Ability to change order address without triggering address validations in solidus

Impact This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zo...

Unspecified Vulnerability in Mattermost Server (CNVD-2020-35328)

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 3.0.0. An attacker could exploit the vulnerability to change the account name and e-mail address of an LDAP account...

CVE-2019-20875

Mattermost Server vulnerable versions prior to 5.9.0, 5.8.1, 5.7.3, and 4.10.8 allow a password reset to proceed while an email address is being changed. Nexus of the issue is not detailed in the provided documents beyond this description. Affected component is the password reset flow; root cause...

CVE-2020-9330

Certain Xerox WorkCentre printers before 073.xxx.000.02300 do not require the user to reenter or validate LDAP bind credentials when changing the LDAP connector IP address. A malicious actor who gains access to affected devices e.g., by using default credentials can change the LDAP connection IP...

Nord Security: Password Reset Link Works Multiple Times

Background: Normally, a secure way to handle password reset links is to invalidate the link/token upon usage. Additionally, if multiple reset links are requested, older & unused tokens should also be invalidated i.e., if 2 reset tokens were requested, the 2nd token should be invalid upon your usa...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Storefront Application in DS Data Systems KonaKart before 7.3.0.0 allows remote attackers to hijack the authentication of administrators for requests that change a user email address via an unspecified GET request...

CVE-2019-18790

An issue was discovered in channels/chansip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Certified Asterisk 13.21 before cert5. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls...

CVE-2019-18790

An issue was discovered in channels/chansip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Certified Asterisk 13.21 before cert5. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls...

Authentication flaw

An issue was discovered in channels/chansip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Certified Asterisk 13.21 before cert5. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls...

UBUNTU-CVE-2019-18790

An issue was discovered in channels/chansip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Certified Asterisk 13.21 before cert5. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls...

CVE-2019-18790

CVE-2019-18790ffects Sangoma Asterisk chan_sip.c: a SIP request can alter a peer’s IP address to hijack calls. Affected: Asterisk 13.x <13.29.2, 16.x <16.6.2, 17.x <17.0.1; Certified Asterisk

asterisk -- SIP request can change address of a SIP peer

The Asterisk project reports: A SIP request can be sent to Asterisk that can change a SIP peers IP address. A REGISTER does not need to occur, and calls can be hijacked as a result. The only thing that needs to be known is the peers name; authentication details such as passwords do not need to be...

Cloud Foundry UAA Authorization Issues Vulnerability

Cloud Foundry UAA is an authentication and managed service endpoint for the CloudFoundry Cloud Platform. An authorization issue vulnerability exists in Cloud Foundry UAA versions prior to v70.0. An attacker could exploit this vulnerability to impersonate another user by changing their address to...

CVE-2018-19580

CVE-2018-19580 affects GitLab versions prior to 11.5.1, 11.4.8, and 11.3.11. The issue is that when an account’s email address is changed, GitLab does not send a notification email to the old address. The connected documents confirm the affected versions and the observed behavior, but do not prov...

AMAC Address Change 5.4 - Denial of Service Exploit

Exploit Title: a-Mac Address Change v5.4 - Denial of Service PoC Discovery by: Rafael Pedrero Vendor Homepage: http://amac.paqtool.com/ Software Link : http://amac.paqtool.com/ Tested Version: 5.4 Tested on: Windows XP SP3 Vulnerability Type: Denial of Service DoS Local Buffer Overflow Steps to...

Mail.ru: [api.pandao.ru] IDOR позволяет изменять адрес любого пользователя

IDOR in deliveryProfiles API of pandao.ru marketplace allowed to change delivery address of arbitrary user On the time of reporting, pandao.ru runs temporary pre-bug bounty competition program with $1000 bounties for vulnerabilities related to money/points/orders manipulation...

Design/Logic Flaw

An issue was discovered in the Paymorrow module 1.0.0 before 1.0.2 and 2.0.0 before 2.0.1 for OXID eShop. An attacker can bypass delivery-address change detection if the payment module doesn't use eShop's checkout procedure properly. To do so, the attacker must change the delivery address to one...

CVE-2018-14020

An issue was discovered in the Paymorrow module 1.0.0 before 1.0.2 and 2.0.0 before 2.0.1 for OXID eShop. An attacker can bypass delivery-address change detection if the payment module doesn't use eShop's checkout procedure properly. To do so, the attacker must change the delivery address to one...

Haiwell C10S0R(-e) PLC has an Override Access Vulnerability

C10S0R-e PLC is a product in the programmable logic controller PLC series of Xiamen Haiwei Technology Co. The Haiwell C10S0R-e PLC suffers from an over-the-horizon access vulnerability that can be exploited by an attacker to change the IP of the PLC through unauthorized construction of specific...

Maliciously Changing Someone's Address

Someone changed the address of UPS corporate headquarters to his own apartment in Chicago. The company discovered it three months later. The problem, of course, is that in the US there isn't any authentication of change-of-address submissions: According to the Postal Service, nearly 37 million...