https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 21:19:16 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-216452 EUVD-2026-216452 https://cve.radiocsirt.org/vuln/euvd-2026-216452 https://cve.radiocsirt.org/vuln/fkie_cve-2023-31287 <p>An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. Password reset links are sent by email. A link contains a token that is used to reset the password. This token remains valid even after the password reset and can be used a second time to change the password of the corresponding user. The token expires only 3 hours after issuance and is sent as a query parameter when resetting. An attacker with access to the browser history can thus use the token again to change the password in order to take over the account.</p> <p>An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. Password reset links are sent by email. A link contains a token that is used to reset the password. This token remains valid even after the password reset and can be used a second time to change the password of the corresponding user. The token expires only 3 hours after issuance and is sent as a query parameter when resetting. An attacker with access to the browser history can thus use the token again to change the password in order to take over the account.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-31287 https://cve.radiocsirt.org/vuln/ghsa-2hp9-3xfr-r9w2 <p><strong>Affected:</strong> NuGet: Serenity.Net.Core, NuGet: Serenity.Net.Web</p> <p>An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. Password reset links are sent by email. A link contains a token that is used to reset the password. This token remains valid even after the password reset and can be used a second time to change the password of the corresponding user. The token expires only 3 hours after issuance and is sent as a query parameter when resetting. An attacker with access to the browser history can thus use the token again to change the password in order to take over the account.</p> <p><strong>Affected:</strong> NuGet: Serenity.Net.Core, NuGet: Serenity.Net.Web</p> <p>An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. Password reset links are sent by email. A link contains a token that is used to reset the password. This token remains valid even after the password reset and can be used a second time to change the password of the corresponding user. The token expires only 3 hours after issuance and is sent as a query parameter when resetting. An attacker with access to the browser history can thus use the token again to change the password in order to take over the account.</p> https://cve.radiocsirt.org/vuln/ghsa-2hp9-3xfr-r9w2 https://cve.radiocsirt.org/vuln/gsd-2023-31287 gsd-2023-31287 https://cve.radiocsirt.org/vuln/gsd-2023-31287