PT-2023-28998 · Unknown · Instantsoft/Icms2

Name of the Vulnerable Software and Affected Versions: instantsoft/icms2 versions prior to 2.16.1-git. Description: The issue concerns an unverified password change in the GitHub repository instantsoft/icms2. Recommendations: For versions prior to 2.16.1-git, update to version 2.16.1-git or later...

iCMS 安全漏洞

iCMS is a software application. An efficient and simple content management system built with PHP and MySQL. A security vulnerability exists in iCMS versions prior to 2.16.1-git, which stems from an unauthenticated password change...

New password can be set as same as the old password

Description The web application allows us to set new password as the old one at Password change function. Detail: 1/ Access to the demo website and go to My profile. 2/ Choose Edit profile, at the Security tab, change the password with the new password and the old password are the same. 3/ Logout...

CVE-2023-4276

The Absolute Privacy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1. This is due to missing nonce validation on the 'abprprofileShortcode' function. This makes it possible for unauthenticated attackers to change user email and password via a...

Cross site request forgery (csrf)

The Absolute Privacy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1. This is due to missing nonce validation on the 'abprprofileShortcode' function. This makes it possible for unauthenticated attackers to change user email and password via a...

Absolute Privacy <= 2.1 - User Email/Password Change via Cross-Site Request Forgery

Description The plugin does not protect its abprprofileShortcode action against CSRF attacks, allowing an unauthenticated attacker to change a users email or password by tricking a logged in administrator to submit a crafted request...

New Report Exposes Vice Society's Collaboration with Rhysida Ransomware

Tactical similarities have been unearthed between the double extortion ransomware group known as Rhysida and Vice Society, including in their targeting of education and healthcare sectors. "As Vice Society was observed deploying a variety of commodity ransomware payloads, this link does not sugge...

CVE-2023-36139

In PHPJabbers Cleaning Business Software 1.0, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts...

CVE-2023-36139

In PHPJabbers Cleaning Business Software 1.0, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts...

CVE-2023-36134

In PHP Jabbers Class Scheduling System 1.0, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts...

Code injection

In PHPJabbers Cleaning Business Software 1.0, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts...

CVE-2023-36139

In PHPJabbers Cleaning Business Software 1.0, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts...

PHPJabbers Cleaning Business Software Data Forgery Issue Vulnerability

Cleaning Business Software is an open source cleaning business software from PHPJabbers. A security vulnerability exists in version 1.0 of PHPJabbers Cleaning Business Software that stems from a lack of authentication when changing e-mail addresses and/or passwords, allowing a remote attacker to...

CVE-2023-36133

PHPJabbers Availability Booking Calendar 5.0 is vulnerable to User Account Takeover through username/password change...

CVE-2023-33563

In PHP Jabbers Time Slots Booking Calendar 3.3 , lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts...

PHPJabbers Time Slots Booking Calendar Authorization Issues Vulnerability

PHPJabbers Time Slots Booking Calendar is a booking system by PHPJabbers. A security vulnerability exists in PHPJabbers Time Slots Booking Calendar version v3.3, which stems from a lack of validation when changing an email address or password on the profile page, allowing a remote attacker to tak...

(Pwn2Own) Inductive Automation Ignition OPC UA Quick Client Missing Authentication for Critical Function Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation Ignition. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

GHSA-5MVJ-RVP8-RF45 Insufficient Session Expiration after a password change

TL;DR This vulnerability affects all Kirby sites with user accounts unless Kirby's API and Panel are disabled in the config. It can only be abused if a Kirby user is logged in on a device or browser that is shared with potentially untrusted users or if an attacker already maliciously used a...

Insufficient Session Expiration after a password change

TL;DR This vulnerability affects all Kirby sites with user accounts unless Kirby's API and Panel are disabled in the config. It can only be abused if a Kirby user is logged in on a device or browser that is shared with potentially untrusted users or if an attacker already maliciously used a...

CVE-2023-38489 Kirby vulnerable to Insufficient Session Expiration after a password change

Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites with user accounts unless Kirby's API and Panel are disabled in the config. It can only be abused if a Kirby user is logged in on a device or browser th...