Cross site request forgery (csrf)

Request Tracker RT 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 does not use a constant-time comparison algorithm for secrets, which makes it easier for remote attackers to obtain sensitive user password information via a timing side-channel attack...

There are loopholes in the design of the password recovery function of the Shunzhang campus informationization platform.

Campus informatization platform is a set of campus education comprehensive application platform developed by Shunzhang Technology with the actual application needs of primary and secondary schools and fully integrating network resources. There is a vulnerability in the design of the password...