CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
GitLab CE/EE Account Takeover via Password Reset Vulnerability (CVE-2023-7028) Security Advisory
[Affected Scope] GitLab CE/EE versions 16.1 to 16.7.1 (prior to 16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, and 16.7.2)
[Impact] An unauthenticated remote attacker can trigger password reset emails to be sent to an arbitrary, unverified email address, leading to complete account takeover.
[Mitigation] Immediately upgrade GitLab instances to the patched versions (16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, 16.7.2 or later) and enforce Multi-Factor Authentication (MFA).
October CMS Account Takeover and Authentication Bypass Vulnerability via Password Reset Flaw (CVE-2021-32648)
[Affected Scope] October CMS versions prior to Build 472 and v1.1.5 (affecting the october/system package)
[Impact] An attacker can bypass authentication and gain full access to any user account, including administrators, by sending a specially crafted password reset request.
[Mitigation] Immediately upgrade October CMS to Build 472, v1.1.5, or a newer version.