303 matches found
Moodle 4.1 < 4.1.2 Multiple Vulnerabilities
Moodle is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:moodle:moodle"; ifdescription...
CVE-2022-39216 Combodo iTop's weak password reset token leads to account takeover
Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, the reset password token is generated without any randomness parameter. This may lead to account takeover. The issue is fixed in versions 2.7.8 and 3.0.2-1...
SUSE CVE-2019-19844
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address that is equal to an existing user's email address after case transformation of Unicode characters would allow an attacker to be sent a password reset token for the matched user...
CVE-2022-45782
An issue was discovered in dotCMS core 5.3.8.5 through 5.3.8.15 and 21.03 through 22.10.1. A cryptographically insecure random generation algorithm for password-reset token generation leads to account takeover...
CVE-2022-45782
An issue was discovered in dotCMS core 5.3.8.5 through 5.3.8.15 and 21.03 through 22.10.1. A cryptographically insecure random generation algorithm for password-reset token generation leads to account takeover...
CVE-2022-44938
Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack...
Design/Logic Flaw
Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack...
CVE-2022-44938
Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack...
CVE-2022-44938
The CVE-2022-44938 issue concerns SeedDMS v6.0.20 and v5.1.7, where weak reset token generation enables full account takeovers via brute force. According to sources (Red Hat, CNNVD/CVELIST, and vulnerability trackers), the vulnerability stems from insufficient randomness/verification in the accou...
CVE-2022-44938
Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack...
PT-2022-27339 · Seeddms · Seeddms
Name of the Vulnerable Software and Affected Versions: SeedDMS versions 5.1.7 through 6.0.20 Description: The issue is related to weak reset token generation, allowing attackers to execute a full account takeover via a brute force attack. Recommendations: For SeedDMS version 5.1.7, update to a...
phpservermon 安全特征问题漏洞
phpservermon is a script that checks to see if your website and server are up and running. A security vulnerability exists in phpservermon that stems from the generatePasswordResetToken function of its src/psm/Service/User.php component causing the random number generator to use a predictable...
PT-2022-11592 · Unknown · Phpservermon
Name of the Vulnerable Software and Affected Versions: phpservermon affected versions not specified Description: A problematic issue was found in phpservermon, affecting the generatePasswordResetToken function of the file src/psm/Service/User.php. The manipulation leads to the use of a predictabl...
PT-2022-28185 · Unknown · Redwood Dbauth
Name of the Vulnerable Software and Affected Versions: Redwood dbAuth versions 0.38.0 through 3.3.0 Redwood dbAuth versions 0.38.0 through 2.2.4 Description: This issue affects the dbAuth "forgot password" feature in Redwood, allowing a malicious user to obtain a reset token for any user given...
Rocket.Chat SQL注入漏洞
Rocket.Chat, an open source team chat software, is vulnerable to SQL injection, which stems from the application's lack of validation of externally entered SQL statements. An attacker could exploit the vulnerability to retrieve a reset password token via 2fa secret or 2fa secret...
PT-2022-21153 · Unknown · Rocket.Chat
Name of the Vulnerable Software and Affected Versions: Rocket.Chat versions prior to 3.18.6 Rocket.Chat versions prior to 4.4.4 Rocket.Chat versions prior to 4.7.3 Description: A SQL injection issue exists, allowing an attacker to retrieve a reset password token or a 2fa secret. Recommendations:...
CVE-2022-25047
The password reset token in CWP v0.9.8.1126 is generated using known or predictable values...
Snapchat: Password reset tokens sent to CSP reporting endpoints
Description: It has been identified that the application is leaking referrer token to third party sites. In this case it was found that the password reset token is being leaked to third party sites which is a issue knowing the fact that it can allow any malicious users to use the token and reset...
