CVE-2019-10042

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use an API URL /goform/LoadDefaultSettings to reset the router without authentication...

Trend Micro Control Manager cgiCMUIDispatcher Login Token SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Control Manager. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within processing of...

Unitrends Enterprise Backup 'token' cookie modification lifting vulnerability

Unitrends Enterprise Backup is a suite of enterprise-class data protection software from Unitrends, Inc. in the United States. The software provides data backup, data recovery and deduplication features. A security vulnerability exists in versions of Unitrends Enterprise Backup prior to 9.0.0. Th...

Shopify: password less login token expiration issue

Log into Shopify iOS app as Alice and grab the token. 2. Send the below request to generate the password less login token The token expires after a single use. So don't use the token. Request: POST /admin/api/graphql HTTP/1.1 Host: seclearn.myshopify.com Content-Type: application/graphql...

The vulnerability of the Moodle learning management system allows a hacker to bypass the forced password change.

The vulnerability of the login/token.php component of the Moodle learning management system is related to deficiencies in access control for certain functions. Exploiting this vulnerability could allow a malicious actor to bypass the forced password change process...

Moodle 'login/token.php' Vulnerable

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in the Moodle 'login/token.php' script. A remote attacker could exploit this vulnerability by creating ...