Arbitrary Account Password Reset Vulnerability in PV Guard Android APP

PV Guard is a PV monitoring and operation management platform based on big data and knowledge base. The PV Guard Android APP has an arbitrary account password reset vulnerability, which allows attackers to exploit the vulnerability to change the password of the other party's cell phone number onl...

Change Password Option in StoreFront Not Shown, Available Only for Admins

Change password option in StoreFront not shown for non-domain admins but is there for domain admins...

CVE-2017-6086

Multiple cross-site request forgery CSRF vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the authentication of logged administrators to 1 add an administrator user via a crafted POST request to...

Default credentials

QNAP QTS before 4.2.6 build 20170517 has a flaw in the change password function...

CVE-2017-7629

QNAP QTS before 4.2.6 build 20170517 has a flaw in the change password function...

CVE-2017-7629

CVE-2017-7629 affects QNAP QTS pre-4.2.6 build 20170517, due to a flaw in the change password function. The vulnerability’s impact is partial integrity loss (I:P) with no confidentiality/availability impact per CVSS data, and a network-accessible, low-complexity path without required authenticati...

CVE-2017-7629

QNAP QTS before 4.2.6 build 20170517 has a flaw in the change password function...

Robert 0.5 - Multiple Vulnerabilities

Robert 0.5 - Multiple Vulnerabilities Exploit Title: Robert 0.5 - Multiple Vulnerabilities XSS, CSRF, Directory traversal & SQLi Date: 07/06/2017 Exploit Author: Cyril Vallicari / HTTPCS - ZIWIT Vendor website :http://robert.polosson.com/ Download link :...

Aerohive HiveOS 5.1r5 6.1r5 - Remote Code Execution

Aerohive HiveOS 5.1r5 6.1r5 - Remote Code Execution !/usr/bin/python3 TARGET: AeroHive AP340 HiveOS $cmd"; die; ?" URL of the login page where we will inject our PHP command exec code so it poisons the log file posturl= "/login.php5?version=6.1r2" postfields = "loginauth" : "1", "miniHiveUI" :...

Weblate: No Rate Limitting at Change Password

Hello Team, I found out that you didnt implement a Rate Limitting on Change Password. Scenario This Scenario is Limited. But some of Programs here consider this. Victim Forgot to logout his/her account in Cafe/Internet Computer Shops. Attacker saw the Account that it is not Logged out having a...

CVE-2016-8716

An exploitable Cleartext Transmission of Password vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. The Change Password functionality of the Web Application transmits the password in cleartext. An attacker capable of intercepti...

PT-2017-9759 · Moxa · Moxa Awk-3131A Wireless Access Point

Name of the Vulnerable Software and Affected Versions: Moxa AWK-3131A Wireless Access Point version 1.1 Description: A Cleartext Transmission of Password issue exists in the Web Application functionality. The Change Password functionality transmits the password in cleartext, allowing an attacker...

CVE-2017-6127

Multiple cross-site request forgery CSRF vulnerabilities in the access portal on the DIGISOL DG-HR1400 Wireless Router with firmware 1.00.02 allow remote attackers to hijack the authentication of administrators for requests that 1 change the SSID, 2 change the Wi-Fi password, or 3 possibly have...

CVE-2016-9005

IBM System Storage TS3100-TS3200 Tape Library could allow an unauthenticated user with access to the company network, to change a user's password and gain remote access to the system...

Nord Security: CSRF to change password

Description Cross-Site Request Forgery CSRF is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site for which the user is currently authenticated. I have found CSRF to change...

Polycom VVX Web Interface - Change Admin Password

Exploit Title: Polycom VVX Web Interface - Change Admin Password as User Date: January 26, 2017 Exploit Author: Mike Brown Vendor Homepage: http://www.polycom.com/ Software Link: http://downloads.polycom.com/voice/voip/ucswreleasesmatrix.html Version: Polycom vvx 410 UC Software Version: 5.3.1.04...

MC Inventory Manager Script - Multiple Vulnerabilities

Vulnerability: Admin Login Bypass & SQLi Date: 15.01.2017 Vendor Homepage: http://microcode.ws/ Script Name: MC Inventory Manager Script Buy Now: http://microcode.ws/product/mc-inventory-manager-php-script/3885 Author: İhsan Şencan Author Web: http://ihsan.net Mail : ihsanbeygirihsannoktanet Admi...

DEBIAN-CVE-2016-6630

An issue was discovered in phpMyAdmin. An authenticated user can trigger a denial-of-service DoS attack by entering a very long password at the change password dialog. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...

ALPINE-CVE-2016-6630

An issue was discovered in phpMyAdmin. An authenticated user can trigger a denial-of-service DoS attack by entering a very long password at the change password dialog. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...

UBUNTU-CVE-2016-6630

An issue was discovered in phpMyAdmin. An authenticated user can trigger a denial-of-service DoS attack by entering a very long password at the change password dialog. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...