CWE-640 Archives - CVE Vulnerability

CVE-2018-8916

Sun, 26 Feb 2023 06:51:39 +0000

Unverified password change vulnerability in Change Password in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to reset password without verification.

The post CVE-2018-8916 appeared first on CVE Vulnerability.

CVE-2018-7811

Sun, 26 Feb 2023 06:51:11 +0000

An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the change password function of the web server

The post CVE-2018-7811 appeared first on CVE Vulnerability.

CVE-2018-7809

Sun, 26 Feb 2023 06:51:11 +0000

The post CVE-2018-7809 appeared first on CVE Vulnerability.

CVE-2018-19488

Sun, 26 Feb 2023 06:48:10 +0000

The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_reset_pass() function through the admin-ajax.php file, which allows remote unauthenticated attackers to reset the password of a user’s account.

The post CVE-2018-19488 appeared first on CVE Vulnerability.

CVE-2018-18871

Sun, 26 Feb 2023 06:47:57 +0000

Missing password verification in the web interface on Gigaset Maxwell Basic VoIP phones with firmware 2.22.7 would allow a remote attacker (in the same network as the device) to change the admin password without authentication (and without knowing the original password).

The post CVE-2018-18871 appeared first on CVE Vulnerability.

CVE-2018-17881

Sun, 26 Feb 2023 06:47:36 +0000

On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 SetPasswdSettings commands without authentication to trigger an admin password change.

The post CVE-2018-17881 appeared first on CVE Vulnerability.

CVE-2018-17401

Sun, 26 Feb 2023 06:47:25 +0000

** DISPUTED ** The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to perform Account Takeover attacks by exploiting its Forgot Password feature. NOTE: the vendor says that, to exploit this, the user has to explicitly install a malicious app and provide accessibility permission to the malicious app, that the Android platform provides fair warnings to the users before turning on accessibility for any application, and that it believes it is similar to installing malicious keyboards, or malicious apps taking screenshots.

The post CVE-2018-17401 appeared first on CVE Vulnerability.

CVE-2018-17298

Sun, 26 Feb 2023 06:47:23 +0000

An issue was discovered in Enalean Tuleap before 10.5. Reset password links are not invalidated after a user changes its password.

The post CVE-2018-17298 appeared first on CVE Vulnerability.

CVE-2018-16988

Sun, 26 Feb 2023 06:47:15 +0000

An issue was discovered in Open XDMoD through 7.5.0. An authentication bypass (account takeover) exists due to a weak password reset mechanism. A brute-force attack against an MD5 rid value requires only 600 guesses in the plausible situation where the attacker knows that the victim has started a password-reset process (pass_reset.php, password_reset.php, XDUser.php) in the past few minutes.

The post CVE-2018-16988 appeared first on CVE Vulnerability.

CVE-2018-16529

Sun, 26 Feb 2023 06:47:06 +0000

A password reset vulnerability has been discovered in Forcepoint Email Security 8.5.x. The password reset URL can be used after the intended expiration period or after the URL has already been used to reset a password.

The post CVE-2018-16529 appeared first on CVE Vulnerability.