CVE-2023-2548

The RegistrationMagic plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 5.2.0.5. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible f...

CVE-2023-2548

The RegistrationMagic plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 5.2.0.5. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible f...

CVE-2023-2548 RegistrationMagic <= 5.2.0.5 - Authenticated (Admin+) Insecure Direct Object Reference to Arbitrary User Password Change

The RegistrationMagic plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 5.2.0.5. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible f...

PT-2023-20098 · WordPress · Registrationmagic

Name of the Vulnerable Software and Affected Versions: RegistrationMagic plugin for WordPress versions up to, and including, 5.2.0.5 Description: The issue allows authenticated attackers with administrator-level permissions and above to bypass authorization and access system resources due to...

CVE-2023-31572

An issue in Bludit 4.0.0-rc-2 allows authenticated attackers to change the Administrator password and escalate privileges via a crafted request...

Screen SFT DAB 600/C Authentication Bypass / Admin Password Change

!/usr/bin/env python3 Screen SFT DAB 600/C Authentication Bypass Admin Password Change Exploit Vendor: DB Elettronica Telecomunicazioni SpA Product web page: https://www.screen.it | https://www.dbbroadcast.com https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/ Affected version...

Screen SFT DAB 600/C Authentication Bypass / Password Change

!/usr/bin/env python3 Screen SFT DAB 600/C Authentication Bypass Password Change Exploit Vendor: DB Elettronica Telecomunicazioni SpA Product web page: https://www.screen.it | https://www.dbbroadcast.com https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/ Affected version:...

Screen SFT DAB 600/C Authentication Bypass Admin Password Change Exploit

Summary Screen's new radio DAB Transmitter is reaching the highest technology level in both Digital Signal Processing and RF domain. SFT DAB Series - Compact Radio DAB Transmitter - Air. Thanks to the digital adaptive precorrection and configuatio flexibility, the Hot Swap System technology, the...

Seiko Solutions SkyBridge 安全漏洞

Seiko Solutions SkyBridge is a series of routers from Seiko Solutions Japan. A security vulnerability exists in the Seiko Solutions SkyBridge MB-A100/110. An authenticated, remote attacker could exploit the vulnerability to change the product's WebUI password...

CVE-2022-35898

OpenText BizManager before 16.6.0.1 does not perform proper validation during the change-password operation. This allows any authenticated user to change the password of any other user, including the Administrator account...

PT-2023-13451 · Opentext · Opentext Imanager

Name of the Vulnerable Software and Affected Versions: OpenText BizManager versions prior to 16.6.0.1 Description: The issue arises from improper validation during the change-password operation, allowing any authenticated user to change the password of any other user, including the Administrator...

OpenText BizManager 授权问题漏洞

OpenText BizManager is an integrated B2B gateway from OpenText Japan. Almost all document types, communication protocols and industry standards are supported. A security vulnerability previously existed in OpenText BizManager version 16.6.0.1, which stemmed from a failure to perform proper...

CVE-2022-35898

OpenText BizManager before 16.6.0.1 does not perform proper validation during the change-password operation. This allows any authenticated user to change the password of any other user, including the Administrator account...

CVE-2023-1778

This vulnerability exists in GajShield Data Security Firewall firmware versions prior to v4.28 except v4.21 due to insecure default credentials which allows remote attacker to login as superuser by using default username/password via web-based management interface and/or exposed SSH port thereby...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration such that the token used in the password reset links remains valid even after the password reset and can be used a second time to change the password of the corresponding user. The token expires only 3...

CVE-2023-26841

A cross-site request forgery CSRF vulnerability in ChurchCRM v4.5.3 allows attackers to change any user's password except for the user that is currently logged in...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in ChurchCRM v4.5.3 allows attackers to change any user's password except for the user that is currently logged in...

ChurchCRM 跨站请求伪造漏洞

ChurchCRM is an open source CRM system for churches. A security vulnerability exists in ChurchCRM version v4.5.3. An attacker can exploit this vulnerability to change the password of any user other than the currently logged in user...

CyberPower PowerPanel Business Edition 代码问题漏洞

Cyber Power Systems CyberPower PowerPanel Business Edition is a suite of power management software from Cyber Power Systems, USA. The software automates the shutdown of physical and virtual infrastructures and monitors and manages CyberPower UPS systems and network-connected PDUs Power Distributi...

TRIPLEPLAY Caveman 安全漏洞

TRIPLEPLAY Caveman is a commercial software platform for IPTV technology and video streaming from TRIPLEPLAY UK. A security vulnerability exists in TRIPLEPLAY Caveman prior to version 3.4.0 that stems from incorrect access control and can be exploited by an attacker to modify another user's...