten form (e.g., /req_password_user.php?email=). The database component runs as root, enabling data theft and potential full access to the application...