437 matches found
[slackware-security] nghttp2
New nghttp2 packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/nghttp2-1.57.0-i586-1slack15.0.txz: Upgraded. This release has a fix to mitigate the HTTP/2 Rapid Reset vulnerability. For more...
Default credentials
All versions of NetMan 204 allow an attacker that knows the MAC and serial number of the device to reset the administrator password via the legitimate recovery function...
CVE-2023-4915 WP User Control <= 1.5.3 - Insecure Password Reset Mechanism
The WP User Control plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.5.3. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function in the WP User Control Widget. The functi...
PT-2023-31069 · WordPress · Wp User Control
Name of the Vulnerable Software and Affected Versions: WP User Control plugin for WordPress versions up to, and including 1.5.3 Description: The issue arises from the plugin's use of native password reset functionality with insufficient validation on the password reset function in the WP User...
Restaurant Booking Script 安全漏洞
Restaurant Booking Script is a restaurant reservation system. A security vulnerability exists in PHPJabbers Restaurant Booking Script version v3.0, which stems from a user enumeration vulnerability during password reset...
Car Rental Script 安全漏洞
Car Rental Script is a vehicle rental script from GZ Script open source. A security vulnerability exists in PHPJabbers Car Rental Script version v3.0, which stems from a user enumeration vulnerability during password reset...
PT-2023-25159 · Weintek · Weintek Weincloud
Name of the Vulnerable Software and Affected Versions: Weintek Weincloud version 0.13.6 Description: The issue allows an attacker to reset a password using the corresponding account's JWT token only. No information is provided about the estimated number of potentially affected devices worldwide o...
CVE-2023-36993
The CVE concerns TravianZ 8.3.4 and 8.3.3 where the password reset function uses a cryptographically insecure random number generator. This root cause permits an attacker to guess password reset parameters and take over accounts. Public sources in connected documents corroborate the same affected...
CVE-2023-26615
D-Link DIR-823G firmware version 1.02B05 has a password reset vulnerability, which originates from the SetMultipleActions API, allowing unauthorized attackers to reset the WEB page management password...
PT-2023-3639 · D Link · D-Link Dir-823G
Name of the Vulnerable Software and Affected Versions: D-Link DIR-823G firmware version 1.02B05 Description: The issue is related to a password reset vulnerability in the D-Link DIR-823G firmware, which stems from errors in the password recovery mechanism. This vulnerability can be exploited by...
PT-2023-3420 · Nextcloud +2 · Nextcloud Enterprise Server +3
Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions 25.0.0 through 25.0.7 Nextcloud Server versions 26.0.0 through 26.0.2 Nextcloud Enterprise Server versions 21.0.0 through 21.0.9.12 Nextcloud Enterprise Server versions 22.0.0 through 22.2.10.12 Nextcloud Enterprise...
CVE-2023-2807 Authentication bypass in password reset process
Authentication Bypass by Spoofing vulnerability in the password reset process of Pandora FMS allows an unauthenticated attacker to initiate a password reset process for any user account without proper authentication. This issue affects PandoraFMS v771 and prior versions on all platforms...
CVE-2023-2434
The Nested Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'reset' function in versions up to, and including, 3.2.3. This makes it possible for authenticated attackers, with editor-level permissions and above, to reset plugin settings...
PT-2023-7824 · Milesight · Milesight 4K/H.265 Series Nvr
Name of the Vulnerable Software and Affected Versions: Milesight 4K/H.265 Series NVR models MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC Description: The issue exists due to a weak password reset mechanism at the Milesight NVR web-based management interface. A remote...
CVE-2023-31287
An issue was discovered in Serenity Serene and StartSharp before 6.7.0. Password reset links are sent by email. A link contains a token that is used to reset the password. This token remains valid even after the password reset and can be used a second time to change the password of the...
CVE-2023-2297 Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset Mechanism
The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 3.9.0. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function...
Gladinet CentreStack 安全漏洞
Gladinet CentreStack is a premier mobile access and secure sharing solution from Gladinet USA. Provides self-hosted cloud storage. A security vulnerability exists in Gladinet CentreStack versions prior to 13.5.9808. An attacker exploited the vulnerability to set a new password for any valid user...
PT-2023-13490 · Zoho · Zoho Manageengine Adselfservice Plus
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADSelfService Plus versions through 6203 Description: The issue allows for a brute-force attack, leading to a password reset on IDM applications. This is a result of a weakness in the password reset mechanism, which can be...
PT-2023-18755 · Smartbear · Smartbear Zephyr Enterprise
Name of the Vulnerable Software and Affected Versions: SmartBear Zephyr Enterprise versions through 7.15.0 Description: The issue is a privilege escalation vulnerability that could be exploited by authorized users to reset passwords for other accounts. Recommendations: For SmartBear Zephyr...
