4979 matches found
CVE-2025-62781 PILOS is missing session regeneration after password change
PILOS Platform for Interactive Live-Online Seminars is a frontend for BigBlueButton. Prior to 4.8.0, users with a local account can change their password while logged in. When doing so, all other active sessions are terminated, except for the currently active one. However, the current session’s...
CVE-2025-62781 PILOS is missing session regeneration after password change
PILOS Platform for Interactive Live-Online Seminars is a frontend for BigBlueButton. Prior to 4.8.0, users with a local account can change their password while logged in. When doing so, all other active sessions are terminated, except for the currently active one. However, the current session’s...
EUVD-2025-36381
PILOS Platform for Interactive Live-Online Seminars is a frontend for BigBlueButton. Prior to 4.8.0, users with a local account can change their password while logged in. When doing so, all other active sessions are terminated, except for the currently active one. However, the current session’s...
CVE-2025-62781
PILOS (Frontend for BigBlueButton) prior to version 4.8.0 exposes a session-regen flaw: when a local user changes their password, all other active sessions are terminated except the current one, whose token is not refreshed. If an attacker already possesses that session token (from another vulner...
CVE-2025-62781 PILOS is missing session regeneration after password change
PILOS Platform for Interactive Live-Online Seminars is a frontend for BigBlueButton. Prior to 4.8.0, users with a local account can change their password while logged in. When doing so, all other active sessions are terminated, except for the currently active one. However, the current session’s...
CVE-2025-12285
Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...
Improper Access Control
com.liferay.portal, release.portal.bom is vulnerable to improper access control. The vulnerability is due to the failure to restrict API access before a user changes their initial password, which allows an attacker to remotely access and modify content via the API...
PT-2025-44055
Name of the Vulnerable Software and Affected Versions PILOS versions prior to 4.8.0 Description PILOS, a frontend for BigBlueButton, contains a flaw where changing a local user’s password does not invalidate existing session tokens, except for the current session. An attacker who previously...
PILOS 代码问题漏洞
PILOS is a THM open source front-end software. A code issue vulnerability exists in PILOS versions prior to 4.8.0 that stems from a password change that does not invalidate the current session token, which could allow an attacker to continue to maintain access using the acquired session token...
EUVD-2025-35944
Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...
CVE-2025-12285
Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...
CVE-2025-12285
Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...
CVE-2025-12285 Missing Initial Password Change
Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...
CVE-2025-12285
The CVE-2025-12285 entry concerns Azure Access Technology BLU-IC2 and BLU-IC4 (through 1.19.5) with a missing initial password change. Connected sources confirm affected devices are networked access controllers from BLU-IC2/BLU-IC4 lines, and that the issue stems from not changing the initial def...
CVE-2025-12285 Missing Initial Password Change
Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...
Azure Access Technology BLU-IC2和Azure Access Technology BLU-IC4 安全漏洞
The Azure Access Technology BLU-IC2 and Azure Access Technology BLU-IC4 are both networked access controllers from Azure Access Technology, USA. A security vulnerability exists in the Azure Access Technology BLU-IC2 and Azure Access Technology BLU-IC4 that stems from a missing initial password...
CVE-2025-62771
Mercku M6a devices through 2.1.0 allow password changes via intranet CSRF attacks...
CVE-2025-52079
The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to Unverified Password Change via crafted POST request to /getset.ccp...
D-Link DIR-820L Access Control Error Vulnerability
The D-Link DIR-820L is a wireless router device from D-Link. An improper access control vulnerability exists in the D-Link DIR-820L version 1.06B02, which stems from the administrator password setup function not properly validating the authentication mechanism. An attacker can exploit this...