841 matches found
Subex ROC Partner Settlement Insecure Direct Object Reference (IDOR) Vulnerability
Subex ROC Partner Settlement is a scalable partner management platform from Subex India. The platform supports features such as billing and revenue management. A security vulnerability exists in the Change Password feature in Subex ROC Partner Settlement version 10.5. The vulnerability can be...
Design/Logic Flaw
An Insecure Direct Object Reference IDOR vulnerability in the Change Password feature of Subex ROC Partner Settlement 10.5 allows remote authenticated users to achieve account takeover via manipulation of POST parameters. NOTE: This vulnerability may only affect a testing version of the applicati...
CVE-2020-9384
An Insecure Direct Object Reference IDOR vulnerability in the Change Password feature of Subex ROC Partner Settlement 10.5 allows remote authenticated users to achieve account takeover via manipulation of POST parameters. NOTE: This vulnerability may only affect a testing version of the applicati...
CVE-2020-9384
An Insecure Direct Object Reference IDOR vulnerability in the Change Password feature of Subex ROC Partner Settlement 10.5 allows remote authenticated users to achieve account takeover via manipulation of POST parameters. NOTE: This vulnerability may only affect a testing version of the applicati...
PT-2020-20625 · Subex · Subex Roc Partner Settlement
Name of the Vulnerable Software and Affected Versions: Subex ROC Partner Settlement version 10.5 Description: An Insecure Direct Object Reference IDOR vulnerability in the Change Password feature allows remote authenticated users to achieve account takeover via manipulation of POST parameters. Th...
CVE-2019-19987
An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. It allows Cross-Site Request Forgery CSRF on any HTML form. An attacker can exploit the vulnerability to abuse functionalities such as change password, add user, add privilege, and so on...
Cross site request forgery (csrf)
An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. It allows Cross-Site Request Forgery CSRF on any HTML form. An attacker can exploit the vulnerability to abuse functionalities such as change password, add user, add privilege, and so on...
CVE-2019-19857
An issue was discovered in Serpico aka SimplE RePort wrIting and CollaboratiOn tool 1.3.0. An admin can change their password without providing the current password, by using interfaces outside the Change Password screen. Thus, requiring the admin to enter an Old Password value on the Change...
The vulnerability of the server management application CentOS Web Panel arises due to insufficient validation of input data. This allows a hacker to change the email password of the user account.
The vulnerability of the CentOS Web Panel server management application exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to remotely change the user’s email account password...
Hospital Management System 4.0 - Authentication Bypass
Exploit Title: Hospital Management System 4.0 - Authentication Bypass Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/hospital-management-system-in-php/ Version: v4.0 Category: Webapps Tested on: Xampp for Windows...
Cross site request forgery (csrf)
Intelbras WRN 150 1.0.18 devices allow CSRF via GO=systempassword.asp to the goform/SysToolChangePwd URI to change a password...
Authentication Bypass Vulnerability in ZTE ZXR10 1800-2S Multiservice Router
ZXR10 ZSR V2 series router is a next-generation intelligent access router product integrating routing, switching, wireless, security, VPN, and AC launched by ZTE. The product adopts the industry-leading hardware platform and software architecture, which provides an intelligent and resilient devic...
Session Fixation
silverstripe/framework is vulnerable to session fixation. The application does not regenerate the session ID in the Change Password function, allowing a remote attacker with physical access to a victim's node to perform session fixation in the Change Password form...
CVE-2012-4385
letodms 3.3.6 has CSRF via change password...
Cross site request forgery (csrf)
letodms 3.3.6 has CSRF via change password...
CVE-2012-4385
letodms 3.3.6 has CSRF via change password...
CVE-2012-4385
CVE-2012-4385 affects letodms 3.3.6. The connected documents identify a CSRF vulnerability in the change password flow, enabling an attacker to induce password changes without user intent. Root cause is CSRF in the authentication workflow, with impact limited to confidentiality/ integrity of the ...
CVE-2012-4385
letodms 3.3.6 has CSRF via change password...
