CWE-640: Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- dell powerprotect data managerDell PowerProtect Data Manager, version 19.15 and prior versions, contain a weak password...8.8 High
- aureus erp, huaxiaerp huaxia erp +1 moreHuaxia ERP UserController.java password recovery5.3 Medium
- gitlab, gitlab ce/ee +1 moreWeak Password Recovery Mechanism for Forgotten Password in GitLab10.0 Critical
- foru cmsForU CMS password recovery5.3 Medium
- wwbn avideoAn insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation...8.8 High
- wwbn avideoWWBN AVideo recovery notification bypass vulnerability5.3 Medium
- huiran host reseller systemHuiRan Host Reseller System HTTP POST Request password recovery3.7 Low
- sap commerce cloudImproper Access Control vulnerability in SAP Commerce Cloud8.1 High
- zitadelZITADEL vulnerable account takeover via malicious host header injection8.1 High
- apppresser, scottopolis apppresser – mobile app framework +1 moreAppPresser <= 4.2.5 - Insecure Password Reset Mechanism8.1 High
- emudhra emsignerIncorrect access control in the Forgot Your Password function of EMSigner v2.8.7 allows...9.8 Critical
- byzoro smart s85f management platform, smart s85f firmware +1 moreByzoro Smart S85F Management Platform login.php password recovery4.3 Medium
- thm pilosPILOS account takeover through password reset poisoning8.8 High
- fit2cloud jumpserverJumpServer default admin user email leak password reset3.7 Low
- linkstack, linkstackorg linkstackorg/linkstack +1 moreWeak Password Recovery Mechanism for Forgotten Password in linkstackorg/linkstack6.5 Medium
- zitadelZITADEL's password reset does not respect the "Ignoring unknown usernames" setting5.3 Medium
- rockoaXinhu RockOA Password password recovery4.3 Medium
- fit2cloud jumpserverNon-MFA account takeover via brute-force attack on weak password reset code in jumpserver8.2 High
- fujitsu arconte áurea, arconte aurea +1 moreWeak password recovery mechanism vulnerability in Fujitsu Arconte Áurea8.6 High
- scshr hr portalSoar Cloud Ltd. HR Portal - Weak Password Recovery Mechanism for Forgotten Password7.8 High
- alfnru password recovery plugin, password recovery project recovery +1 moreVulnerability in the password recovery mechanism of Roundcube Password Recovery Plugin7.5 High
- openrapid rapidcmsOpenRapid RapidCMS run-movepass.php password recovery6.3 Medium
- weintek weincloudWeintek Weincloud Weak Password Recovery Mechanism for Forgotten Password7.4 High
- malwarebytes, malwarebytes endpoint detection and response +1 moreThe Malwarebytes EDR 1.0.11 for Linux driver doesn't properly ensure whitelisting of executable...7.8 High
- iliasThe password reset function in ILIAS 7.0_beta1 through 7.20 and 8.0_beta1 through 8.1 allows...9.8 Critical
- d-link dir-823g, dlink dir-823g firmware +1 moreD-Link DIR-823G firmware version 1.02B05 has a password reset vulnerability, which originates...7.5 High
- apple ipados, macos, tvos +3 more +5 moreThis issue was addressed with improved state management. This issue is fixed in iOS 16.5 and...5.5 Medium
- apple macosA logic issue was addressed with improved state management. This issue is fixed in macOS Ventura...4.3 Medium
- itsourcecode student management systemningzichun Student Management System Password Reset resetPassword.php password recovery6.5 Medium
- mitel mivoice connectA vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6...8.8 High
- milesight ms-n1004-uc firmware, ms-n1004-upc firmware, ms-n1008-uc firmware +23 more +25 moreAuthentication Bypass Vulnerability in Milesight Network Video Recorder (NVR)9.8 Critical
- concretecms concrete cmsMissing rate limit for password resets5.3 Medium
- serenity serene, startsharp +1 moreInsufficient token expiration in Serenity7.8 High
- mobicintAn issue in Mobicint Backend for Credit Unions v3 allows attackers to retrieve partial email...5.3 Medium
- megafeis bofei dbd\+An insecure password reset issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android...9.8 Critical
- akuvox e11, e11 firmware +1 moreCVE-2023-03529.1 Critical
- dotcmsAn issue was discovered in dotCMS core 5.3.8.5 through 5.3.8.15 and 21.03 through 22.10.1. A...8.8 High
- comfast project cf-wr623n firmwareCOMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1...9.8 Critical
- ami megarac spx-12, megarac spx-13, megarac sp-x +2 more +4 morePassword reset interception via API8.3 High
- gitter-badger ezpublish-modern-legacy, gitter ez publish modern legacy +1 moregitter-badger ezpublish-modern-legacy forgotpassword.php password recovery2.6 Low
- rocketsoftware trufusion enterpriseThe Forgotten Password functionality of Rocket TRUfusion Portal v7.9.2.1 allows remote attackers...7.5 High
- talend administration centerIn Talend Administration Center 7.3.1.20200219 before TAC-15950, the Forgot Password feature...5.3 Medium
- pilz pmcIn Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), a user's...7.5 High
- sick sim2000 firmwarePassword recovery vulnerability in SICK SIM2000ST Partnumber 2086502 with firmware version <1.13...9.8 Critical
- ifm moneo appliance, moneo qha200 firmware, moneo qha210 firmware +2 moreWeak Password Recovery in ifm moneo appliance9.8 Critical
- backclickAn issue was discovered in BACKCLICK Professional 5.9.63. Due to insecure design or lack of...9.8 Critical
- schneider electric ecostruxure control expert, ecostruxure process expert, modicon m340 cpu +35 more +37 moreA CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that...9.8 Critical
- backdropcms backdrop cmsAn issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers...5.3 Medium
- priorityPriority - Priority User Enumeration5.5 Medium
- count countly server, countly countly-server +1 morePredictable password reset token may lead to account takeover in countly-server8.1 High
- Show moreLoading…