Rocky Linux 8 [CIQ] Security Update: grafana / grafana-debuginfo Multiple Vulnerabilities (crlsa-2023_5863)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20235863 advisory. grafana: golang: net/http, x/net/http2: rapid stream resets can cause excessive work CVE-2023-39325 HTTP/2: Multiple HTTP/2 enabled web servers are...

Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2024_1444)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20241444 advisory. nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks CVE-2024-22019 nodejs: HTTP/2: Multiple HTTP/2 enabled web serve...

Rocky Linux 9 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-docs / etc (crlsa-2023_5765)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20235765 advisory. nodejs: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 A Rocky Enterprise Software Foundation Securit...

Rocky Linux 9 [CIQ] Security Update: libnghttp2 / libnghttp2-debuginfo / libnghttp2-devel / nghttp2 / etc (crlsa-2023_5838)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20235838 advisory. HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 Tenable has extracted the preceding description block...

Rocky Linux 9 [CIQ] Security Update: varnish / varnish-devel / varnish-docs (crlsa-2023_5924)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20235924 advisory. HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 Tenable has extracted the preceding description block...

CVE-2026-102115

Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then...

CVE-2026-102115 Kiteworks Core Authentication Bypass in the Password Reset Workflow

Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then...

CVE-2026-102115 Kiteworks Core Authentication Bypass in the Password Reset Workflow

Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then...

CVE-2026-102115

Kiteworks Core is vulnerable to an authentication bypass in its password reset workflow due to insufficient validation of a submitted parameter. An unauthenticated attacker who possesses a user's email address can reset the account's password without needing access to the emailed reset link. This...

CVE-2026-36438

CVE-2026-36438: パスワードリセットを介した機密情報 Intelbras VIP 1230 B/D G4 のバージョン6未満では、リモートの攻撃者がOutsideCmdファイル下のパスワードリセット機能を介して管理者アカウントの機密情報を取得できます。 Henrique Koji により発見, 2026年2月。 参照: https://backend.intelbras.com/sites/default/files/2026-03/Changelog%20%E2%80%93%20VIP%201230%20B-D%20G4.pdf...

CVE-2026-100255

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset...

EUVD-2026-90004

In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset...

CVE-2026-100255

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset...

EUVD-2026-89999

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset...

CVE-2026-100255

JetBrains TeamCity versions prior to 2026.2 , 2026.1.4 , and 2025.11.8 are vulnerable to an administrator account takeover . The root cause is identified as Improper Validation of Unsafe Equivalence in Input (CWE-1289), which specifically allowed for account takeover via the password reset functi...

CVE-2026-100255

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset...

CVE-2025-63314

CVE-2025-63314 - Acora CMS におけるパスワードリセットトークン処理の不備 Crowe India の Joby Y Daniel によって発見されました 📌 概要 DDSN Interactive cm3 Acora CMS バージョン 10.7.1 には、パスワードリセット機能にセキュリティ上の脆弱性が存在します。 このアプリケーションは、使用後に無効化されず、時間の経過によっても失効しない、静的かつ永続的なパスワードリセットトークンを使用します。 この欠陥により、有効なリセットトークンを入手した攻撃者は、そのトークンを無期限に再利用でき、特権ユーザーアカウン...

CVE-2026-102586

A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting XSS attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary...

UBUNTU-CVE-2026-102586

A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting XSS attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary...

CVE-2026-102586

A flaw exists in Moodle where insufficient sanitization of username input on the password reset page enables a remote cross-site scripting (XSS) attack. An attacker can execute arbitrary script in a victim's browser by tricking an unauthenticated user into clicking a specially crafted password re...