CVE-2023-40260: Improper Authentication

EmpowerID before 7.205.0.1 allows an attacker to bypass an MFA multi factor authentication requirement if the first factor username and password is known, because the first factor is sufficient to change an account's email address, and the product would then send MFA codes to the new email addres...

Code injection

In PHPJabbers Cleaning Business Software 1.0, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts...

CVE-2023-36134: Insufficient Verification of Data Authenticity

In PHP Jabbers Class Scheduling System 1.0, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts...

PT-2023-25449

Name of the Vulnerable Software and Affected Versions PHPJabbers Cleaning Business Software version 1.0 Description The issue allows remote attackers to take over accounts due to a lack of verification when changing an email address and/or password on the Profile Page. Recommendations For...

Admin user has an absolute power to withdraw all contract balance, which may raise red flags for investors

Lines of code Vulnerability details Impact Having rug-pull related code is always considered as a red flag for new investors. An admin, who's a single point of failure has access to withdraw function, which allows to withdraw the whole contract balance. Even if the owner is genuine the rug pull...

CVE-2023-3273

Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by changing settings of the device such as the IP address based on missing access control...

CVE-2023-3273: Improper Access Control

Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by changing settings of the device such as the IP address based on missing access control...

CVE-2023-26466

A user with non-Admin access can change a configuration file on the client to modify the Server URL...

Virtuozzo Hybrid Infrastructure 5.4 (5.4.0-133)

In this release, Virtuozzo Hybrid Infrastructure provides a range of new features that cover compute services, management node high availability, monitoring and alerts, and the user interface. Additionally, this release delivers stability improvements and addresses issues found in previous...

usememos/memos Improper Access Control vulnerability

usememos/memos 0.9.0 and prior is vulnerable to full account takeover via changing user name, email address, and display name...

GHSA-6W5W-WX8W-2CQ9 usememos/memos Improper Access Control vulnerability

usememos/memos 0.9.0 and prior is vulnerable to full account takeover via changing user name, email address, and display name...

CVE-2022-33186

A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions could allow a remote unauthenticated attacker to execute on a Brocade Fabric OS switch commands capable of modifying zoning, disabling the switch, disabling ports, and modifying the switch IP...

Single-step process for critical ownership transfer/renounce is risky

Lines of code Vulnerability details Single-step process for critical ownership transfer/renounce is risky Impact The following contracts and functions, allow owners to interact with core functions such as: execute, rawExecute and setApproval in OwnableSmartWallet registerKnotsToSyndicate,...

PT-2022-7651 · Siemens · Logo! 230Rce +7

Name of the Vulnerable Software and Affected Versions: LOGO! 12/24RCE versions 6ED1052-1MD08-0BA1 through 6ED1052-1MD08-0BA2 LOGO! 12/24RCEo versions 6ED1052-2MD08-0BA1 through 6ED1052-2MD08-0BA2 LOGO! 230RCE versions 6ED1052-1FB08-0BA1 through 6ED1052-1FB08-0BA2 LOGO! 230RCEo versions...

Default credentials

In Nagios XI through 5.8.5, it is possible for a user without password verification to change his e-mail address...

CVE-2022-31266

CVE-2022-31266 affects ILIAS up to version 7.10. The issue is a lack of verification when changing the email address on the Profile Page, which allows remote attackers to take over accounts. The vulnerability is documented across multiple sources (Red Hat, NVD, OSV, OpenVAS, CNNVD) with consisten...

PT-2022-20654

Name of the Vulnerable Software and Affected Versions ILIAS versions prior to 7.11 Description The issue allows remote attackers to take over accounts due to a lack of verification when changing an email address on the Profile Page. Recommendations For versions prior to 7.11, update to version 7....

Nagios XI 访问控制错误漏洞

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems and more. A security vulnerability exists in Nagios XI version 5.8.5 and prior versions. An attacker can exploit the...

[M-01] Cannot set or change curve pool after initialization

Lines of code Vulnerability details Impact Inability to set or change curve pool after initialization will hurt the project liquidity and block the ability to instant unstake from curve. Approving the CURVEPOOL address is done only on initialize and only if non zero address supplied. When using...

WordPress plugin Collaboration E-mails 跨站请求伪造漏洞

WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin Collaboration E-mails 2.2.0 and earlier versions are vulnerable to cross-site request forgery, which stems from a lack of...