This may allow an attacker to brute-force users’ passwords with minimal to no computational effort. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. This allows the attacker to gain access to the highest privileged user in the application. Any application user in the application who has update user permission enabled is able to change the password of other users, including the administrator’s. In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed.

In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration. This allows attackers to enumerate the registered users' email addresses. When requesting a password reset for a given email address, the application displays an error message when the email isn't registered within the system. In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature.

Improper authentication vulnerability in Samsung Internet prior to 16.0.2.19 allows attackers to bypass secret mode password authentication Jenkins Publish Over SSH Plugin 1.22 and earlier stores password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to retrieve all username/password credentials stored on the Jenkins controller.

Hot alarm clock 5.1.0.0