CWE-640: Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- craftcms craft cmsImproper account password reset in Craft CMS8.8 High
- shopwareMultiple valid tokens for password reset in Shopware6.4 Medium
- php pearwebpearweb < 1.32 is suffers from a Weak Password Recovery Mechanism via include/users...9.8 Critical
- atutorAn Access Control vulnerability exists in ATutor 2.2.4 in password_reminder.php when the g, id, h...7.5 High
- unspecified automatic question paper generator, automatic question paper generator system project question paper generator system +1 moreAutomatic Question Paper Generator password recovery7.3 High
- microweber, microweber microweber/microweber +1 moreWeak Password Recovery Mechanism for Forgotten Password in microweber/microweber7.3 High
- xwiki, xwiki xwiki-platform +1 moreInformation exposure in xwiki-platform5.3 Medium
- pega infinity, pegasystems pega infinity +1 moreForgotten password reset functionality for local accounts can be used to bypass local...8.8 High
- saviynt enterprise identity cloudAn issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. An authentication...9.8 Critical
- deltarm delta rmAn issue was discovered in Delta RM 1.2. It is possible to request a new password for any other...6.5 Medium
- umbraco cmsUmbraco Password Reset URL Poison6.8 Medium
- gitlabIn all versions of GitLab CE/EE starting version 14.0 before 14.3.6, all versions starting from...4.4 Medium
- globaldatingsoftware premiumdatingscriptAn Incorrect Access Control vulnerability exists in Premiumdatingscript 4.2.7.7 via the password...9.8 Critical
- teampasswordmanager team password managerTeam Password Manager (aka TeamPasswordManager) before 10.135.236 allows password-reset poisoning.7.5 High
- gitlabIn all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute...2.9 Low
- salesagility suitecrmSuiteCRM - Account Takeover in Password Reset Functionality8.0 High
- otrs, otrs ag ((otrs)) community edition +1 moreUser enumeration issue using "lost password" feature5.3 Medium
- dolibarrAccount Takeover in "Dolibarr" via Password Reset Functionality8.8 High
- discourseRe-use of email tokens in Discourse5.3 Medium
- jetbrains hubIn JetBrains Hub before 2021.1.13402, HTML injection in the password reset email was possible.6.1 Medium
- prolink prc2402m firmwareIn ProLink PRC2402M V1.0.18 and older, the set_sys_init function in the login.cgi binary allows...7.5 High
- jetbrains hubIn JetBrains Hub before 2021.1.13389, account takeover was possible during password reset.9.8 Critical
- akauntingAkaunting Password Reset Relay5.4 Medium
- liferay dxp, portal +1 moreLiferay Portal and Liferay DXP insecure default configuration7.5 High
- schneider-electric powerlogic pm5560 firmware, powerlogic pm5561 firmware, powerlogic pm5562 firmware +2 more +4 moreA CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in...9.8 Critical
- seceon aisiemSeceon aiSIEM before 6.3.2 (build 585) is prone to an unauthenticated account takeover...9.8 Critical
- schneider-electric mcsesm043f23f0 firmware, mcsesm053f1cs0 firmware, mcsesm053f1cu0 firmware +13 more +15 moreWeak Password Recovery Mechanism for Forgotten Password vulnerability exists on Modicon Managed...9.8 Critical
- jetbrains teamcityIn JetBrains TeamCity before 2020.2.3, account takeover was potentially possible during a...8.8 High
- strapiWeak Password Recovery Mechanism for Forgotten Password in Strapi8.1 High
- cern indicoIndico Tampering with links (e.g. password reset) in sent emails7.5 High
- netgear cbr40 firmware, r6900p firmware, r7000 firmware +13 more +15 moreCertain NETGEAR devices are affected by password reset by an unauthenticated attacker. This...8.1 High
- misp-project mispThe default setting of MISP 2.4.136 did not enable the requirements (aka...9.1 Critical
- dell cpg biosSelect Dell Client Commercial and Consumer platforms support a BIOS password reset capability...5.1 Medium
- terra-master tosEmail Injection in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to abuse the...7.3 High
- os4ed opensisOpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file...7.5 High
- immutaImmuta v2.8.2 is affected by one instance of insecure permissions that can lead to user account...7.5 High
- konzept-ix publixonekonzept-ix publiXone before 2020.015 allows attackers to take over arbitrary user accounts by...9.8 Critical
- clickstudios passwordstateClickStudios Passwordstate Password Reset Portal prior to build 8501 is affected by an...7.5 High
- alfresco reset passwordThe Reset Password add-on before 1.2.0 for Alfresco has a broken algorithm (involving an...8.8 High
- erambaeramba c2.8.1 and Enterprise before e2.19.3 has a weak password recovery token (createHash has...9.8 Critical
- f5 nginx controllerIn NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is...7.8 High
- naviwebs navigate cmsAn issue was discovered in Navigate CMS 2.9 r1433. The forgot-password feature allows users to...5.3 Medium
- naviwebs navigate cmsAn issue was discovered in Navigate CMS 2.9 r1433. When performing a password reset, a user is...7.5 High
- mattermost serverMattermost Server password reset email requests can be sent to attacker-provided email addresses9.8 Critical
- wordpress, debian linux +1 morePassword reset links invalidation issue in WordPress6.1 Medium
- auto-maskin dcu 210 firmware, marine pro observer, rp210e firmware +2 moreIn Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer...9.1 Critical
- zpanelcp zpanelZPanel 10.0.1 has insufficient entropy for its password reset process.9.8 Critical
- ushahidiUshahidi before 2.6.1 has insufficient entropy for forgot-password tokens.9.8 Critical
- ctfdIncorrect username validation in the registration processes of CTFd through 2.2.2 allows a remote...9.8 Critical
- pyforumA backdoor (aka BMSA-2009-07) was found in PyForum v1.0.3 where an attacker who knows a valid...7.5 High
- Show moreLoading…