Design/Logic Flaw

Yealink phones through 2019-08-04 do not properly check user roles in POST requests. Consequently, the default User account with a password of user can make admin requests via HTTP...

CVE-2019-14656

Yealink phones through 2019-08-04 do not properly check user roles in POST requests. Consequently, the default User account with a password of user can make admin requests via HTTP...

CVE-2019-14656

Summary: CVE-2019-14656 affects Yealink phones through 2019-08-04. The issue stems from inadequate role checks in POST requests, enabling the default User account (password: user) to issue admin requests over HTTP. It has high impact per CVSS metrics (network access, low privileges required, UI/N...

ESPCMS suffers from CSRF vulnerability

ESPCMS is an enterprise website management system built on LAMP development. ESPCMS suffers from a CSRF vulnerability. An attacker can exploit this vulnerability to forge administrator requests and perform unauthorized operations...