Advisories · Weakness

CWE-640.

Every Advisory and CVE whose sources give the weakness CWE-640, newest first.

contao/contao +2 Packagist

CVSS 9.8 CriticalCritical · CVSS 9+

Contao Does Not Invalidate Existing Sessions When Password Changes
- CWE-640
>=4.0.0, <4.4.37 || >=4.5.0, <4.7.3 · fixed in 4.4.37, 4.7.3

GHSA-vcgg-hp4r-87gx · CVE-2019-10641 Not analysed yet 14 May 2022
mantisbt/mantisbt Packagist

CVSS 8.8 HighCritical · CVSS 7+ and EPSS

MantisBT allows arbitrary password reset
- CWE-640
>=1.3.0-rc.2, <1.3.10 || >=2.0.0, <2.2.4 || >=2.3.0, <2.3.1 · fixed in 1.3.10, 2.2.4, 2.3.1

GHSA-252r-f55f-ff34 · CVE-2017-7615 Not analysed yet 13 May 2022
moodle/moodle Packagist

CVSS 7.3 High

Moodle Weak Password Recovery Mechanism for Forgotten Password
- CWE-640
>=2.7, <2.7.16 || >=2.9, <2.9.8 || >=3.0, <3.0.6 || >=3.1, <3.1.2 · fixed in 2.7.16, 2.9.8, 3.0.6, 3.1.2

GHSA-2phx-w35g-x9vm · CVE-2016-7038 Not analysed yet 13 May 2022
pagekit/pagekit Packagist

CVSS 7.5 High

Pagekit Weak Password Recovery Mechanism for Forgotten Password
- CWE-640
<1.0.11 · fixed in 1.0.11

GHSA-rp89-32rp-qpq2 · CVE-2017-5594 Not analysed yet 13 May 2022
org.cloudfoundry.identity:cloudfoundry-identity-server Maven

CVSS 3.7 Low

Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password
- CWE-640
<2.2.5 · fixed in 2.2.5

GHSA-fj69-p8f6-q97h · CVE-2015-3189 Not analysed yet 13 May 2022
org.cloudfoundry.identity:cloudfoundry-identity-server Maven

CVSS 9.8 CriticalCritical · CVSS 9+

Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password
- CWE-640
<2.5.2 · fixed in 2.5.2

GHSA-cq6m-74r4-x77g · CVE-2015-5172 Not analysed yet 13 May 2022
craftcms/cms Packagist

CVSS 8.8 High

Improper account password reset in Craft CMS
- CWE-640
<3.7.36 · fixed in 3.7.36

GHSA-5cjr-78cq-3wrg · CVE-2022-29933 Not analysed yet 10 May 2022
shopware/shopware Packagist

CVSS 6.4 Medium

Multiple valid tokens for password reset in Shopware
- CWE-640
>=5.0.4, <5.7.9 · fixed in 5.7.9

GHSA-3qrq-r688-vvh4 · CVE-2022-24892 Not analysed yet 28 Apr 2022
CVE-2022-1073 CVE record

CVSS 7.3 High

Automatic Question Paper Generator password recovery
- Automatic Question Paper Generator
- CWE-640
Not analysed yet 29 Mar 2022
microweber/microweber Packagist

CVSS 7.3 High

Rate limit missing in microweber
- CWE-640
<1.3 · fixed in 1.3

GHSA-7r79-mrp6-8mhq · CVE-2022-0777 Not analysed yet 2 Mar 2022
org.xwiki.platform:xwiki-platform-web Maven

CVSS 5.3 Medium

Information exposure in xwiki-platform
- Information disclosure
- CWE-640
>=13.5RC1, <13.6RC1 || >=13.0.0, <13.4.1 || <12.10.9 · fixed in 13.6RC1, 13.4.1, 12.10.9

GHSA-35fg-hjcr-j65f · CVE-2022-23619 Not analysed yet 9 Feb 2022
CVE-2021-27654 CVE record

CVSS 8.8 High

Weak password recovery in Pegasystems Pega Infinity
- Pegasystems Pega Infinity
- CWE-640
Not analysed yet 28 Jan 2022
Umbraco.Cms.Core NuGet

CVSS 6.8 Medium

Umbraco Persistent Password Reset Poison
- HTTP request smuggling
- CWE-640
<9.2.0 · fixed in 9.2.0

GHSA-r8pr-83cc-ccv7 · CVE-2022-22691 Not analysed yet 21 Jan 2022
strapi npm

CVSS 8.1 High

Weak Password Recovery Mechanism for Forgotten Password in Strapi
- CWE-640
<=3.6.0 · no fixed version yet

GHSA-37hx-4mcq-wc3h · CVE-2021-28128 Not analysed yet 6 Oct 2021
CVE-2021-25961 CVE record

CVSS 8.0 High

SuiteCRM - Account Takeover in Password Reset Functionality
- salesagility SuiteCRM
- CWE-640
Not analysed yet 29 Sept 2021
dolibarr/dolibarr Packagist

CVSS 8.8 High

Weak Password Recovery Mechanism for Forgotten Password
- CWE-640
<14.0.0 · fixed in 14.0.0

GHSA-c32w-3cqh-f6jx · CVE-2021-25957 Not analysed yet 2 Sept 2021
akaunting/akaunting Packagist

CVSS 5.4 Medium

Malicious password-reset in Akaunting
- CWE-640
<2.1.13 · fixed in 2.1.13

GHSA-246r-r2wf-frhx · CVE-2021-36804 Not analysed yet 1 Sept 2021
CVE-2021-37693 CVE record

CVSS 5.3 Medium

Re-use of email tokens in Discourse
- discourse
- Authentication bypass
- CWE-640
Not analysed yet 13 Aug 2021
CVE-2021-22763 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Weak password recovery in PowerLogic PM55xx, PowerLogic PM8ECC…
- PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation)
- CWE-640
Not analysed yet 11 Jun 2021
CVE-2021-22731 CVE record

Weak password recovery in Modicon Managed Switch MCSESM* and MCSESP* V8.21 and prior
- Modicon Managed Switch MCSESM* and MCSESP* V8.21 and prior
- CWE-640
Not analysed yet 26 May 2021
indico PyPI

CVSS 7.5 High

Indico Tampering with links (e.g. password reset) in sent emails
- CWE-640
<2.3.4 · fixed in 2.3.4

GHSA-wgpj-7c2j-vfjm · CVE-2021-30185 Not analysed yet 8 Apr 2021
CVE-2020-5361 CVE record

CVSS 5.1 Medium

Weak password recovery in Dell CPG BIOS
- Dell CPG BIOS
- CWE-640
Not analysed yet 4 Jan 2021
CVE-2019-6560 CVE record

Weak password recovery in Auto-Maskin RP210E Versions 3.7 and prior DCU210E Versions 3.7 and prior and…
- Auto-Maskin RP210E Versions 3.7 and prior DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App)
- CWE-640
Not analysed yet 23 Mar 2020
django PyPI

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Django Potential account hijack via password reset form
- CWE-640
<1.11.27 || >=2.0, <2.2.9 || >=3.0, <3.0.1 · fixed in 1.11.27, 2.2.9, 3.0.1

GHSA-vfq6-hq5r-27r6 · CVE-2019-19844 Not analysed yet 16 Jan 2020
strapi npm

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Strapi allows unauthenticated attacker to reset admin password without valid reset token
- CWE-640
<3.0.0-beta.17.5 · fixed in 3.0.0-beta.17.5

GHSA-6xc2-mj39-q599 · CVE-2019-18818 Not analysed yet 2 Dec 2019
CVE-2018-16529 CVE record

Weak password recovery in Forcepoint Email Security
- Forcepoint Email Security
- CWE-640
Not analysed yet 28 Mar 2019
Microsoft.AspNetCore.HttpOverrides +1 NuGet

CVSS 8.8 High

ASP.NET Core allow an elevation of privilege
- CWE-640
>=2.0.0, <2.0.2 · fixed in 2.0.2

GHSA-365p-96qv-xr7g · CVE-2018-0787 Not analysed yet 16 Oct 2018