4989 matches found
Arbitrary User Password Change Vulnerability in LearnDash LMS WordPress Plugin
On June 5, 2023, our Wordfence Threat Intelligence team identified, and began the responsible disclosure process, for an Arbitrary User Password Change vulnerability in LearnDash LMS plugin, a WordPress plugin that is actively installed on more than 100,000 WordPress websites according to our...
WordPress LearnDash LMS 4.6.0 Insecure Direct Object Reference Vulnerability
Description: LearnDash LMS = 4.6.0 – Authenticated Subscriber+ Insecure Direct Object Reference to Arbitrary User Password Change Affected Plugin: LearnDash LMS Plugin Slug: sfwd-lms Affected Versions: = 4.6.0 CVE ID: CVE-2023-3105 CVSS Score: 8.8 High CVSS Vector:...
WordPress LearnDash LMS 4.6.0 Insecure Direct Object Reference
Description: LearnDash LMS = 4.6.0 – Authenticated Subscriber+ Insecure Direct Object Reference to Arbitrary User Password Change Affected Plugin: LearnDash LMS Plugin Slug: sfwd-lms Affected Versions: = 4.6.0 CVE ID: CVE-2023-3105 CVSS Score: 8.8 High CVSS Vector:...
Cross-Site Request Forgery (CSRF)
github.com/casdoor/casdoor is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists in the SetPassword function at user.go due to a lack of CSRF token, which allows an attacker to change a users password...
CVE-2023-34927
Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery CSRF in the endpoint /api/set-password. This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL...
Cross site request forgery (csrf)
Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery CSRF in the endpoint /api/set-password. This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL...
Casdoor 跨站请求伪造漏洞
Casdoor is an open source Identity and Access Management IAM/Single Sign-On SSO platform with a Web UI that supports OAuth 2.0/OIDC and SAML authentication. A security vulnerability exists in Casdoor v1.331.0 and earlier versions that could allow an attacker to arbitrarily change a victim user's...
CVE-2022-3372
There is a CSRF vulnerability on Netman-204 version 02.05. An attacker could manage to change administrator passwords through a Cross Site Request Forgery due to the lack of proper validation on the CRSF token. This vulnerability could allow a remote attacker to access the administrator panel,...
RIELLO UPS NetMan 204 跨站请求伪造漏洞
Riello Ups RIELLO UPS NetMan is a network adapter from the Italian company Riello Ups. A security vulnerability exists in RIELLO UPS NetMan version 204 02.05, which stems from the lack of proper validation of CRSF tokens and a CSRF vulnerability that allows an attacker to try to change the...
CVE-2023-3305
A vulnerability was found in C-DATA Web Management System up to 20230607. It has been classified as critical. This affects an unknown part of the file /cgi-bin/jumpto.php?class=user&page=configsave&isphp=1 of the component User Creation Handler. The manipulation of the argument user/newpassword...
Cisco Expressway Series / Cisco TelePresence VCS < 14.2.1 Privilege Escalation (cisco-sa-expressway-priv-esc-Ls2B9t7b)
The Cisco Expressway Series or Cisco TelePresence Video Communication Server VCS running on the remote host is prior to 14.2.1. It is, therefore, affected by a privilege escalation vulnerability as described in the cisco-sa-expressway-priv-esc-Ls2B9t7b advisory. Due to incorrect handling of...
The vulnerability of the password-changing function of Cisco Expressway Series and Cisco Telepresence VCS devices allows attackers to increase their privileges.
The vulnerability of password-changing functions in Cisco Expressway Series and Cisco Telepresence VCS devices is related to errors in processing password-change requests. Exploiting this vulnerability can allow a malicious actor to enhance their privileges by sending specially crafted passwords...
多款Cisco产品 安全漏洞
Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS are both products of Cisco, Inc.Cisco Expressway Series is software for accessing devices outside the firewall. The software provides simple, highly secure access for users outside the firewall, helping telecommuters wo...
多款Cisco产品 安全漏洞
Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS are both products of Cisco, Inc.Cisco Expressway Series is software for accessing devices outside the firewall. The software provides simple, highly secure access for users outside the firewall, helping telecommuters wo...
CVE-2023-2187
On Triangle MicroWorks' SCADA Data Gateway version = v5.01.03, an unauthenticated attacker can send broadcast events to any user via the WebMonitor.An unauthenticated user can use this vulnerability to forcefully log out of any currently logged-in user by sending a "password change event"...
CVE-2023-0985
An Authorization Bypass vulnerability was found in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual version = 2.13.3. An authenticated remote user with low privileges can change the password of any user in the same account. This allows to take over the admin...
Authorization
An Authorization Bypass vulnerability was found in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual version = 2.13.3. An authenticated remote user with low privileges can change the password of any user in the same account. This allows to take over the admin...
PT-2023-16666 · Helmholz +1 · Myrex24 +2
Name of the Vulnerable Software and Affected Versions: MB Connect Lines mbCONNECT24 versions = 2.13.3 mymbCONNECT24 versions = 2.13.3 Helmholz' myREX24 versions = 2.13.3 Helmholz' myREX24.virtual versions = 2.13.3 Description: An Authorization Bypass issue allows an authenticated remote user with...