Skip to content
OpenAdvisories

Package · NuGet

Serenity.Net.Web

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 5.3
    CVE-2023-31286

    User account enumeration in Serenity

    An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When a password reset request occurs, the server response leaks the existence of users. If one tries to reset a password of a non-existent user, an error message indicates that this use…

    Serenity.Net.Core Serenity.Net.Web NuGet
  • High 7.8
    CVE-2023-31287

    Insufficient token expiration in Serenity

    An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. Password reset links are sent by email. A link contains a token that is used to reset the password. This token remains valid even after the password reset and can be used a second time …

    Serenity.Net.Core Serenity.Net.Web NuGet