CVE-2024-38287

CRITICAL Year: 2024
CVSS v3 Score
9.1
Critical
Weakness Type
CWE-640
View all →

Vulnerability Description

The password-reset mechanism in the Forgot Password functionality in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to force the application into resetting the administrator's password to a random insecure 8-digit value.

Related Vulnerabilities

CVE-2019-6560

CRITICAL
CVSS:9.1(Critical)

In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the software contains a mechanism for users to recover or change their passwords wit...

CWE-6402019

CVE-2021-25323

CRITICAL
CVSS:9.1(Critical)

The default setting of MISP 2.4.136 did not enable the requirements (aka require_password_confirmation) to provide the previous password when changing a password.

CWE-6402021

CVE-2017-12850

HIGH
CVSS:8.8(High)

An authenticated standard user could reset the password of other users (including the admin) by altering form data. Affects kanboard before 1.0.46.

CWE-6402017

CVE-2017-12851

HIGH
CVSS:8.8(High)

An authenticated standard user could reset the password of the admin by altering form data. Affects kanboard before 1.0.46.

CWE-6402017

CVE-2017-7615

HIGH
CVSS:8.8(High)

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.

CWE-6402017

CVE-2018-0787

HIGH
CVSS:8.8(High)

ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core Elevation Of Privilege...

CWE-6402018