CWE-640: Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- intelbras iwr 3000n firmwareAn issue was discovered on Intelbras IWR 3000N 1.8.7 devices. When the administrator password is...8.8 High
- djangoproject django, canonical ubuntu linux +1 moreDjango Potential account hijack via password reset form9.8 Critical
- progress sitefinityProgress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because...9.8 Critical
- strapiStrapi allows unauthenticated attacker to reset admin password without valid reset token9.8 Critical
- craftcms craft cmsCraft CMS possibility of brute force attempts9.8 Critical
- sitos sixSITOS six Build v6.2.1 allows a user to change their password and recovery email address without...6.5 Medium
- jetbrains hubIn JetBrains Hub versions earlier than 2018.4.11436, there was no option to force a user to...5.3 Medium
- ttlockTTLock devices do not properly restrict password-reset attempts, leading to incorrect access...8.1 High
- glpi-project glpiAn issue was discovered in GLPI before 9.4.1. After a successful password reset by a user, it is...5.9 Medium
- ultimatemember ultimate memberAn arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress...8.8 High
- cloud foundry uaa release (oss), pivotal software cloud foundry uaa-release +1 moreUAA defaults email address to an insecure domain8.3 High
- zohocorp manageengine adselfservice plusAn authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine...6.8 Medium
- buffalo open xdmodAn issue was discovered in Open XDMoD through 7.5.0. An authentication bypass (account takeover)...9.8 Critical
- intelbras iwr 3000n firmwareAn issue was discovered on Intelbras IWR 3000N 1.5.0 devices. When the administrator password is...8.8 High
- tildeslash monitAn issue was discovered in /admin/users/update in M/Monit before 3.7.3. It allows unprivileged...9.8 Critical
- contao cmsContao Does Not Invalidate Existing Sessions When Password Changes9.8 Critical
- forcepoint email securityA password reset vulnerability has been discovered in Forcepoint Email Security 8.5.x. The...9.8 Critical
- wp-jobhunt project wp-jobhuntThe WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the...9.8 Critical
- openam consortium openamOpenAM (Open Source Edition) 13.0 and later does not properly manage sessions, which allows...7.5 High
- gigasetpro maxwell basic firmwareMissing password verification in the web interface on Gigaset Maxwell Basic VoIP phones with...9.8 Critical
- artica integria imsArtica Integria IMS version 5.0 MR56 Package 58, likely earlier versions contains a CWE-640: Weak...8.1 High
- asustor data masterMissing verification of a password in ASUSTOR ADM version 3.1.1 allows attackers to change...6.5 Medium
- schneider electric se embedded web servers in all modicon m340, premium, quantum plcs and bmxnor0200, schneider-electric modicom bmxnor0200h firmware, modicom m340 firmware +2 more +4 moreAn Unverified Password Change vulnerability exists in the embedded web servers in all Modicon...9.8 Critical
- schneider electric se embedded web servers in all modicon m340, premium, quantum plcs and bmxnor0200, schneider-electric modicom bmxnor0200h firmware, modicom m340 firmware +2 more +4 moreAn Unverified Password Change vulnerability exists in the embedded web servers in all Modicon...9.8 Critical
- d-link dir-823g firmwareOn D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 SetPasswdSettings...9.8 Critical
- phonepe** DISPUTED ** The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for...8.8 High
- enalean tuleapAn issue was discovered in Enalean Tuleap before 10.5. Reset password links are not invalidated...9.8 Critical
- oxid-esales eshopAn issue was discovered in OXID eShop Enterprise Edition before 5.3.8, 6.0.x before 6.0.3, and 6...8.1 High
- red hat ovirt-engine-extension-aaa-jdbc, redhat enterprise virtualization +1 moreWhen updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to...6.8 Medium
- gitlabGitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an...8.1 High
- troveboxTrovebox version <= 4.0.0-rc6 contains a Unsafe password reset token generation vulnerability in...9.8 Critical
- instant-update instant update cmsInstant Update CMS contains a Password Reset Vulnerability vulnerability in /iu-application...9.8 Critical
- ltb-project ldap tool box self service passwordLTB (aka LDAP Tool Box) Self Service Password before 1.3 allows a change to a user password ...9.8 Critical
- synology diskstation manager (dsm), diskstation manager +1 moreUnverified password change vulnerability in Change Password in Synology DiskStation Manager (DSM)...6.3 Medium
- quest kace system management applianceIn order to perform actions that requires higher privileges, the Quest KACE System Management...8.8 High
- vaultize enterprise file sharingAn issue was discovered in Vaultize Enterprise File Sharing 17.05.31. Enumeration of users is...5.3 Medium
- cmsmadesimple cms made simpleCMS Made Simple (CMSMS) through 2.2.6 contains an admin password reset vulnerability because data...9.8 Critical
- wordpressWordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via...8.1 High
- microsoft asp.net coreASP.NET Core allow an elevation of privilege8.8 High
- keycloakModerate severity vulnerability that affects org.keycloak:keycloak-core8.8 High
- cisecurity cis-cat pro dashboardIn Center for Internet Security CIS-CAT Pro Dashboard before 1.0.4, an authenticated user is able...7.8 High
- maharaAn issue was discovered in Mahara before 18.10.0. It mishandled user requests that could...6.5 Medium
- gps-server gps tracking softwaregps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that...9.8 Critical
- cloudfoundry cf-release, pivotal software cloud foundry elastic runtime, cloud foundry uaa +2 moreCloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password9.8 Critical
- prominent multiflex m10a controller firmwareAn Unverified Password Change issue was discovered in ProMinent MultiFLEX M10a Controller web...8.8 High
- ellucian banner studentEllucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to reset...9.8 Critical
- zte zxv10 w300 firmwareZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote...7.5 High
- 389 directory server 389-ds-base, fedoraproject 389 directory server +1 more389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks...9.8 Critical
- kanboardAn authenticated standard user could reset the password of the admin by altering form data....8.8 High
- kanboardAn authenticated standard user could reset the password of other users (including the admin) by...8.8 High
- Show moreLoading…