Latest Weak Password Recovery Mechanism for Forgotten Password Vulnerabilities
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-09-03 | CVE-2020-25105 | Weak Password Recovery Mechanism FOR Forgotten Password vulnerability in Eramba 2.19.3/2.8.1 eramba c2.8.1 and Enterprise before e2.19.3 has a weak password recovery token (createHash has only a million possibilities). | |
| 2020-07-01 | CVE-2020-5899 | Weak Password Recovery Mechanism FOR Forgotten Password vulnerability in F5 Nginx Controller In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an attacker who can intercept the database connection or have read access to the database, to request a password reset using the email address of another registered user then retrieve the recovery code. | |
| 2020-06-29 | CVE-2019-18256 | Weak Password Recovery Mechanism for Forgotten Password vulnerability in Biotronik products BIOTRONIK CardioMessenger II, The affected products use individual per-device credentials that are stored in a recoverable format. | |
| 2020-06-24 | CVE-2020-14016 | Weak Password Recovery Mechanism for Forgotten Password vulnerability in Naviwebs Navigate CMS 2.9 An issue was discovered in Navigate CMS 2.9 r1433. | |
| 2020-06-24 | CVE-2020-14015 | Weak Password Recovery Mechanism for Forgotten Password vulnerability in Naviwebs Navigate CMS 2.9 An issue was discovered in Navigate CMS 2.9 r1433. | |
| 2020-04-30 | CVE-2020-11027 | Weak Password Recovery Mechanism for Forgotten Password vulnerability in Wordpress In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. | |
| 2020-03-23 | CVE-2019-6560 | Weak Password Recovery Mechanism for Forgotten Password vulnerability in Auto-Maskin products In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak. | |
| 2020-02-04 | CVE-2012-5686 | Weak Password Recovery Mechanism for Forgotten Password vulnerability in Zpanelcp Zpanel 10.0.1 ZPanel 10.0.1 has insufficient entropy for its password reset process. | |
| 2020-02-04 | CVE-2012-5618 | Weak Password Recovery Mechanism FOR Forgotten Password vulnerability in Ushahidi Ushahidi before 2.6.1 has insufficient entropy for forgot-password tokens. | |
| 2020-01-23 | CVE-2020-7245 | Weak Password Recovery Mechanism FOR Forgotten Password vulnerability in Ctfd Incorrect username validation in the registration process of CTFd v2.0.0 - v2.2.2 allows an attacker to take over an arbitrary account if the username is known and emails are enabled on the CTFd instance. |