Touch Lebanon Mobile App 安全漏洞

Touch Lebanon Mobile App is a free application from Touch Lebanon. A security vulnerability exists in Touch Lebanon Mobile App version 2.20.2, which stems from a flaw in the password reset process that could lead to a bypass of the OTP mechanism...

TOTVS Portal Meu RH 输入验证错误漏洞

TOTVS Portal Meu RH is an enterprise management application from TOTVS Brazil. An input validation error vulnerability exists in TOTVS Portal Meu RH version 12.1.17 and earlier, which stems from mishandling of password reset and could lead to open redirection...

CVE-2025-50503

A vulnerability in the password reset workflow of the Touch Lebanon Mobile App 2.20.2 allows an attacker to bypass the OTP reset password mechanism. By manipulating the reset process, an unauthorized user may be able to reset the password and gain access to the account without needing to provide ...

PT-2025-34149

Name of the Vulnerable Software and Affected Versions: Eclipse Jetty versions =9.4.57 Eclipse Jetty versions =10.0.25 Eclipse Jetty versions =11.0.25 Eclipse Jetty versions =12.0.21 Eclipse Jetty version 12.1.0.alpha2 Description: An HTTP/2 client can trigger the server to send RST STREAM frames ...

PT-2025-33902 · Six Apart · Movable Type

Name of the Vulnerable Software and Affected Versions: Movable Type affected versions not specified Description: Movable Type contains an issue with the use of less trusted sources. A remote, unauthenticated attacker may exploit this to send a tampered email for password reset purposes...

CVE-2025-50503

A vulnerability in the password reset workflow of the Touch Lebanon Mobile App 2.20.2 allows an attacker to bypass the OTP reset password mechanism. By manipulating the reset process, an unauthorized user may be able to reset the password and gain access to the account without needing to provide ...

Movable Type 输入验证错误漏洞

Movable Type is a content management system from Movable Type, Inc. A security vulnerability exists in Movable Type that stems from the possibility that invalid parameters may be inserted into the password reset page, resulting in a redirection to an arbitrary URL...

PT-2025-33903 · Six Apart · Movable Type

Name of the Vulnerable Software and Affected Versions: Movable Type affected versions not specified Description: An open redirect issue exists in Movable Type. Exploitation of this issue may allow an attacker to insert an invalid parameter into the password reset page, potentially redirecting use...

PT-2025-33890 · Totvs · Totvs Portal Meu Rh

Name of the Vulnerable Software and Affected Versions: TOTVS Portal Meu RH versions up to 12.1.17 Description: A flaw has been identified in the Password Reset Handler component that may allow for an open redirect. Manipulation of the redirectUrl argument can lead to a redirect to an arbitrary UR...

ALSA-2025:14181 Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat: Apache Tomcat DoS in multipart upload CVE-2025-48988 tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources CVE-2025-49125 apache-commons-fileupload: Apache...

Apache Tomcat Denial of Service Vulnerability (CNVD-2025-19106)

Apache Tomcat is the United States Apache Apache Foundation of a lightweight Web application server for the implementation of Servlet and JavaServer Page JSP support. Apache Tomcat suffers from a denial of service vulnerability due to a forced reset attack in the HTTP/2 implementation. An attacke...

Movable Type 安全漏洞

Movable Type is a content management system from Movable Type, Inc. A security vulnerability exists in Movable Type that stems from the use of a low-trustworthy source, which could lead to a remote, unauthenticated attacker sending a doctored password reset email...

JVN#76729865: Multiple vulnerabilities in Movable Type

Movable Type provided by Six Apart Ltd. contains multiple vulnerabilities listed below. Use of less trusted source（CWE-348） CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Base Score 6.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Base Score 5.3 CVE-2025-53522 Open...

CVE-2025-50503

The CVE-2025-50503 entry concerns Touch Lebanon Mobile App 2.20.2, where a flaw in the password reset workflow enables bypassing the OTP mechanism, potentially allowing an unauthorized user to reset a password and access an account without a legitimate authentication factor. The incident is descr...

PT-2025-34054 · Unknown · Touch Lebanon Mobile App

Name of the Vulnerable Software and Affected Versions: Touch Lebanon Mobile App version 2.20.2 Description: A flaw exists in the password reset workflow that allows an attacker to bypass the one-time password OTP reset password mechanism. By manipulating the reset process, an unauthorized user ma...

CVE-2025-51543

An issue was discovered in Cicool builder 3.4.4 allowing attackers to reset the administrator's password via the /administrator/auth/resetpassword endpoint...

CVE-2025-52338

An issue in the default configuration of the password reset function in LogicData eCommerce Framework v5.0.9.7000 allows attackers to bypass authentication and compromise user accounts via a bruteforce attack...

DEBIAN-CVE-2025-38572

In the Linux kernel, the following vulnerability has been resolved: ipv6: reject malicious packets in ipv6gsosegment syzbot was able to craft a packet with very long IPv6 extension headers leading to an overflow of skb-transportheader. This 16bit field has a limited range. Add...

AZL-66527 CVE-2025-38572 affecting package kernel for versions less than 6.6.104.2-1

In the Linux kernel, the following vulnerability has been resolved: ipv6: reject malicious packets in ipv6gsosegment syzbot was able to craft a packet with very long IPv6 extension headers leading to an overflow of skb-transportheader. This 16bit field has a limited range. Add...

CVE-2025-38572

CVE-2025-38572 affects the Linux kernel IPv6 path, where an attacker could craft IPv6 extension headers to overflow skb->transport_header via ipv6_gso_segment() when processing very long headers. The root cause is related to the 16-bit transport header field handling, with a suggested fix addi...