CWE-640

In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user passwo

An issue was discovered in Navigate CMS 2.9 r1433. The forgot-password feature allows users to reset their passwords by

The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_reset_pass() functi

A password reset vulnerability has been discovered in Forcepoint Email Security 8.5.x. The password reset URL can be use

Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.

An issue was discovered in /admin/users/update in M/Monit before 3.7.3. It allows unprivileged users to escalate their p

An issue was discovered in Open XDMoD through 7.5.0. An authentication bypass (account takeover) exists due to a weak pa

In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, lea

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/s

Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address

An issue was discovered on Intelbras IWR 3000N 1.5.0 devices. When the administrator password is changed from a certain

An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible (due t

Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is

TTLock devices do not properly restrict password-reset attempts, leading to incorrect access control and disclosure of s

OpenAM (Open Source Edition) 13.0 and later does not properly manage sessions, which allows remote authenticated attacke

An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus befor

SITOS six Build v6.2.1 allows a user to change their password and recovery email address without requiring them to confi

An issue was discovered in GLPI before 9.4.1. After a successful password reset by a user, it is possible to change that

In JetBrains Hub versions earlier than 2018.4.11436, there was no option to force a user to change the password and no p

gps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that immediately resets passwords

CMS Made Simple (CMSMS) through 2.2.6 contains an admin password reset vulnerability because data values are improperly

LTB (aka LDAP Tool Box) Self Service Password before 1.3 allows a change to a user password (without knowing the old pas

Instant Update CMS contains a Password Reset Vulnerability vulnerability in /iu-application/controllers/administration/a

Trovebox version <= 4.0.0-rc6 contains a Unsafe password reset token generation vulnerability in user component that can

An issue was discovered in Enalean Tuleap before 10.5. Reset password links are not invalidated after a user changes its

On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 SetPasswdSettings commands without authen

An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLC

An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLC

Missing password verification in the web interface on Gigaset Maxwell Basic VoIP phones with firmware 2.22.7 would allow

It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a

ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are create

In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies o

The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to perform A

WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach

GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an unverified password chan

An issue was discovered in OXID eShop Enterprise Edition before 5.3.8, 6.0.x before 6.0.3, and 6.1.x before 6.1.0; Profe

Artica Integria IMS version 5.0 MR56 Package 58, likely earlier versions contains a CWE-640: Weak Password Recovery Mech

In Center for Internet Security CIS-CAT Pro Dashboard before 1.0.4, an authenticated user is able to change an administr

When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the

An issue was discovered in Mahara before 18.10.0. It mishandled user requests that could discontinue a user's ability to

Missing verification of a password in ASUSTOR ADM version 3.1.1 allows attackers to change account passwords without ent

Unverified password change vulnerability in Change Password in Synology DiskStation Manager (DSM) before 6.2-23739 allow

An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. Enumeration of users is possible through the passw

EMC Documentum eRoom version 7.4.4, EMC Documentum eRoom version 7.4.4 SP1, EMC Documentum eRoom version prior to 7.4.5

389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout du

Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to reset arbitrary passwords via

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value

An authenticated standard user could reset the password of other users (including the admin) by altering form data. Affe