Total
156 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-12315 | 1 Asustor | 2 As602t, Data Master | 2019-10-03 | 4.0 MEDIUM | 6.5 MEDIUM |
| Missing verification of a password in ASUSTOR ADM version 3.1.1 allows attackers to change account passwords without entering the current password. | |||||
| CVE-2018-7811 | 1 Schneider-electric | 8 Modicom Bmxnor0200h, Modicom Bmxnor0200h Firmware, Modicom M340 and 5 more | 2019-10-02 | 5.0 MEDIUM | 9.8 CRITICAL |
| An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the change password function of the web server | |||||
| CVE-2018-1000812 | 1 Artica | 1 Integria Ims | 2019-08-16 | 4.3 MEDIUM | 8.1 HIGH |
| Artica Integria IMS version 5.0 MR56 Package 58, likely earlier versions contains a CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability in Password recovery process, line 45 of general/password_recovery.php that can result in IntegriaIMS web app user accounts can be taken over. This attack appear to be exploitable via Network access to IntegriaIMS web interface . This vulnerability appears to have been fixed in fixed in versions released after commit f2ff0ba821644acecb893483c86a9c4d3bb75047. | |||||
| CVE-2019-13240 | 1 Glpi-project | 1 Glpi | 2019-07-17 | 4.3 MEDIUM | 5.9 MEDIUM |
| An issue was discovered in GLPI before 9.4.1. After a successful password reset by a user, it is possible to change that user's password again during the next 24 hours without any information except the associated email address. | |||||
| CVE-2019-11393 | 1 Tildeslash | 1 Monit | 2019-04-30 | 5.0 MEDIUM | 9.8 CRITICAL |
| An issue was discovered in /admin/users/update in M/Monit before 3.7.3. It allows unprivileged users to escalate their privileges to an administrator by requesting a password change and specifying the admin parameter. | |||||
| CVE-2019-11414 | 1 Intelbras | 2 Iwr 3000n, Iwr 3000n Firmware | 2019-04-22 | 4.3 MEDIUM | 8.8 HIGH |
| An issue was discovered on Intelbras IWR 3000N 1.5.0 devices. When the administrator password is changed from a certain client IP address, administrative authorization remains available to any client at that IP address, leading to complete control of the router. | |||||
| CVE-2019-10641 | 1 Contao | 1 Contao Cms | 2019-04-19 | 5.0 MEDIUM | 9.8 CRITICAL |
| Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password. | |||||
| CVE-2018-19488 | 1 Wp-jobhunt Project | 1 Wp-jobhunt | 2019-04-01 | 7.5 HIGH | 9.8 CRITICAL |
| The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_reset_pass() function through the admin-ajax.php file, which allows remote unauthenticated attackers to reset the password of a user's account. | |||||
| CVE-2015-4689 | 1 Ellucian | 1 Banner Student | 2019-03-13 | 5.0 MEDIUM | 9.8 CRITICAL |
| Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to reset arbitrary passwords via unspecified vectors, aka "Weak Password Reset." | |||||
| CVE-2018-0696 | 1 Osstech | 1 Openam | 2019-02-22 | 3.5 LOW | 7.5 HIGH |
| OpenAM (Open Source Edition) 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the security questions and reset the login password via unspecified vectors. | |||||
| CVE-2018-17298 | 1 Enalean | 1 Tuleap | 2019-01-29 | 5.0 MEDIUM | 9.8 CRITICAL |
| An issue was discovered in Enalean Tuleap before 10.5. Reset password links are not invalidated after a user changes its password. | |||||
| CVE-2018-7809 | 1 Schneider-electric | 8 Modicom Bmxnor0200h, Modicom Bmxnor0200h Firmware, Modicom M340 and 5 more | 2018-12-28 | 6.4 MEDIUM | 9.8 CRITICAL |
| An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the password delete function of the web server. | |||||
| CVE-2018-12579 | 1 Oxid-esales | 1 Eshop | 2018-11-07 | 6.8 MEDIUM | 8.1 HIGH |
| An issue was discovered in OXID eShop Enterprise Edition before 5.3.8, 6.0.x before 6.0.3, and 6.1.x before 6.1.0; Professional Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0; and Community Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0. An attacker could gain access to the admin panel or a customer account when using the password reset function. To do so, it is required to own a domain name similar to the one the victim uses for their e-mail accounts. | |||||
| CVE-2017-0921 | 1 Gitlab | 1 Gitlab | 2018-09-04 | 6.8 MEDIUM | 8.1 HIGH |
| GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an unverified password change issue in the PasswordsController component resulting in potential account takeover if a victim's session is compromised. | |||||
| CVE-2018-1000501 | 1 Instant-update | 1 Instant Update Cms | 2018-08-30 | 7.5 HIGH | 9.8 CRITICAL |
| Instant Update CMS contains a Password Reset Vulnerability vulnerability in /iu-application/controllers/administration/auth.php that can result in Account Tackover. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in v0.3.3. | |||||
| CVE-2018-1000554 | 1 Trovebox | 1 Trovebox | 2018-08-17 | 5.0 MEDIUM | 9.8 CRITICAL |
| Trovebox version <= 4.0.0-rc6 contains a Unsafe password reset token generation vulnerability in user component that can result in Password reset. This attack appear to be exploitable via HTTP request. This vulnerability appears to have been fixed in after commit 742b8ed. | |||||
| CVE-2018-12421 | 1 Ltb-project | 1 Ldap Tool Box Self Service Password | 2018-08-10 | 5.0 MEDIUM | 9.8 CRITICAL |
| LTB (aka LDAP Tool Box) Self Service Password before 1.3 allows a change to a user password (without knowing the old password) via a crafted POST request, because the ldap_bind return value is mishandled and the PHP data type is not constrained to be a string. | |||||
| CVE-2018-11134 | 1 Quest | 1 Kace System Management Appliance | 2018-06-29 | 9.0 HIGH | 8.8 HIGH |
| In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue managed that runs with root privileges and only allows a set of commands. One of the available commands allows changing any user's password (including root). A low-privilege user could abuse this feature by changing the password of the 'kace_support' account, which comes disabled by default but has full sudo privileges. | |||||
| CVE-2017-1000141 | 1 Mahara | 1 Mahara | 2018-06-13 | 6.4 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in Mahara before 18.10.0. It mishandled user requests that could discontinue a user's ability to maintain their own account (changing username, changing primary email address, deleting account). The correct behavior was to either prompt them for their password and/or send a warning to their primary email address. | |||||
| CVE-2018-10210 | 1 Vaultize | 1 Enterprise File Sharing | 2018-05-25 | 5.0 MEDIUM | 5.3 MEDIUM |
| An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. Enumeration of users is possible through the password-reset feature. | |||||