5002 matches found
CVE-2017-8848
Allen Disk 1.6 has CSRF in setpass.php with an impact of changing a password...
CVE-2019-15749
SITOS six Build v6.2.1 allows a user to change their password and recovery email address without requiring them to confirm the change with their old password. This would allow an attacker with access to the victim's account e.g., via XSS or an unattended workstation to change that password and...
CVE-2019-12394
Anviz access control devices allow unverified password change which allows remote attackers to change the administrator password without prior authentication...
CVE-2018-21037
Subrion CMS 4.1.5 and possibly earlier versions allow CSRF to change the administrator password via the panel/members/edit/1 URI...
CVE-2018-10503
An issue was discovered in index.php in baijiacms V4 v41420170105. CSRF allows adding an administrator account via op=edituser, changing the administrator password via op=changepwd, or deleting an account via op=deleteuser...
CVE-2017-18471
cPanel before 62.0.4 allows self XSS on the paperlantern password-change screen SEC-197...
CVE-2019-3927
Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 anyone can change the administrator and moderator passwords via the iso.3.6.1.4.1.3212.100.3.2.8.1 and iso.3.6.1.4.1.3212.100.3.2.8.2 OIDs. A remote, unauthenticated attacker can use this vulnerability to change the admin or...
CVE-2013-5116
Evernote prior to 5.5.1 has insecure password change...
CVE-2017-8879
Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attackers to obtain access via an unattended workstation...
CVE-2012-1562
Joomla! core before 2.5.3 allows unauthorized password change...
CVE-2019-1010094
domainmod v4.10.0 is affected by: Cross Site Request Forgery CSRF. The impact is: There is a CSRF vulnerability that can change admin password. The component is: http://127.0.0.1/settings/password/ http://127.0.0.1/admin/users/add.php http://127.0.0.1/admin/users/edit.php?uid=2. The attack vector...
CVE-2012-4385
letodms 3.3.6 has CSRF via change password...
CVE-2016-10859
cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands SEC-65...
CVE-2016-11069
An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change...
CVE-2019-15299
An issue was discovered in Centreon Web through 19.04.3. When a user changes his password on his profile page, the contactautologinkey field in the database becomes blank when it should be NULL. This makes it possible to partially bypass authentication...
CVE-2017-18408
cPanel before 67.9999.103 allows stored XSS in WHM MySQL Password Change interfaces SEC-282...
CVE-2017-9673
In SimpleCE 2.3.0, a CSRF vulnerability can be exploited to add an administrator account via the index.php/user/new URI or change its settings via the index.php/user/1 URI, including its password...
CVE-2019-19516
Intelbras WRN 150 1.0.18 devices allow CSRF via GO=systempassword.asp to the goform/SysToolChangePwd URI to change a password...
CVE-2010-2594
Multiple cross-site request forgery CSRF vulnerabilities in the web management interface in InterSect Alliance Snare Agent 3.2.3 and earlier on Solaris, Snare Agent 3.1.7 and earlier on Windows, Snare Agent 1.5.0 and earlier on Linux and AIX, Snare Agent 1.4 and earlier on IRIX, Snare Epilog 1.5....