When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
88 vulnerabilities with CWE-620
CVE-2024-9431
HIGH
transformeroptimus/superagi <0.0.14 - Privilege Escalation
CVSS 8.8
CVE-2024-13373
HIGH
Exertio Framework <1.3.1 - Privilege Escalation
CVSS 8.1
CVE-2024-12824
CRITICAL
Nokri - Job Board WordPress Theme <1.6.2 - Privilege Escalation
CVSS 9.8
CVE-2024-12860
CRITICAL
CarSpot < 2.4.3 - Unauthenticated Privilege Escalation via Password Change Token Validation Bypass
CVSS 9.8
CVE-2024-45647
MEDIUM
IBM Security Verify Access <10.0.9 - Privilege Escalation
CVSS 5.6
CVE-2024-13375
CRITICAL
Adifier System <3.1.7 - Privilege Escalation
CVSS 9.8
CVE-2024-28143
HIGH
Image Access Scan2Net 7.40 - Cross-Site Request Forgery Password Reset
CVSS 8.4
CVE-2024-51493
MEDIUM
OctoPrint <= 1.10.2 - Unverified Password Change via Stolen API Key
CVSS 5.3
CVE-2024-33699
CRITICAL
LevelOne WBR-6012 - Privilege Escalation
CVSS 9.9
CVE-2024-8794
MEDIUM
BA Book Everything <1.6.20 - Info Disclosure
CVSS 5.3
CVE-2024-21757
MEDIUM
Fortinet FortiManager/FortiAnalyzer <7.4.1 - Info Disclosure
CVSS 6.1
CVE-2024-26520
CRITICAL
Restaurant Digital Comprehensive Management <v1 - Auth Bypass
CVSS 9.8
CVE-2024-37998
CRITICAL
CPCI85 Central Processing/Communication < V5.40 - Privilege Escalation
CVSS 9.8
CVE-2024-20419
CRITICAL
Cisco Smart Software Manager (SSM) On-Prem Account Takeover (CVE-2024-20419)
CVSS 10.0
CVE-2024-27715
HIGH
Eskooly Free Online School <3.0 - Privilege Escalation
CVSS 8.2
CVE-2024-2213
LOW
zenml-io/zenml <0.55.4 - Auth Bypass
CVSS 3.3
CVE-2024-34077
HIGH
MantisBT < 2.26.2 - Unauthenticated Account Takeover via Password Reset Token Reuse
CVSS 7.3
CVE-2024-23637
MEDIUM
OctoPrint <= 1.9.3 - Unverified Password Change
CVSS 4.2
CVE-2023-4465
LOW
Poly Trio and CCX Devices - Unverified Password Change via Configuration File Import
CVSS 2.7
CVE-2023-2449
CRITICAL
UserPro < 5.1.1 - Unauthenticated Password Reset via Plaintext Reset Key
CVSS 9.8
CVE-2023-4214
HIGH
AppPresser <4.2.5 - Info Disclosure
CVSS 8.1
CVE-2023-5844
HIGH
pimcore admin_classic_bundle < 1.1.4 and admin-ui-classic-bundle < 1.2.0-RC1 - Unverified Password Change
CVSS 7.2
CVE-2023-4915
MEDIUM
WP User Control <1.5.3 - Info Disclosure
CVSS 5.3
CVE-2023-4381
MEDIUM
instantsoft/icms2 <2.16.1 - Info Disclosure
CVSS 4.3
CVE-2023-3069
CRITICAL
tsolucio/corebos <8 - Info Disclosure
CVSS 9.8
Details
Vulnerabilities
88