CVE-2024-39597

SAP Commerce contains an authorization issue where an attacker can abuse the Forgot Password flow to gain access to a Composable Storefront B2B site with early login/registration enabled, without merchant approval. If the site is not configured as isolated, access may extend to other non-isolated...

PT-2024-28548 · Sap · Sap Commerce

Name of the Vulnerable Software and Affected Versions: SAP Commerce affected versions not specified Description: A user can misuse the forgotten password functionality to gain access to a Composable Storefront B2B site for which early login and registration is activated, without requiring the...

The vulnerability of the “Forgotten Password” function on the IIoT platform of ifm Moneo devices, including IFM QHA300, IFM QHA210, and IFM QVA200, allows a hacker to change the administrator password.

The vulnerability of the “Forgotten Password” function on the IIoT platform of ifm Moneo devices, namely IFM QHA300, IFM QHA210, and IFM QVA200, is related to the lack of a password recovery mechanism. Exploiting this vulnerability could allow an attacker to remotely change the administrator’s...

forgotten-paradise.org Cross Site Scripting vulnerability OBB-3926557

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

ROS-20240404-01

A vulnerability in the Grafana web-based data submission tool is related to authentication bypass via spoofing. Exploitation of the vulnerability could allow an attacker acting remotely to gain full access to a user's account A vulnerability in the Grafana monitoring and surveillance platform is...

HTTP Header Injection

FullStackHero.WebAPI.Boilerplate is vulnerable to HTTP Header Injection. The vulnerability is due to insufficient input validation in the forgotten password functionality. This allows an attacker to manipulate the host header and leak sensitive information...

CVE-2024-24903

Dell Secure Connect Gateway SCG Policy Manager, version 5.10+, contain a weak password recovery mechanism for forgotten passwords. An adjacent network low privileged attacker could potentially exploit this vulnerability, leading to unauthorized access to the application with privileges of the...

PT-2024-19001 · Unknown · Rubygems.Org

Name of the Vulnerable Software and Affected Versions: Rubygems.org affected versions not specified Description: The issue concerns a workaround on the forgotten password form of Rubygems.org, which allows an attacker to bypass the Multi-Factor Authentication MFA requirement. Normally, users with...

CVE-2023-42481

In SAP Commerce Cloud - versions HYCOM 1905, HYCOM 2005, HYCOM2105, HYCOM 2011, HYCOM 2205, COMCLOUD 2211, a locked B2B user can misuse the forgotten password functionality to un-block his user account again and re-gain access if SAP Commerce Cloud - Composable Storefront is used as storefront, d...

Default credentials

In SAP Commerce Cloud - versions HYCOM 1905, HYCOM 2005, HYCOM2105, HYCOM 2011, HYCOM 2205, COMCLOUD 2211, a locked B2B user can misuse the forgotten password functionality to un-block his user account again and re-gain access if SAP Commerce Cloud - Composable Storefront is used as storefront, d...

CVE-2023-42481 Improper Access Control vulnerability in SAP Commerce Cloud

In SAP Commerce Cloud - versions HYCOM 1905, HYCOM 2005, HYCOM2105, HYCOM 2011, HYCOM 2205, COMCLOUD 2211, a locked B2B user can misuse the forgotten password functionality to un-block his user account again and re-gain access if SAP Commerce Cloud - Composable Storefront is used as storefront, d...

PT-2023-28366 · Sap · Sap Commerce Cloud

Name of the Vulnerable Software and Affected Versions: SAP Commerce Cloud versions HY COM 1905 through HY COM 2205, COM CLOUD 2211 Description: A locked B2B user can misuse the forgotten password functionality to un-block their user account again and re-gain access if SAP Commerce Cloud -...

CVE-2023-5840 Weak Password Recovery Mechanism for Forgotten Password in linkstackorg/linkstack

Weak Password Recovery Mechanism for Forgotten Password in GitHub repository linkstackorg/linkstack prior to v4.2.9...

CVE-2023-5840 Weak Password Recovery Mechanism for Forgotten Password in linkstackorg/linkstack

Weak Password Recovery Mechanism for Forgotten Password in GitHub repository linkstackorg/linkstack prior to v4.2.9...

LinkStack Authorization Issues Vulnerability

LinkStack is a unique platform from LinkStack Open Source that provides an efficient solution for managing and sharing links online. An authorization issue vulnerability exists in versions prior to LinkStack v4.2.9 that stems from the absence of a weak password recovery mechanism for forgotten...

PT-2023-32372 · Linkstack · Linkstack

Name of the Vulnerable Software and Affected Versions: linkstack versions prior to 4.2.9 Description: The issue concerns a weak password recovery mechanism for forgotten passwords. Recommendations: For versions prior to 4.2.9, update to version 4.2.9 or later to resolve the issue...

The vulnerability of the “Forgotten Password” function of the Mendix software platform for deploying and testing software applications, which allows a perpetrator to execute a brute-force attack.

The vulnerability of the “Forgotten Password” function in the Mendix software deployment and application testing platform is related to its non-persistent execution time. Exploiting this vulnerability allows a malicious actor to execute an attack using brute-force methods...

CVE-2023-34357

Soar Cloud Ltd. HR Portal has a weak Password Recovery Mechanism for Forgotten Password. The reset password link sent out through e-mail, and the link will remain valid after the password has been reset and after the expected expiration date. An attacker with access to the browser history or has...

CVE-2023-34357 Soar Cloud Ltd. HR Portal - Weak Password Recovery Mechanism for Forgotten Password

Soar Cloud Ltd. HR Portal has a weak Password Recovery Mechanism for Forgotten Password. The reset password link sent out through e-mail, and the link will remain valid after the password has been reset and after the expected expiration date. An attacker with access to the browser history or has...

CVE-2023-34357

Soar Cloud Ltd. HR Portal is affected by CVE-2023-34357 due to a weak password recovery mechanism: the password-reset link sent by email remains valid after a reset and past its expiration, enabling an attacker who can access the link (e.g., via browser history) to reuse it and change the passwor...