CVE-2024-27715

An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via a crafted request to the Password Change mechanism...

CVE-2024-27715

An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via a crafted request to the Password Change mechanism...

eSkooly Security Vulnerabilities

eSkooly is a free online school management software from eSkooly, Inc. A security vulnerability exists in eSkooly 3.0 and prior versions that originated from allowing a remote attacker to elevate privileges by sending a crafted request to the password change mechanism...

PT-2024-22006 · Unknown · Eskooly Free Online School Management

Name of the Vulnerable Software and Affected Versions: Eskooly Free Online School management Software versions 3.0 and earlier Description: An issue in the software allows a remote attacker to escalate privileges via a crafted request to the Password Change mechanism. Recommendations: For version...

CVE-2024-27715

Eskooly Free Online School management Software (v3.0 and earlier) contains a vulnerability in the Password Change mechanism that allows a remote attacker to escalate privileges via a crafted request. Affected products are documented across multiple sources (CVE-2024-27715). The Red Hat and NVD en...

ABB ASPECT System

SUMMARY ABB became aware of vulnerabilities in the product versions listed as affected in the advisory. ASPECT devices are not intended to be internet-facing. A product advisory issued in June 2023 informed cus-tomers of this parameter. An attacker can successfully exploit these vulnerabilities...

The vulnerability of the “Forgotten Password” function on the IIoT platform of ifm Moneo devices, including IFM QHA300, IFM QHA210, and IFM QVA200, allows a hacker to change the administrator password.

The vulnerability of the “Forgotten Password” function on the IIoT platform of ifm Moneo devices, namely IFM QHA300, IFM QHA210, and IFM QVA200, is related to the lack of a password recovery mechanism. Exploiting this vulnerability could allow an attacker to remotely change the administrator’s...

CVE-2024-2472

The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'startorusesessionforcustomer' function in all versions up to and including 4.9.9. This makes it possible for unauthenticated attackers to view...

CVE-2024-4680

A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change, enabling an attacker to maintain access to a compromised account without the...

CVE-2024-4680

ZenML-IO/zenml prior to 0.56.3 is affected by CVE-2024-4680 due to insufficient session expiration. The vulnerability allows reuse of old session credentials after a password change, enabling continued access to a compromised account without re-authentication. Documentation notes this behavior sp...

PT-2024-4359

Name of the Vulnerable Software and Affected Versions zenml-io/zenml version 0.56.3 Description A vulnerability in zenml-io/zenml allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password...

PYSEC-2024-193

An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vulnerability allows for unauthorized...

PYSEC-2024-193

An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vulnerability allows for unauthorized...

CVE-2024-2213 Improper Authentication in zenml-io/zenml

An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vulnerability allows for unauthorized...

CVE-2024-2213 Improper Authentication in zenml-io/zenml

An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vulnerability allows for unauthorized...

CVE-2024-2213 Improper Authentication in zenml-io/zenml

An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vulnerability allows for unauthorized...

PT-2024-19218 · Zenml · Zenml

Name of the Vulnerable Software and Affected Versions: zenml-io/zenml versions up to and including 0.55.4 Description: An issue was discovered due to improper authentication mechanisms, allowing an attacker with access to an active user session to change the account password without knowing the...

TYPO3 Security Misconfiguration in User Session Handling

When users change their password existing sessions for that particular user account are not revoked. A valid backend or frontend user account is required in order to make use of this vulnerability...

GHSA-XMGR-JFF3-FCFV TYPO3 Security Misconfiguration in User Session Handling

When users change their password existing sessions for that particular user account are not revoked. A valid backend or frontend user account is required in order to make use of this vulnerability...

Online Blood Bank Management System SQL注入漏洞

Online Blood Bank Management System is an online blood bank management system. Itsourcecode Online Blood Bank Management System version 1.0 suffers from a SQL injection vulnerability that originates from changepwd.php containing an unknown function that causes SQL injection via the parameter...