Search
Total
58 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-0186 | 1 Huiran Host Reseller System Project | 1 Huiran Host Reseller System | 2024-01-08 | N/A | 8.1 HIGH |
| A vulnerability classified as problematic has been found in HuiRan Host Reseller System up to 2.0.0. Affected is an unknown function of the file /user/index/findpass?do=4 of the component HTTP POST Request Handler. The manipulation leads to weak password recovery. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249444. | |||||
| CVE-2023-49097 | 1 Zitadel | 1 Zitadel | 2023-12-08 | N/A | 8.8 HIGH |
| ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this header is overwritten and a user clicks the link to a malicious site in the email, the secret code can be retrieved and used to reset the users password and take over his account. Accounts with MFA or Passwordless enabled can not be taken over by this attack. This issue has been patched in versions 2.41.6, 2.40.10 and 2.39.9. | |||||
| CVE-2023-47107 | 1 Thm | 1 Pilos | 2023-11-16 | N/A | 8.8 HIGH |
| PILOS is an open source front-end for BigBlueButton servers with a built-in load balancer. The password reset component deployed within PILOS uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to PILOS users when so that it points to the attackers server thereby disclosing the password reset token if/when the link is followed. This only affects local user accounts and requires the password reset option to be enabled. This issue has been patched in version 2.3.0. | |||||
| CVE-2022-26872 | 1 Ami | 1 Megarac Sp-x | 2023-07-31 | N/A | 8.8 HIGH |
| AMI Megarac Password reset interception via API | |||||
| CVE-2022-29174 | 1 Count | 1 Countly Server | 2022-05-30 | 6.8 MEDIUM | 8.1 HIGH |
| countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor who knows an account email address/username and full name specified in the database is capable of guessing the password reset token. The actor may use this information to reset the password and take over the account. The problem has been patched in Countly Server version 22.03.7 for servers using the new user interface and in 21.11.4 for servers using the old user interface. | |||||
| CVE-2022-29933 | 1 Craftcms | 1 Craft Cms | 2022-05-18 | 6.8 MEDIUM | 8.8 HIGH |
| Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must send X-Forwarded-Host to the /index.php?p=admin/actions/users/send-password-reset-email URI. NOTE: the vendor's position is that a customer can already work around this by adjusting the configuration (i.e., by not using the default configuration). | |||||
| CVE-2022-24892 | 1 Shopware | 1 Shopware | 2022-05-10 | 6.8 MEDIUM | 7.5 HIGH |
| Shopware is an open source e-commerce software platform. Starting with version 5.0.4 and before version 5.7.9, multiple tokens for password reset can be requested. All tokens can be used to change the password. This makes it possible for an attacker to take over the victim's account if they somehow gain access to the victims email account and find an unused password reset token in the emails. This issue is fixed in version 5.7.9. | |||||
| CVE-2022-23619 | 1 Xwiki | 1 Xwiki | 2022-02-15 | 5.0 MEDIUM | 7.5 HIGH |
| XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to guest users. This problem has been patched on XWiki 12.10.9, 13.4.1 and 13.6RC1. Users are advised yo update. There are no known workarounds for this issue. | |||||
| CVE-2021-27654 | 1 Pega | 1 Infinity | 2022-02-03 | 4.6 MEDIUM | 7.8 HIGH |
| Forgotten password reset functionality for local accounts can be used to bypass local authentication checks. | |||||
| CVE-2021-44037 | 1 Teampasswordmanager | 1 Team Password Manager | 2021-11-22 | 5.0 MEDIUM | 7.5 HIGH |
| Team Password Manager (aka TeamPasswordManager) before 10.135.236 allows password-reset poisoning. | |||||
| CVE-2021-25961 | 1 Salesagility | 1 Suitecrm | 2021-10-07 | 6.0 MEDIUM | 8.0 HIGH |
| In “SuiteCRM” application, v7.1.7 through v7.10.31 and v7.11-beta through v7.11.20 fail to properly invalidate password reset links that is associated with a deleted user id, which makes it possible for account takeover of any newly created user with the same user id. | |||||
| CVE-2021-37693 | 1 Discourse | 1 Discourse | 2021-08-30 | 5.0 MEDIUM | 7.5 HIGH |
| Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta4, when adding additional email addresses to an existing account on a Discourse site an email token is generated as part of the email verification process. Deleting the additional email address does not invalidate an unused token which can then be used in other contexts, including reseting a password. | |||||
| CVE-2021-25957 | 1 Dolibarr | 1 Dolibarr | 2021-08-24 | 6.5 MEDIUM | 8.8 HIGH |
| In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password. | |||||
| CVE-2021-36804 | 1 Akaunting | 1 Akaunting | 2021-08-13 | 5.8 MEDIUM | 8.1 HIGH |
| Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a running Akaunting instance, if that attacker knows the target's e-mail address. This issue was fixed in version 2.1.13 of the product. Please note that this issue is ultimately caused by the defaults provided by the Laravel framework, specifically how proxy headers are handled with respect to multi-tenant implementations. In other words, while this is not technically a vulnerability in Laravel, this default configuration is very likely to lead to practically identical identical vulnerabilities in Laravel projects that implement multi-tenant applications. | |||||
| CVE-2021-36708 | 1 Prolink | 2 Prc2402m, Prc2402m Firmware | 2021-08-12 | 5.0 MEDIUM | 7.5 HIGH |
| In ProLink PRC2402M V1.0.18 and older, the set_sys_init function in the login.cgi binary allows an attacker to reset the password to the administrative interface of the router. | |||||
| CVE-2021-33321 | 1 Liferay | 2 Dxp, Liferay Portal | 2021-08-11 | 5.0 MEDIUM | 7.5 HIGH |
| Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should be defaulted to true. | |||||
| CVE-2020-5899 | 1 F5 | 1 Nginx Controller | 2021-07-21 | 4.6 MEDIUM | 7.8 HIGH |
| In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an attacker who can intercept the database connection or have read access to the database, to request a password reset using the email address of another registered user then retrieve the recovery code. | |||||
| CVE-2020-26061 | 1 Clickstudios | 1 Passwordstate | 2021-07-21 | 5.0 MEDIUM | 7.5 HIGH |
| ClickStudios Passwordstate Password Reset Portal prior to build 8501 is affected by an authentication bypass vulnerability. The ResetPassword function does not validate whether the user has successfully authenticated using security questions. An unauthenticated, remote attacker can send a crafted HTTP request to the /account/ResetPassword page to set a new password for any registered user. | |||||
| CVE-2020-15949 | 1 Immuta | 1 Immuta | 2021-07-21 | 5.0 MEDIUM | 7.5 HIGH |
| Immuta v2.8.2 is affected by one instance of insecure permissions that can lead to user account takeover. | |||||
| CVE-2021-31912 | 1 Jetbrains | 1 Teamcity | 2021-05-17 | 6.8 MEDIUM | 8.8 HIGH |
| In JetBrains TeamCity before 2020.2.3, account takeover was potentially possible during a password reset. | |||||
| CVE-2021-28128 | 1 Strapi | 1 Strapi | 2021-05-14 | 5.5 MEDIUM | 8.1 HIGH |
| In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password. | |||||
| CVE-2017-9543 | 1 Echatserver | 1 Easy Chat Server | 2021-03-26 | 5.0 MEDIUM | 7.5 HIGH |
| register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1 allows remote attackers to reset arbitrary passwords via a crafted POST request to registresult.htm. | |||||
| CVE-2021-29080 | 1 Netgear | 32 Cbr40, Cbr40 Firmware, R6900p and 29 more | 2021-03-24 | 4.8 MEDIUM | 8.1 HIGH |
| Certain NETGEAR devices are affected by password reset by an unauthenticated attacker. This affects RBK852 before 3.2.10.11, RBK853 before 3.2.10.11, RBR854 before 3.2.10.11, RBR850 before 3.2.10.11, RBS850 before 3.2.10.11, CBR40 before 2.5.0.10, R7000 before 1.0.11.116, R6900P before 1.3.2.126, R7900 before 1.0.4.38, R7960P before 1.4.1.66, R8000 before 1.0.4.66, R7900P before 1.4.1.66, R8000P before 1.4.1.66, RAX75 before 1.0.3.102, RAX80 before 1.0.3.102, and R7000P before 1.3.2.126. | |||||
| CVE-2020-5361 | 1 Dell | 1 Cpg Bios | 2021-01-29 | 7.2 HIGH | 7.6 HIGH |
| Select Dell Client Commercial and Consumer platforms support a BIOS password reset capability that is designed to assist authorized customers who forget their passwords. Dell is aware of unauthorized password generation tools that can generate BIOS recovery passwords. The tools, which are not authorized by Dell, can be used by a physically present attacker to reset BIOS passwords and BIOS-managed Hard Disk Drive (HDD) passwords. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability to bypass security restrictions for BIOS Setup configuration, HDD access and BIOS pre-boot authentication. | |||||
| CVE-2017-5594 | 1 Pagekit | 1 Pagekit | 2021-01-08 | 4.3 MEDIUM | 7.5 HIGH |
| An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug toolbar is enabled. The password is successfully recovered using this exploit. The SecureLayer7 ID is SL7_PGKT_01. | |||||
| CVE-2020-28186 | 1 Terra-master | 1 Tos | 2020-12-28 | 6.8 MEDIUM | 7.3 HIGH |
| Email Injection in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to abuse the forget password functionality and achieve account takeover. | |||||
| CVE-2016-7038 | 1 Moodle | 1 Moodle | 2020-12-01 | 5.0 MEDIUM | 7.3 HIGH |
| In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed. | |||||
| CVE-2020-25728 | 1 Alfresco | 1 Reset Password | 2020-09-25 | 6.5 MEDIUM | 8.8 HIGH |
| The Reset Password add-on before 1.2.0 for Alfresco has a broken algorithm (involving an increment) that allows a malicious user to change any user's account password include the admin account. | |||||
| CVE-2017-7615 | 1 Mantisbt | 1 Mantisbt | 2020-09-18 | 6.5 MEDIUM | 8.8 HIGH |
| MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php. | |||||
| CVE-2020-14015 | 1 Naviwebs | 1 Navigate Cms | 2020-06-29 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Navigate CMS 2.9 r1433. When performing a password reset, a user is emailed an activation code that allows them to reset their password. There is, however, a flaw when no activation code is supplied. The system will allow an unauthorized user to continue setting a password, even though no activation code was supplied, setting the password for the most recently created user in the system (the user with the highest user id). | |||||
| CVE-2020-11027 | 2 Debian, Wordpress | 2 Debian Linux, Wordpress | 2020-05-11 | 5.5 MEDIUM | 8.1 HIGH |
| In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33). | |||||
| CVE-2019-3787 | 1 Pivotal Software | 1 Cloud Foundry Uaa-release | 2020-02-10 | 4.3 MEDIUM | 8.8 HIGH |
| Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads to attack vectors including password recovery emails sent to a potentially fraudulent address. This would allow the attacker to gain complete control of the user's account. | |||||
| CVE-2009-5025 | 1 Pyforum Project | 1 Pyforum | 2020-01-23 | 5.0 MEDIUM | 7.5 HIGH |
| A backdoor (aka BMSA-2009-07) was found in PyForum v1.0.3 where an attacker who knows a valid user email could force a password reset on behalf of that user. | |||||
| CVE-2019-20004 | 1 Intelbras | 2 Iwr 3000n, Iwr 3000n Firmware | 2020-01-14 | 4.3 MEDIUM | 8.8 HIGH |
| An issue was discovered on Intelbras IWR 3000N 1.8.7 devices. When the administrator password is changed from a certain client IP address, administrative authorization remains available to any client at that IP address, leading to complete control of the router. | |||||
| CVE-2018-8916 | 1 Synology | 1 Diskstation Manager | 2019-10-09 | 4.0 MEDIUM | 8.8 HIGH |
| Unverified password change vulnerability in Change Password in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to reset password without verification. | |||||
| CVE-2017-14005 | 1 Prominent | 2 Multiflex M10a Controller, Multiflex M10a Controller Firmware | 2019-10-09 | 6.5 MEDIUM | 8.8 HIGH |
| An Unverified Password Change issue was discovered in ProMinent MultiFLEX M10a Controller web interface. When setting a new password for a user, the application does not require the user to know the original password. An attacker who is authenticated could change a user's password, enabling future access and possible configuration changes. | |||||
| CVE-2017-12161 | 1 Keycloak | 1 Keycloak | 2019-10-09 | 4.3 MEDIUM | 8.8 HIGH |
| It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request. An attacker could use this flaw to craft a malicious password reset request and gain a valid reset token, leading to information disclosure or further attacks. | |||||
| CVE-2017-8613 | 1 Microsoft | 1 Azure Active Directory Connect | 2019-10-03 | 6.8 MEDIUM | 8.1 HIGH |
| Azure AD Connect Password writeback, if misconfigured during enablement, allows an attacker to reset passwords and gain unauthorized access to arbitrary on-premises AD privileged user accounts aka "Azure AD Connect Elevation of Privilege Vulnerability." | |||||
| CVE-2019-12943 | 1 Ttlock | 1 Ttlock | 2019-09-12 | 2.6 LOW | 8.1 HIGH |
| TTLock devices do not properly restrict password-reset attempts, leading to incorrect access control and disclosure of sensitive information about valid account names. | |||||
| CVE-2018-1000812 | 1 Artica | 1 Integria Ims | 2019-08-16 | 4.3 MEDIUM | 8.1 HIGH |
| Artica Integria IMS version 5.0 MR56 Package 58, likely earlier versions contains a CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability in Password recovery process, line 45 of general/password_recovery.php that can result in IntegriaIMS web app user accounts can be taken over. This attack appear to be exploitable via Network access to IntegriaIMS web interface . This vulnerability appears to have been fixed in fixed in versions released after commit f2ff0ba821644acecb893483c86a9c4d3bb75047. | |||||
| CVE-2019-10270 | 1 Ultimatemember | 1 Ultimate Member | 2019-06-24 | 4.0 MEDIUM | 8.8 HIGH |
| An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible (due to lack of verification and correlation between the reset password key sent by mail and the user_id parameter) to reset the password of another user. One only needs to know the user_id, which is publicly available. One just has to intercept the password modification request and modify user_id. It is possible to modify the passwords for any users or admin WordPress Ultimate Members. This could lead to account compromise and privilege escalation. | |||||
| CVE-2019-11414 | 1 Intelbras | 2 Iwr 3000n, Iwr 3000n Firmware | 2019-04-22 | 4.3 MEDIUM | 8.8 HIGH |
| An issue was discovered on Intelbras IWR 3000N 1.5.0 devices. When the administrator password is changed from a certain client IP address, administrative authorization remains available to any client at that IP address, leading to complete control of the router. | |||||
| CVE-2018-0696 | 1 Osstech | 1 Openam | 2019-02-22 | 3.5 LOW | 7.5 HIGH |
| OpenAM (Open Source Edition) 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the security questions and reset the login password via unspecified vectors. | |||||
| CVE-2018-17401 | 1 Phonepe | 1 Phonepe | 2018-11-08 | 4.3 MEDIUM | 8.8 HIGH |
| ** DISPUTED ** The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to perform Account Takeover attacks by exploiting its Forgot Password feature. NOTE: the vendor says that, to exploit this, the user has to explicitly install a malicious app and provide accessibility permission to the malicious app, that the Android platform provides fair warnings to the users before turning on accessibility for any application, and that it believes it is similar to installing malicious keyboards, or malicious apps taking screenshots. | |||||
| CVE-2018-12579 | 1 Oxid-esales | 1 Eshop | 2018-11-07 | 6.8 MEDIUM | 8.1 HIGH |
| An issue was discovered in OXID eShop Enterprise Edition before 5.3.8, 6.0.x before 6.0.3, and 6.1.x before 6.1.0; Professional Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0; and Community Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0. An attacker could gain access to the admin panel or a customer account when using the password reset function. To do so, it is required to own a domain name similar to the one the victim uses for their e-mail accounts. | |||||
| CVE-2017-0921 | 1 Gitlab | 1 Gitlab | 2018-09-04 | 6.8 MEDIUM | 8.1 HIGH |
| GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an unverified password change issue in the PasswordsController component resulting in potential account takeover if a victim's session is compromised. | |||||
| CVE-2018-11134 | 1 Quest | 1 Kace System Management Appliance | 2018-06-29 | 9.0 HIGH | 8.8 HIGH |
| In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue managed that runs with root privileges and only allows a set of commands. One of the available commands allows changing any user's password (including root). A low-privilege user could abuse this feature by changing the password of the 'kace_support' account, which comes disabled by default but has full sudo privileges. | |||||
| CVE-2014-6412 | 1 Wordpress | 1 Wordpress | 2018-05-17 | 5.0 MEDIUM | 8.1 HIGH |
| WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach. | |||||
| CVE-2018-0787 | 1 Microsoft | 1 Asp.net Core | 2018-04-11 | 6.8 MEDIUM | 8.8 HIGH |
| ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability". | |||||
| CVE-2017-8916 | 1 Cisecurity | 1 Cis-cat Pro Dashboard | 2018-02-24 | 4.6 MEDIUM | 7.8 HIGH |
| In Center for Internet Security CIS-CAT Pro Dashboard before 1.0.4, an authenticated user is able to change an administrative user's e-mail address and send a forgot password email to themselves, thereby gaining administrative access. | |||||