SUSE-SU-2024:3094-1 Security update for kubernetes1.26

This update for kubernetes1.26 fixes the following issues: Update kubernetes to version 1.26.15: - CVE-2024-24786: Fixed infinite loop in protojson.Unmarshal in golang-protobuf bsc1229867 - CVE-2023-39325: Fixed a flaw that can lead to a DoS due to a rapid stream resets causing excessive work. Th...

PT-2025-2718 · Ibm · Ibm Security Verify Access +1

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Access versions 10.0.0 through 10.0.8 IBM Security Verify Access Docker versions 10.0.0 through 10.0.8 Description: The issue allows an unverified user to change the password of an expired user without prior knowledge of...

PT-2024-30197 · Unknown · Limesurvey

Name of the Vulnerable Software and Affected Versions: LimeSurvey versions 6.6.1+240806 and earlier Description: A Host header injection issue in the password reset function allows attackers to send users a crafted password reset link that directs victims to a malicious domain. This occurs becaus...

UBUNTU-CVE-2024-45231

An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome only...

PT-2024-31489

Name of the Vulnerable Software and Affected Versions Django versions 4.2.16, 5.0.9, and 5.1.1 Description An issue was discovered in the django.contrib.auth.forms.PasswordResetForm class, which allows remote attackers to enumerate user e-mail addresses by sending password reset requests and...

CVE-2024-42903

CVE-2024-42903 affects LimeSurvey before 6.6.1+240806, where the password reset feature is vulnerable to host header injection. The issue allows an attacker to craft a reset link that could direct victims to a malicious domain due to insufficient Host header validation. Affected component: passwo...

CVE-2024-42903

A Host header injection vulnerability in the password reset function of LimeSurvey v.6.6.1+240806 and before allows attackers to send users a crafted password reset link that will direct victims to a malicious domain...

LimeSurvey 安全漏洞

LimeSurvey PHPSurveyor is an open source online survey program from the LimeSurvey team that supports survey program development, survey posting, and data collection. A security vulnerability exists in LimeSurvey version v.6.6.1+240806 and prior versions, which stems from a host header injection...

CVE-2024-42903

A Host header injection vulnerability in the password reset function of LimeSurvey v.6.6.1+240806 and before allows attackers to send users a crafted password reset link that will direct victims to a malicious domain...

CVE-2024-42903

A Host header injection vulnerability in the password reset function of LimeSurvey v.6.6.1+240806 and before allows attackers to send users a crafted password reset link that will direct victims to a malicious domain...

CVE-2024-45231

An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome only...

CVE-2024-45522

Linen before cd37c3e does not verify that the domain is linen.dev or www.linen.dev when resetting a password. This occurs in create in apps/web/pages/api/forgot-password/index.ts...

WordPress Easy WP SMTP Password Reset

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress Easy WP SMTP Password Reset', 'Description' = %q Wordpress plugin Easy WP SMTP versions 'h00die', msf module this was an 0day , 'Licens...

CVE-2024-45522

Linen before cd37c3e does not verify that the domain is linen.dev or www.linen.dev when resetting a password. This occurs in create in apps/web/pages/api/forgot-password/index.ts...

BMC TrackIt! Unauthenticated Arbitrary User Password Change

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'BMC TrackIt! Unauthenticated Arbitrary User Password Change', 'Description' = %q This module exploits a flaw in the password reset mechanism in B...

CVE-2024-45522

Linen before cd37c3e does not verify that the domain is linen.dev or www.linen.dev when resetting a password. This occurs in create in apps/web/pages/api/forgot-password/index.ts...

Rosewill RXS-3211 IP Camera Password Retriever

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Rosewill RXS-3211 IP Camera Password Retriever', 'Description' = %q This module takes advantage of a protocol design issue with the Rosewill admi...

CVE-2024-45522

Linen before cd37c3e does not verify that the domain is linen.dev or www.linen.dev when resetting a password. This occurs in create in apps/web/pages/api/forgot-password/index.ts...

Cambium EPMP 1000 Account Password Reset

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cambium ePMP 1000 Account Password Reset', 'Description' = % This module exploits an access control vulnerability in Cambium ePMP device manageme...

Linen 安全漏洞

Linen is a community-based, lightweight Google searchable Slack alternative to Linen open source. A security vulnerability exists in versions prior to Linen cd37c3e that stems from improper domain validation when resetting passwords...