CVE-2019-15799

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. User accounts created through the web interface of the device, when given non-admin level privileges, have the same level of privileged access as administrators when connecting to the device via SSH while their...

CVE-2010-3305

Cross-site request forgery CSRF vulnerability in pixelpost 1.7.3 could allow remote attackers to change the admin password...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in pixelpost 1.7.3 could allow remote attackers to change the admin password...

CVE-2010-3305

Cross-site request forgery CSRF vulnerability in pixelpost 1.7.3 could allow remote attackers to change the admin password...

CVE-2010-3305

This entry concerns CVE-2010-3305, a CSRF vulnerability in Pixelpost 1.7.3 that could allow remote attackers to change the admin password. The connected documents confirm the affected software/version and the underlying issue (CSRF) with implications for admin credentials. The provided materials ...

eMerge E3 1.00-06 - Cross-Site Request Forgery Vulnerability

Exploit for hardware platform in category web applications Exploit Title: eMerge E3 1.00-06 - Cross-Site Request Forgery Exploit Author: LiquidWorm Vendor Homepage: http://linear-solutions.com/nscfamily/e3-series/ Software Link: http://linear-solutions.com/nscfamily/e3-series/ Version: 1.00-06...

Nortek Linear eMerge E3 Access Control Cross Site Request Forgery

Nortek Linear eMerge E3 Access Control Cross-Site Request Forgery CVE: CVE-2019-7262 Advisory: https://applied-risk.com/resources/ar-2019-005 Discovered by Gjoko 'LiquidWorm' Krstic input type="hidden" name="DefaultFloorNo" valu...

Privilege Escalation

Overview Versions of strapi prior to 3.0.0-beta.17.5 are vulnerable to Privilege Escalation. The password reset routes allows an unauthenticated attacker to reset an admin's password without providing a valid password reset token. Recommendation Upgrade to version 3.0.0-beta.17.5 or later...

Improper access control

Computing For Good's Basic Laboratory Information System also known as C4G BLIS version 3.4 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may change the password of any administrator-level user...

Amazon Linux 2 : keycloak-httpd-client-install (ALAS-2019-1324)

It was discovered that keycloak-httpd-client-install uses a predictable log file name in /tmp. A local attacker could create a symbolic link to a sensitive location, possibly causing data corruption or denial of service.CVE-2017-15111 In keycloak-http-client-install prior to version 0.8, the admi...

Low: keycloak-httpd-client-install

Issue Overview: It was discovered that keycloak-httpd-client-install uses a predictable log file name in /tmp. A local attacker could create a symbolic link to a sensitive location, possibly causing data corruption or denial of service.CVE-2017-15111 In keycloak-http-client-install prior to versi...

CVE-2019-17521

An issue was discovered in Landing-CMS 0.0.6. There is a CSRF vulnerability that can change the admin's password via the password/ URI,...

CVE-2019-17521

An issue was discovered in Landing-CMS 0.0.6. There is a CSRF vulnerability that can change the admin's password via the password/ URI,...

Cross site request forgery (csrf)

An issue was discovered in Landing-CMS 0.0.6. There is a CSRF vulnerability that can change the admin's password via the password/ URI,...

CVE-2019-17521

An issue was discovered in Landing-CMS 0.0.6. There is a CSRF vulnerability that can change the admin's password via the password/ URI,...

Authentication flaw

Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanChanged.cgi. The attacker can then, for example, visit MNUaccessPasswordrecovered.html to obtain a valid new admin password. This affects AC1450, D8500, DC112A, JNDR3000, LG2200D,...

CVE-2019-17372

CVE-2019-17372 affects multiple NETGEAR consumer routers (e.g., AC1450, D8500, R4500, R6300/R6300v2, R7000/R7000P, WNR3500L, WNDR4500/v2, WNDR4000, WNDR4500v2, WNR1000/v3, etc.). The underlying issue is an authentication bypass that allows remote attackers to disable all authentication by visitin...

CVE-2019-15068

A broken access control vulnerability in Smart Battery A4, a multifunctional portable charger, firmware version ?= r1.7.9 allows an attacker to get/reset administrator’s password without any authentication...

CVE-2019-11326

An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product is protected by a login. A guest is allowed to login. Once logged in as a guest, an attacker can browse a URL to read the password of the administrative user. The same...

HPSBPI06327 rev. 1 - Execution of Arbitrary Code for HP LaserJet, PageWide, OfficeJet Enterprise, and LaserJet Managed Printers

Potential Security Impact Execution of arbitrary code VULNERABILITY SUMMARY Solution application signature checking may allow potential execution of arbitrary code. RESOLUTION Perform the following steps to help mitigate the vulnerability. 1. Update firmware for impacted printers as indicated in...