Advisories · Weakness
CWE-620.
Every Advisory and CVE whose sources give the weakness CWE-620, newest first.
- CVSS 6.9 Medium
D-Link DI-7003GV2 webgl.asp sub_41F4F0 unverified password change
- D-Link DI-7003GV2
- CWE-620
- CWE-640
- CVSS 2.7 Low
Unverified Password Change
- Schweitzer Engineering Laboratories SEL Blueframe OS
- CWE-620
- CVSS 9.3 CriticalCritical · CVSS 9+
WormHole Tech GPM - Unverified Password Change
- WormHole Tech GPM
- CWE-620
- CVSS 5.3 Medium
ContiNew Admin password unverified password change
- ContiNew Admin
- CWE-620
- CWE-640
- CVSS 9.8 CriticalCritical · CVSS 9+
IMITHEMES Listing <= 3.3 - Unauthenticated Privilege Escalation via Unverified Password Reset
- IMITHEMES Listing
- CWE-620
- CVSS 2.1 Low
Unverified Password Change
- ABB ANC
- ABB ANC-L
- CWE-620
- CVSS 9.8 CriticalCritical · CVSS 9+
Flynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Password Update
- v1rustyle Flynax Bridge
- CWE-620
- CVSS 4.2 Medium
Buddypress Force Password Change <= 0.1 - Authenticated (Subscriber+) Account Takeover via Password Update
- lamarant Buddypress Force Password Change
- CWE-620
- CVSS 8.8 High
Frontend Login and Registration Blocks <= 1.0.8 - Authenticated (Subscriber+) Privilege Escalation via Password Reset
- arkenon Login, Registration and Lost Password Blocks
- CWE-620
- CVSS 5.3 Medium
YXJ2018 SpringBoot-Vue-OnlineExam studentPWD unverified password change
- YXJ2018 SpringBoot-Vue-OnlineExam
- CWE-620
- CWE-640
- CVSS 9.3 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Fortinet FortiSwitch: A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote…
- Fortinet FortiSwitch
- CWE-620
- CVSS 6.9 Medium
A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions).
- Siemens SENTRON 7KT PAC1260 Data Manager
- CWE-620
- CVSS 6.5 Medium
Improper Privilege Management in transformeroptimus/superagi
- transformeroptimus/superagi
- CWE-620
- CVSS 8.1 High
Exertio Framework <= 1.3.1 - Unauthenticated Arbitrary User Password Update
- scriptsbundle Exertio Framework
- CWE-620
- CVSS 9.8 CriticalCritical · CVSS 9+
Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change
- scriptsbundle Nokri – Job Board WordPress Theme
- CWE-620
- CVSS 9.8 CriticalCritical · CVSS 9+
CarSpot – Dealership Wordpress Classified Theme <= 2.4.3 - Unauthenticated Arbitrary Password Reset/Account Takeover
- scriptsbundle CarSpot – Dealership Wordpress Classified Theme
- CWE-620
- CVSS 9.9 CriticalCritical · CVSS 9+
Unverified password change vulnerability in Janto
- Impronta Janto
- CWE-620
- CVSS 5.6 Medium
IBM Security Verify Access unverified password change
- IBM Security Verify Access
- IBM Security Verify Access Docker
- CWE-620
- CVSS 9.8 CriticalCritical · CVSS 9+
Adifier System <= 3.1.7 - Unauthenticated Arbitrary Password Reset
- spoonthemes Adifier System
- CWE-620
- CVSS 8.4 High
Insecure Password Change Function
- Image Access GmbH Scan2Net
- CWE-620
- CVSS 5.3 Medium
OctoPrint has API key access in settings without reauthentication
- Authentication bypass
- CWE-620
<1.10.3 · fixed in 1.10.3
GHSA-cc6x-8cc7-9953 · CVE-2024-51493 - CVSS 9.9 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
LevelOne WBR-6012: The LevelOne WBR-6012 router's web application has a vulnerability in its firmware…
- LevelOne WBR-6012
- CWE-620
- CVSS 5.3 Medium
BA Book Everything <= 1.6.20 - Unauthenticated Arbitrary User Password Reset
- bookingalgorithms BA Book Everything
- CWE-620
- CVSS 5.5 Medium
Fortinet FortiManager: A unverified password change in Fortinet FortiManager versions 7.0.0 through 7.0.10…
- Fortinet FortiManager
- Fortinet FortiAnalyzer
- CWE-620
- CVSS 9.8 CriticalCritical · CVSS 9+
An issue in Hangzhou Xiongwei Technology Development Co., Ltd.
- CWE-620
- CVSS 9.3 CriticalCritical · CVSS 9+
Siemens CPCI85 Central Processing/Communication: A vulnerability has been identified in CPCI85 Central Processing/Communication (All…
- Siemens CPCI85 Central Processing/Communication
- Siemens SICORE Base system
- CWE-620
- CVSS 10.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Cisco Smart Software Manager On-Prem: A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM…
- Cisco Smart Software Manager On-Prem
- CWE-620
- CVSS 8.2 High
An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via a crafted request to the Password Change mechanism.
- CWE-620
- CVSS 3.3 Low
An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account pa...
- CWE-620
<0.56.3 · fixed in 0.56.3
GHSA-j527-v579-m98h · CVE-2024-2213 - CVSS 7.3 High
Mantis Bug Tracker (MantisBT) allows user account takeover in the signup/reset password process
- CWE-305
- CWE-620
<2.26.2 · fixed in 2.26.2
GHSA-93x3-m7pw-ppqm · CVE-2024-34077 - CVSS 4.2 Medium
OctoPrint Unverified Password Change via Access Control Settings
- Authentication bypass
- CWE-620
<1.10.0rc1 · fixed in 1.10.0rc1
GHSA-5626-pw9c-hmjr · CVE-2024-23637 - CVSS 2.7 Low
Poly VVX 601 Configuration File Import unverified password change
- Poly Trio 8300
- Poly Trio 8500
- CWE-620
- CVSS 8.1 High
Expired tokens can be renewed without validating the account password
- CWE-620
<2023.12.19 · fixed in 2023.12.19
GHSA-9wgg-m99q-hhfc - CVSS 9.8 CriticalCritical · CVSS 9+
UserPro <= 5.1.1 - Insecure Password Reset Mechanism
- UserPro - Community and User Profile WordPress Plugin
- CWE-620
- CVSS 8.1 High
AppPresser <= 4.2.5 - Insecure Password Reset Mechanism
- scottopolis AppPresser – Mobile App Framework
- CWE-620
- CVSS 4.3 Medium
pimcore/admin-ui-classic-bundle Unverified Password Change
- Authentication bypass
- CWE-620
<1.2.0-RC1 · fixed in 1.2.0-RC1
GHSA-6f58-j323-6472 · CVE-2023-5844 - CVSS 5.3 Medium
WP User Control <= 1.5.3 - Insecure Password Reset Mechanism
- wmsedgar WP User Control
- CWE-620
- CVSS 4.3 Medium
Unverified Password Change in instantsoft/icms2
- instantsoft/icms2
- CWE-620
- CVSS 7.6 High
Unverified Password Change in tsolucio/corebos
- tsolucio/corebos
- CWE-620
- CVSS 9.8 CriticalCritical · CVSS 9+
Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset Mechanism
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- CWE-620
- CVSS 6.4 Medium
Medtronic Micro Clinician & InterStim X Clinician App Password Reset Issue
- Medtronic InsterStim Applications
- CWE-620
- CVSS 9.6 CriticalCritical · CVSS 9+
Unverified Password Change in phpfusion/phpfusion
- phpfusion/phpfusion
- CWE-620
- CVSS 5.3 Medium
Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3.
- CWE-620
<1.8.3 · fixed in 1.8.3
GHSA-39gf-864w-pxw4 · CVE-2022-2930 - CVSS 7.5 High
Metasys password guessing
- Johnson Controls Metasys ADS/ADX/OAS server
- CWE-620
- CVSS 8.0 High
Metasys Unverified Password Change
- Johnson Controls Metasys ADS/ADX/OAS server
- CWE-620
- CVSS 6.5 Medium
Cisco BroadWorks CommPilot Application Software Vulnerabilities
- Cisco BroadWorks
- CWE-620
- CVSS 6.5 Medium
Cisco BroadWorks CommPilot Application Software Vulnerabilities
- Cisco BroadWorks
- CWE-620
-
EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…: A CWE-620: Unverified Password Change vulnerability exists in EVlink City (EVC1S22P4 /…
- EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 )
- CWE-620
- CVSS 9.1 CriticalCritical · CVSS 9+
CRIXP OpenCRX Unverified Password Change
- CRIXP OpenCRX
- CWE-620
- CVSS 6.3 Medium
Synology DiskStation Manager (DSM): Unverified password change vulnerability in Change Password in Synology DiskStation…
- Synology DiskStation Manager (DSM)
- CWE-620
-
ProMinent MultiFLEX M10a Controller: An Unverified Password Change issue was discovered in ProMinent MultiFLEX M10a Controller…
- ProMinent MultiFLEX M10a Controller
- CWE-620