CVE-2025-43931

flask-boilerplate through a170e7c allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...

CVE-2025-43930

Hashview 0.8.1 allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...

PT-2025-28176 · Fblog · Fblog

Name of the Vulnerable Software and Affected Versions: fblog versions through 983bede Description: The issue allows account takeover via the password reset feature because the SERVER NAME is not configured, causing the reset to depend on the Host HTTP header. Recommendations: For versions through...

PT-2025-28228 · Ibm · Ibm Engineering Requirements Management Doors

Name of the Vulnerable Software and Affected Versions: IBM Engineering Requirements Management DOORS version 9.7.2.9 Description: The issue allows a remote attacker to obtain password reset instructions of a legitimate user using man-in-the-middle techniques under certain configurations...

PT-2025-28175 · Jobcenter · Jobcenter

Name of the Vulnerable Software and Affected Versions: JobCenter versions through 7e7b0b2 Description: The issue allows for account takeover via the password reset feature. This is because the SERVER NAME is not configured, causing the password reset to depend on the Host HTTP header...

Blog Security Vulnerabilities

Blog is a personal blogging system by the individual developers of Xuzijia in China. A security vulnerability exists in Blog 983bede and prior versions, which stems from an unconfigured SERVERNAME causing the password reset function to rely on the Host HTTP header, which could lead to an account...

flask-boilerplate security vulnerabilities

flask-boilerplate is a Boilerplate template for Python Flask applications open-sourced by Real Python. A security vulnerability exists in version a170e7c of flask-boilerplate, which stems from an improperly configured password reset feature that could lead to account takeover...

Hashview security vulnerability

Hashview is a Hashview open source software for password cracking and analysis. A security vulnerability exists in Hashview version 0.8.1, which stems from a misconfiguration of the password reset feature that could lead to account takeover...

PT-2025-28174 · Pypi · Flask-Boilerplate

Name of the Vulnerable Software and Affected Versions: flask-boilerplate versions through a170e7c Description: The issue allows account takeover via the password reset feature. This is because the SERVER NAME is not configured, and thus the password reset depends on the Host HTTP header...

IBM Engineering Requirements Management DOORS Authorization Issues Vulnerability

IBM Engineering Requirements Management DOORS is a requirements management tool from International Business Machines IBM. An authorization issue vulnerability exists in IBM Engineering Requirements Management DOORS version 9.7.2.9, which stems from a misconfiguration that could lead to a...

CVE-2025-43930

Hashview version 0.8.1 is vulnerable to account takeover via its password reset feature. The root cause is a misconfiguration where the SERVER_NAME is not defined, forcing the application to rely on the Host HTTP header to process reset requests. This allows an attacker to remotely gain unauthori...

CVE-2025-43931

flask-boilerplate through a170e7c allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...

CVE-2025-43933: External Control of Assumed-Immutable Web Parameter

fblog through 983bede allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...

CVE-2025-43930

Hashview 0.8.1 allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...

CVE-2025-6056

Timing difference in password reset in Ergon Informatik AG's Airlock IAM 7.7.9, 8.0.8, 8.1.7, 8.2.4 and 8.3.1 allows unauthenticated attackers to enumerate usernames...

CVE-2025-47227

In the Production Environment extension in Netmake ScriptCase through 9.12.006 23, the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeov...

CVE-2025-47227

In the Production Environment extension in Netmake ScriptCase through 9.12.006 23, the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeov...

CVE-2025-47227

Netmake ScriptCase Production Environment extension (up to 9.12.006) contains a vulnerability in the administrator password reset mechanism. Specifically, GET and POST requests to login.php can bypass authentication, enabling an unauthenticated administrator account takeover. The CVSS=3.1 base sc...

PT-2025-28035

Name of the Vulnerable Software and Affected Versions: Netmake ScriptCase versions 9.12.006 and earlier Description: The issue allows authenticated attackers to execute system commands via crafted HTTP requests due to shell injection in the SSH connection settings. Additionally, there is a...

DEBIAN-CVE-2025-38188

In the Linux kernel, the following vulnerability has been resolved: drm/msm/a7xx: Call CPRESETCONTEXTSTATE Calling this packet is necessary when we switch contexts because there are various pieces of state used by userspace to synchronize between BR and BV that are persistent across submits and w...