CWE-620: Unverified Password Change
When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedAggie 2.6.1 has a Host Header injection vulnerability in the forgot password functionality,...8.2 High
- hancock11 appy pie connect for woocommerceAppy Pie Connect for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via reset_user_password9.8 Critical
- sophos ap6 series wireless access pointsAn authentication bypass vulnerability allows remote attackers to gain administrative privileges...9.8 Critical
- emby mediabrowserCWE-620: Unverified Password Change6.5 Medium
- uxper sala - startup & saas wordpress themeSala - Startup & SaaS WordPress Theme <= 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover9.8 Critical
- scriptsbundle dwt - directory & listing wordpress themeDWT - Directory & Listing WordPress Theme <= 3.3.6 - Unauthenticated Arbitrary User Password Reset9.8 Critical
- utt 进取 750w, 750w firmware +1 moreUTT 进取 750W Administrator Password setSysAdm formDefineManagement unverified password change6.9 Medium
- sunshinephotocart sunshine photo cart, sunshine photo cart – client photo gallery & photo proofing for photographers +1 moreSunshine Photo Cart <= 3.4.11 - Authenticated (Subscriber+) Privilege Escalation8.8 High
- typo3TYPO3 Vulnerable to Unverified Password Change for Backend Users3.8 Low
- stylemixthemes motors - car dealer, rental & listing wordpress themeMotors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover9.8 Critical
- d-link di-7003gv2, dlink di-7003g firmware +1 moreD-Link DI-7003GV2 webgl.asp sub_41F4F0 unverified password change6.9 Medium
- schweitzer engineering laboratories sel blueframe osUnverified Password Change2.7 Low
- wormhole tech gpmWormHole Tech GPM - Unverified Password Change9.3 Critical
- continew adminContiNew Admin password unverified password change5.3 Medium
- imithemes listingIMITHEMES Listing <= 3.3 - Unauthenticated Privilege Escalation via Unverified Password Reset9.8 Critical
- abb anc, anc-l, anc-mini +2 moreUnverified Password Change2.1 Low
- flynax bridge, v1rustyle flynax bridge +1 moreFlynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Password Update9.8 Critical
- lamarant buddypress force password changeBuddypress Force Password Change <= 0.1 - Authenticated (Subscriber+) Account Takeover via Password Update4.2 Medium
- arkenon login, registration and lost password blocksFrontend Login and Registration Blocks <= 1.0.8 - Authenticated (Subscriber+) Privilege Escalation via Password Reset8.8 High
- yxj2018 springboot-vue-onlineexamYXJ2018 SpringBoot-Vue-OnlineExam studentPWD unverified password change5.3 Medium
- fortinet fortiswitchA unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote...9.3 Critical
- siemens sentron 7kt pac1260 data manager, 7kt pac1260 data manager firmware +1 moreA vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web...6.9 Medium
- superagi, transformeroptimus transformeroptimus/superagi +1 moreImproper Privilege Management in transformeroptimus/superagi6.5 Medium
- scriptsbundle exertio frameworkExertio Framework <= 1.3.1 - Unauthenticated Arbitrary User Password Update8.1 High
- scriptsbundle nokri – job board wordpress themeNokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change9.8 Critical
- carspot project carspot, scriptsbundle carspot – dealership wordpress classified theme +1 moreCarSpot – Dealership Wordpress Classified Theme <= 2.4.3 - Unauthenticated Arbitrary Password Reset/Account Takeover9.8 Critical
- impronta jantoUnverified password change vulnerability in Janto9.9 Critical
- ibm security verify access, security verify access docker +1 moreIBM Security Verify Access unverified password change5.6 Medium
- spoonthemes adifier systemAdifier System <= 3.1.7 - Unauthenticated Arbitrary Password Reset9.8 Critical
- image access gmbh scan2netInsecure Password Change Function8.4 High
- octoprintAPI key access in settings without reauthentication in OctoPrint5.3 Medium
- levelone wbr-6012, level1 wbr-6012 firmware +1 moreThe LevelOne WBR-6012 router's web application has a vulnerability in its firmware version R0...9.9 Critical
- ba-booking ba book everythingBA Book Everything <= 1.6.20 - Unauthenticated Arbitrary User Password Reset5.3 Medium
- fortinet fortianalyzer, fortimanager +1 moreA unverified password change in Fortinet FortiManager versions 7.0.0 through 7.0.10, versions 7.2...5.5 Medium
- xiongwei technology restaurant digital comprehensive managementAn issue in Hangzhou Xiongwei Technology Development Co., Ltd. Restaurant Digital Comprehensive...9.8 Critical
- siemens cpci85 central processing/communication, sicore base system, cpci85 firmware +2 moreA vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5...9.3 Critical
- cisco smart software manager on-premA vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem...10.0 Critical
- eskooly, eskooly web product +1 moreAn issue in Eskooly Free Online School management Software v.3.0 and before allows a remote...8.2 High
- zenml, zenml-io zenml-io/zenml +1 moreImproper Authentication in zenml-io/zenml3.3 Low
- mantisbtMantisBT user account takeover in the signup/reset password process7.3 High
- octoprintOctoPrint Unverified Password Change via Access Control Settings4.2 Medium
- hp inc trio 8300, poly ccx 350, ccx 400 +38 more +40 morePoly VVX 601 Configuration File Import unverified password change2.7 Low
emailproxyPyPIExpired tokens can be renewed without validating the account password8.1 High- userproplugin userproUserPro <= 5.1.1 - Insecure Password Reset Mechanism9.8 Critical
- apppresser, scottopolis apppresser – mobile app framework +1 moreAppPresser <= 4.2.5 - Insecure Password Reset Mechanism8.1 High
- pimcore pimcore/admin-ui-classic-bundle, admin classic bundle +1 moreUnverified Password Change in pimcore/admin-ui-classic-bundle4.3 Medium
- palmspark wp user controlWP User Control <= 1.5.3 - Insecure Password Reset Mechanism5.3 Medium
- instantsoft instantsoft/icms2, instantcms +1 moreUnverified Password Change in instantsoft/icms24.3 Medium
- corebos, tsolucio tsolucio/corebos +1 moreUnverified Password Change in tsolucio/corebos7.6 High
- cozmoslabs profile builder, user profile builder – beautiful user registration forms, user profiles & user role editor +1 moreProfile Builder – User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset Mechanism9.8 Critical
- Show moreLoading…