YesWiki 加密问题漏洞

YesWiki is a wiki system written in PHP by the French organization YesWiki. It is used to create and manage websites in a collaborative manner. A cryptographic issue vulnerability exists in versions of YesWiki prior to 4.4.5, which uses a weak encryption algorithm and hardcoding to hash a passwor...

Press 授权问题漏洞

Press is a Frappe open source Frappe custom application running Frappe Cloud. Press suffers from an authorization issue vulnerability that stems from allowing anyone with the right to bypass 2FA access to a mailbox to reset the password...

CVE-2024-48573

A NoSQL injection vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to reset user and administrator account passwords via the "Reset password" feature...

CVE-2024-48573

A NoSQL injection vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to reset user and administrator account passwords via the "Reset password" feature...

AquilaCMS 安全漏洞

AquilaCMS is a complete multipurpose open source CMS from the AquilaCMS team. A security vulnerability exists in AquilaCMS version 1.409.20 and prior versions, which stems from the Reset password feature containing a SQL injection vulnerability...

CVE-2024-48573

CVE-2024-48573 affects AquilaCMS 1.409.20 and earlier. The connected documents corroborate a vulnerability in the Reset password feature allowing unauthenticated password resets (NoSQL injection per NVD) with high impact (C/H/I/A = 9.8). Public materials mention exploitation activity (e.g., Explo...

CVE-2024-48573

A NoSQL injection vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to reset user and administrator account passwords via the "Reset password" feature...

Fortinet Fortigate CVE-2004-0230 Blind Reset Attack Using the RST/SYN Bit (FG-IR-16-039)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-16-039 advisory. - TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of...

Admin account takeover through weak Pseudo-Random number generator used in generating password reset codes

This report is not public...

PT-2024-39733 · WordPress · Wpschoolpress

Name of the Vulnerable Software and Affected Versions: The School Management System – WPSchoolPress plugin for WordPress versions up to, and including, 2.2.10 Description: The issue is related to privilege escalation via account takeover. This occurs because the plugin does not properly validate ...

Autolab Misconfigured Reset Password Permissions

Impact For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their passwords. Patches This is fixed in v3.0.1. Workarounds No workarounds. For more information If you have any questions or comments about this...

GHSA-V46J-H43H-RWRM Autolab Misconfigured Reset Password Permissions

Impact For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their passwords. Patches This is fixed in v3.0.1. Workarounds No workarounds. For more information If you have any questions or comments about this...

CVE-2024-48428

An issue in Olive VLE allows an attacker to obtain sensitive information via the reset password function...

CVE-2024-49376

Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their...

CVE-2024-49376 Autolab Has Misconfigured Reset Password Permissions

Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their...

CVE-2024-49376

Autolab CVE-2024-49376 affects version 3.0.0 and involves a misconfiguration of reset password permissions for email-based accounts. The issue could allow users with insufficient privileges to reset passwords and potentially access privileged users’ accounts. It is fixed in version 3.0.1. Remedia...

CVE-2024-49376 Autolab Has Misconfigured Reset Password Permissions

Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their...

CVE-2024-49376 Autolab Has Misconfigured Reset Password Permissions

Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their...

CVE-2024-9302

The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.3.7. This is due to the verifyotpforgotpassword and updatepassword functions not having enough controls to preve...

CVE-2024-9302

CVE-2024-9302 affects the WordPress plugin App Builder – Create Native Android & iOS Apps On The Flight, versions up to 5.3.7. The vulnerability enables privilege escalation/account takeover via weak OTP handling in verify_otp_forgot_password() and update_password(), allowing unauthenticated atta...