CWE-640 · Weak Password Recovery Mechanism for Forgotten Password (page 4)
Page 4 of 4 — CVEs classified under CWE-640, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-8385 | Medium | 5.3 | 2017-05-01 | Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message. |
CVE-2017-7615 | High | 8.8 | 2017-04-16 | MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php. |
CVE-2016-8716 | High | 7.5 | 2017-04-12 | An exploitable Cleartext Transmission of Password vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running fir… |
CVE-2017-2766 | Critical | 9.8 | 2017-02-03 | EMC Documentum eRoom version 7.4.4, EMC Documentum eRoom version 7.4.4 SP1, EMC Documentum eRoom version prior to 7.4.5 P04, EMC Documentum eRoom version prior… |
CVE-2017-5594 | High | 7.5 | 2017-01-25 | An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug… |
CVE-2016-7038 | High | 7.3 | 2017-01-20 | In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed. |
CVE-2016-2349 | High | 7.5 | 2016-12-21 | Remedy AR System Server in BMC Remedy 8.1 SP 2, 9.0, 9.0 SP 1, and 9.1 allows attackers to reset arbitrary passwords via a blank previous password. |
CVE-2016-5997 | Medium | 6.5 | 2016-09-26 | The web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A before 9.0.1… |
CVE-2016-5996 | High | 7.5 | 2016-09-26 | The web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A before 9.0.1… |