Knowledge Base - Issues
Our knowledge-base provides a comprehensive collection of information on vulnerabilities related to cyber security.Account Provisioning is an IT vulnerability of the category Identity Management, which occurs in Web and API. This vulnerability involves the ability to create and manage user accounts, allowing malicious actors to gain unauthorized access. According to the Common Weakness Enumeration (CWE) directory, Account Provisioning is a vulnerability that involves...
Admin account(s) which do not have the flag "this account is sensitive and cannot be delegated" is an IT vulnerability that falls within the category of Identity Management. This vulnerability occurs in Infrastructure when an administrator account is created without the sensitive flag, allowing users to access the account and...
Enumerable or guessable user accounts, classified as CWE-203: Observable Discrepancy, is an identity management vulnerability that occurs when it is possible to check for and collect valid login usernames by interacting with the service, without knowledge of the specific account credentials. This vulnerability can occur in web applications and APIs,...
Highly privileged accounts are not in the Protected Users group is an IT vulnerability related to identity management (CWE-264). This vulnerability occurs when privileged accounts are not part of the Protected Users group, allowing them to bypass the default security settings of the operating system. This type of vulnerability is...
Insecure password reset is a vulnerability (CWE-309) that is found in Identity Management systems. It allows an attacker to exploit the system and reset a user's account password without their knowledge or consent. This type of attack can be performed through web and API interfaces as well as through infrastructure...
Members in Schema Admins group is an IT vulnerability that falls under the Identity Management category. It occurs in Infrastructure, where the members of the Schema Admins group are given excessive privileges. This vulnerability is classified as CWE-267: Permissions, Privileges, and Access Controls. It is also an important factor in...
Missing email verification is a type of IT vulnerability that falls under the category of Identity Management. It occurs when an application does not require users to confirm their email address when registering for an account. This lack of verification allows malicious actors to easily create accounts with fake email...
If the password for an account is reset, the new password only needs to be typed once.
## Risk
If a new password is set without a second confirmation, the risk of a typing error is increased. This could result in a user locking themselves out of their account.
## Solution
To...
No "Remember me" opt out functionality is a vulnerability in web and API applications that have user authentication functionality. In particular, it refers to the inability for a user to opt out of the "Remember Me" option when logging in. This can open up the application to brute-force attacks by...
No confirmation mail after resetting password is a vulnerability in identity management systems that occurs when a user requests a password reset but does not receive a confirmation mail. This vulnerability was first identified in the CWE directory as CWE-804. It is also identified in the OWASP Testing Guide as...
No password change functionality is a vulnerability in the identity management of IT infrastructure, mobile apps and web and API applications. It is classified as CWE-257, which is described as "Failure to Change a Password in a timely manner". According to OWASP Testing Guide, this type of vulnerability occurs when...
Password reset token does not expire is a vulnerability related to identity management, found in web and API applications. It is listed in the Common Weakness Enumeration (CWE) directory as CWE-259. According to the OWASP Testing Guide, this vulnerability occurs when a user or application can generate a token that...
Password returned in later response is a type of authentication vulnerability when the server returns a valid password in later response, usually in the form of a cookie, session ID, or other form of authentication token. This type of vulnerability is classified as CWE-287 (Improper Authentication) in the Common Weakness...
Plaintext Storage of a Password is a vulnerability that occurs when a system stores a user’s password in plaintext, meaning the user’s password is not encrypted or hashed. The vulnerability can occur in both web and API systems as well as in infrastructure systems. According to the OWASP Testing Guide,...
Role manipulation is a type of vulnerability in the identity management domain, applicable to web and API infrastructure. This type of attack occurs when attackers gain access to a user account with greater privileges than their own, and then use the additional privileges to gain access to confidential data, modify...
Same password accepted in "password change" functionality is a web and API vulnerability that falls under identity management (CWE-822). This vulnerability occurs when an application allows the same password to be used for both new and old passwords when changing a user's password. This is a critical security flaw as...
Same password accepted in "password reset" functionality is an IT vulnerability that falls under the category of Identity Management. It is described in the Common Vulnerability Enumeration (CWE) directory as CWE-798. According to the OWASP Testing Guide, this vulnerability occurs when a web or API application allows the same password...
The vulnerability "Same person or identity can register multiple times" of category Identity Management occurs when users are able to register with the same personal information multiple times. This vulnerability is also described in the Common Weakness Enumeration (CWE) directory as CWE-602: Client-Side Enforcement of Server-Side Security. The Open Web...
SSL Certificate Cannot Be Trusted is a vulnerability in the identity management category of the Common Weakness Enumeration (CWE) directory. It occurs when an SSL certificate is not validated and the user is not sure if the website they are visiting is genuine or not. This vulnerability can be tested...
Use of Default Credentials is a type of vulnerability in identity management that occurs when a system or application uses a generic username and password combination that is known by many users. This is a security risk because it makes it easier for attackers to gain access to the system...
Use of Hard-coded Credentials (CWE-798) is a type of Identity Management vulnerability that occurs when credentials such as passwords, usernames, or keys are hard-coded into applications or services. This type of vulnerability is commonly found in Web and API applications and is listed as one of the CWE Top 25...
User account is not being deleted after "Delete Account" is an IT vulnerability in the category of Identity Management that applies to Web and API. It is identified in the Common Weakness Enumeration (CWE) directory as CWE-530: Exposure of Sensitive Information During Deletion. This vulnerability is often caused when a...
Weak password rules is a vulnerability in identity management that occurs when a system allows users to set weak passwords, such as those that are too short or do not contain the required complexity. This vulnerability has been assigned the Common Weakness Enumeration (CWE) ID 521. According to the Open...
Windows Active Directory Password Policy is a vulnerability in the Microsoft Windows operating system that affects the security of its users. This vulnerability allows attackers to bypass the usual password policy set in a Windows environment, such as minimum password length, complexity, and expiration times. This vulnerability is classified as...
Showing entries 1 to 24 of 24 entries.