Jason Juntunen

**Name of the Vulnerable Software and Affected Versions** ClickStudios Passwordstate Password Reset Portal versions prior to 8501 **Description** The issue concerns an authentication bypass. Specifically, the `ResetPassword` function does not validate whether the user has successfully authenticated using security questions. This allows an unauthenticated, remote attacker to send a crafted HTTP request to the "/account/ResetPassword" page to set a new password for any registered user. **Recommendations** For versions prior to 8501, update to build 8501 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/account/ResetPassword" page until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Zoho ManageEngine ADSelfService Plus versions prior to 5.5 build 5517 **Description** The issue allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a spoofing attack can redirect the browser to gain execution in the context of the WinLogon.exe process. If Network Level Authentication is not enforced, the issue can be exploited via RDP. Additionally, if the web server has a misconfigured certificate then no spoofing attack is required. **Recommendations** For versions prior to 5.5 build 5517, update to version 5.5 build 5517 or later to resolve the issue. As a temporary workaround, consider enforcing Network Level Authentication and ensuring the web server has a properly configured certificate to minimize the risk of exploitation. Restrict access to the custom GINA/CP module to minimize the risk of exploitation until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** ANIXIS Password Reset Client versions prior to 3.22 **Description** The issue allows remote attackers to execute code and escalate privileges via spoofing. When the client is configured to use HTTP, it does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a spoofing attack can redirect the browser to gain execution in the context of the WinLogon.exe process. If Network Level Authentication is not enforced, the issue can be exploited via RDP. **Recommendations** For versions prior to 3.22, update to version 3.22 or later to resolve the issue. As a temporary workaround, consider configuring the client to use a secure connection protocol instead of HTTP and enforcing Network Level Authentication to minimize the risk of exploitation. Restrict access to RDP connections when possible to further reduce the risk.