CVE-2019-14666

GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any use...

Design/Logic Flaw

GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any use...

CVE-2019-11187

Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided...

Niushop B2B2C Multi-merchant Mall System Exploits Arbitrary Password Reset Vulnerability

NiuShop B2B2C Multi-Merchant Mall System is a PHP open source e-commerce system designed and developed completely independently by Shanxi NiuKu Information Technology Co. Niushop B2B2C Multi-merchant Mall System V1.11 version of the arbitrary password reset vulnerability, an attacker can use the...

CVE-2018-14885

Incorrect access control in the database manager component in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows a remote attacker to restore a database dump without knowing the super-admin password. An arbitrary password succeeds...

CVE-2018-14885

Incorrect access control in the database manager component in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows a remote attacker to restore a database dump without knowing the super-admin password. An arbitrary password succeeds...

CVE-2019-10270

An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible due to lack of verification and correlation between the reset password key sent by mail and the userid parameter to reset the password of another user. One only needs to know the...

Arbitrary Password Change Vulnerability in DCFW-1800-WAF-LAB

DCFW-1800 series next-generation firewalls can accurately identify thousands of network applications and provide detailed application risk analysis and flexible policy control. DCFW-1800-WAF-LAB suffers from an arbitrary password change vulnerability, which can be exploited by an attacker to chan...

Arbitrary Password Reset Vulnerability in MicroXia Online Learning Cloud Service Platform

Micro Xia Online Learning Cloud Service Platform is an online learning system based on B/S architecture. There exists an arbitrary password reset vulnerability in Weixia Online Learning Cloud Service Platform. An attacker can use the vulnerability to reset any user's password and obtain sensitive...

Arbitrary Password Reset Vulnerability in Companion Life App

The Companion Life App is an app for opening neighborhood gates. An arbitrary password reset vulnerability exists in Companion Life APP, which can be exploited by an attacker to reset any password...

Desdev DedeCMS Arbitrary Password Reset Vulnerability

Desdev DedeCMS Dream Weaving Content Management System is a PHP-based open-source content management system CMS of China Zhuozhuo network Desdev company. The system has content publishing , content management , content editing and content retrieval functions. A security vulnerability exists in th...

Arbitrary Password Change Vulnerability in Zhi Rui Elementary and Middle School Students' School Registration Information Management System

Zhirui Elementary and Middle School Students' School Registration Information Management System is an information system that collects students' basic information and reports it to the education administration department. There is an arbitrary password change vulnerability in Zhirui Elementary an...

Arbitrary Password Reset Vulnerability in eCar Insurance App

eCar Insurance is a mobile internet car insurance software application platform developed by Chengdu Zhongtong Technology Co. There is an arbitrary password reset vulnerability in eCar Insurance APP, which can be exploited by an attacker to change any user's password...

Vulnerability of the Data Management System of National Secondary Vocational Schools' Talent Cultivation Work Status due to Arbitrary Password Reset in the Backstage

Xinpengcheng is a high-tech enterprise specializing in vocational education informatization business. There is an arbitrary password reset vulnerability in the background of the National Secondary Vocational School Talent Cultivation Work Status Data Management System. An attacker can utilize thi...

Arbitrary Password Reset Vulnerability in Ruoyi Management System

Ruoyi management system is a SpringBoot2.0 based on the use of Spring, MyBatis, Shiro rights management system . Ruoyi Management System has an arbitrary password reset vulnerability that can be exploited by an attacker to reset any user's password...

Arbitrary Password Reset Vulnerability in YCCMS V3.3

YCCMS is a version of PHP5 + MYSQL as the technical basis for the development of lightweight CMS station-building system. YCCMS V3.3 has an arbitrary password reset vulnerability. The vulnerability is due to the background change the administrator user password failed to verify the original...

Authorization Bypass

neo4j-security-enterprise is vulnerable to an authorization bypass. The library does not properly reject failed login attempts during the STARTTLS operation, allowing a malicious user to log into the server with an existing username and an arbitrary password...

Arbitrary User Password Recovery Vulnerability in Smart Campus Platforms

Smart Campus Platform is a set of smart campus system developed by Guangdong ZhiNai Internet of Things Technology Co. The system involves a number of functional modules such as teaching scheduling, class transfer, class time statistics, teacher leave, student big data management platform,...

SemCms php version V2.7 is vulnerable to arbitrary password reset.

SemCms is an open source foreign trade enterprise website management system, mainly used for foreign trade enterprises, compatible with IE, Firefox and other mainstream browsers. SemCms php version V2.7 there is an arbitrary password reset vulnerability, attackers can use this vulnerability to...

CVE-2018-6617

Easy Hosting Control Panel EHCP v0.37.12.b, when using a local MySQL server, allows attackers to change passwords of arbitrary database users by leveraging failure to ask for the current password...