17 matches found
CVE-2026-109518
A flaw was found in APT. This vulnerability allows an on-path network attacker to achieve arbitrary code execution with administrative root privileges by intercepting package downloads. By manipulating network traffic when a client follows redirects and retries a download, an attacker can exploit...
CVE-2026-109518
An on-path attacker capable of manipulating HTTP traffic can exploit a hard link reuse vulnerability in the APT client on Debian, Ubuntu, and derivative Linux distributions . By tricking the client into following redirects and retrying downloads, an attacker can force the installation of an unver...
CVE-2026-109518 APT RCE via hard link reuse
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic including a malicious mirror or proxy between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified...
EUVD-2026-66218
Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset link can use it up to 2 additional...
Weak Password Recovery Mechanism for Forgotten Password
Overview Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten Password through the loginlink process. An attacker can gain unauthorized access to user accounts by reusing a previously issued password reset link after the password has been changed. Thi...
SUSE CVE-2016-11074
An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused...
CVE-2025-61775
Vickey is a Misskey-based microblogging platform. A vulnerability exists in Vickey prior to version 2025.10.0 where unexpired email confirmation links can be reused multiple times to send repeated confirmation emails to a verified email address. Under certain conditions, a verified email address...
CVE-2025-61775 Vickey's unexpired email confirmation link can be reused to send repeated confirmation emails
Vickey is a Misskey-based microblogging platform. A vulnerability exists in Vickey prior to version 2025.10.0 where unexpired email confirmation links can be reused multiple times to send repeated confirmation emails to a verified email address. Under certain conditions, a verified email address...
CVE-2025-61775
The CVE-2025-61775 entry concerns Vickey, a Misskey-based microblogging platform. A vulnerability exists in Vickey prior to version 2025.10.0 whereby unexpired email confirmation links can be reused multiple times to trigger repeated confirmation emails to a verified address. Under certain condit...
UBUNTU-CVE-2022-23485
Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result...
CVE-2022-23485
Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result...
CVE-2022-23485 Invite code reuse via cookie manipulation in sentry
Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result...
Mobileiron Sentry security vulnerabilities
Mobileiron Sentry is a Smart Gateway product from Mobileiron, Inc. A security vulnerability exists in Mobileiron Sentry versions prior to 22.11.0, where an attacker with a known valid invitation link could manipulate cookies to allow the same invitation link to be reused on multiple accounts when...
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication via the password-reset link. An attacker can gain unauthorized access to user accounts by reusing a previously issued password-reset link. Remediation Upgrade github.com/mattermost/mattermost/model to version 3.0...
GHSA-J26G-95PH-2MWV Mattermost Server: Insufficient Password-Reset Link Invalidation
An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused...
