CWE-640: Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- ibm engineering requirements management doors, engineering requirements management doors web access +1 moreIBM Engineering Requirements Management DOORS weak authentication5.9 Medium
- ahmed-elgaml11 natoursNatours has a 1 Click Account take over on reset password via Host Header injection8.9 High
- No product listedJobCenter through 7e7b0b2 allows account takeover via the password reset feature because...9.8 Critical
- No product listedflask-boilerplate through a170e7c allows account takeover via the password reset feature because...9.8 Critical
- kanboardKanboard Password Reset Poisoning via Host Header Injection8.1 High
- allegraAllegra calculateTokenExpDate Password Recovery Authentication Bypass Vulnerability9.8 Critical
- utt 进取 750w, 750w firmware +1 moreUTT 进取 750W Administrator Password setSysAdm formDefineManagement unverified password change6.9 Medium
- empoweringprowebsite psw front-end login & registrationWordPress PSW Front-end Login & Registration plugin <= 1.13 - Broken Authentication Vulnerability9.8 Critical
- d-link di-7003gv2, dlink di-7003g firmware +1 moreD-Link DI-7003GV2 webgl.asp sub_41F4F0 unverified password change6.9 Medium
- continew adminContiNew Admin password unverified password change5.3 Medium
- yxj2018 springboot-vue-onlineexamYXJ2018 SpringBoot-Vue-OnlineExam studentPWD unverified password change5.3 Medium
- videowhisper paid videochat turnkey siteWordPress Paid Videochat Turnkey Site plugin <= 7.3.11 - Broken Authentication Vulnerability9.8 Critical
- px-lab boombox theme extensionsBoomBox Theme Extensions <= 1.8.0 - Authenticated (Subscriber+) Privilege Escalation via Password Reset/Account Takeover in boombox_ajax_reset_password8.8 High
- rising technosoft cap back office applicationAccount Takeover Vulnerability in CAP back office application8.3 High
- tapandsign technologies tap&sign app, tapandsign tap\&sign +1 moreImproper Authentication in Tapandsign Technologies Tap and Sign App6.5 Medium
- code-projects online library management systemPHPGurukul Online Library Management System change-password.php password recovery2.3 Low
- wpwax directorist, directorist: ai-powered business directory, listings & classified ads +1 moreDirectorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTP8.1 High
- devolutions serverImproper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an...5.4 Medium
- namelessmc namelessAccount Takeover in NamelessMC9.0 Critical
- No product listedYunzMall HTTP POST Request ResetpwdController.php changePwd password recovery6.9 Medium
- scriptsbundle adforestAdForest <= 5.1.6 - Privilege Escalation via Password Reset/Account Takeover9.8 Critical
- crushftpCrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account...9.8 Critical
- ruijie reyee osRuijie Reyee OS Weak Password Recovery Mechanism for Forgotten Password9.3 Critical
- contest-gallery contest gallery, contest gallery gallery, contest-gallery contest gallery – upload & vote photos, media, sell with paypal & stripe +2 moreContest Gallery <= 24.0.7 - Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeover9.8 Critical
- ibm security soar, soar +1 moreIBM Security SOAR weak password recovery mechanism5.6 Medium
- frappe pressPress has a potential 2FA bypass0.0 None
- appcheap app builder – create native android & ios apps on the flight, app builder +1 moreApp Builder – Create Native Android & iOS Apps On The Flight <= 5.3.7 - Privilege Escalation and Account Takeover via Weak OTP8.1 High
- olivegroup olivevleAn issue in Olive VLE allows an attacker to obtain sensitive information via the reset password...9.8 Critical
- apppresser, scottopolis apppresser – mobile app framework +1 moreAppPresser – Mobile App Framework <= 4.4.4 - Privilege Escalation and Account Takeover via Weak OTP8.1 High
- qilecmsQileCMS Verification Code Forget.php sendEmail password recovery6.3 Medium
- meanstoreA host header injection vulnerability in MEANStore 1.0 allows attackers to obtain the password...8.8 High
- riello netman 204, riello-ups netman 204 firmware +1 moreUnauthenticated Password Reset10.0 Critical
- tduckcloud tduckproTDuckCloud TDuckPro password recovery6.9 Medium
- staff appraisal system appraisal systemA host header injection vulnerability in Staff Appraisal System v1.0 allows attackers to obtain...8.0 High
- halo service solutions haloitsmHaloITSM - Password Reset Poisoning8.3 High
- r-hub turbomeetingThe password-reset mechanism in the Forgot Password functionality in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to force the application into resetting the administrator's…9.8 Critical
- glboy otp login with phone number, otp verificationLogin with phone number <= 1.7.34 - Insecure Password Reset Mechanism8.1 High
- guoxinled synthesis image systemShenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized password resets via the...9.8 Critical
- buildapp build app onlineBuild App Online <= 1.0.22 - Account Takeover via Weak Password Reset Mechanism8.1 High
- salesagility suitecrmSuiteCRM unauthenticated user password reset on php73.7 Low
- lunary, lunary-ai lunary-ai/lunary +1 moreWeak Password Recovery Mechanism in lunary-ai/lunary6.4 Medium
- ifm moneo appliance qha210, moneo appliance qha300, moneo appliance qva200 +5 more +7 moreifm: moneo prone to weak password recovery mechanism9.8 Critical
- tp-link tapo c210, tapo c210 firmware +1 moreTP-Link Tapo C210 Password Recovery Authentication Bypass Vulnerability8.8 High
- jitsi meetIn Jitsi Meet before 9391, a logic flaw in password-protected Jitsi meetings (that make use of a...7.5 High
- sap se netweaver as java user management engineSecurity misconfiguration vulnerability in SAP NetWeaver AS Java User Management Engine8.8 High
- lg led assistantPassword reset vulnerability without authorization on LG LED Assistant9.1 Critical
- cdexWeak password recovery mechanism in CDeX8.0 High
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway, secure connect gateway policy manager +2 moreDell Secure Connect Gateway (SCG) Policy Manager, version 5.10+, contain a weak password recovery...8.0 High
- redhat keycloak, red hat build of keycloak, single sign-on 7 +2 moreKeycloak-core: dos via account lockout3.7 Low
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Does Not Obfuscate Password Reminder Answers6.3 Medium
- Show moreLoading…