CVE-2022-45130

Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian is a specific version of the Plesk product: version numbers were used through version 12, and then the convention was changed so that versions are identified by names...

PT-2022-27411 · Plesk · Plesk Obsidian

Name of the Vulnerable Software and Affected Versions: Plesk Obsidian Description: The issue allows a CSRF attack, for example, via the "/api/v2/cli/commands" REST API to change an Admin password. This affects Plesk Obsidian, which is a specific version of the Plesk product where versions are...

CVE-2022-43031

DedeCMS v6.1.9 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily add Administrator accounts and modify Admin passwords...

When setting a customer account's password, the potentially different&existing logged in user/session will be used in audit log to record the password change, causing confusion and making it look like a password hijack

h1. Steps to reproduce Consider the following scenario: User A: Invite is sent to [email protected] to join the JSM customer portal. User B is a customer and it is logged into customer portal as [email protected]. In the same browser where User B is logged in, the mailbox of [email protected] is open and ...

Authentication Bypass

thorsten/phpmyfaq is vulnerable to authentication bypass. The vulnerability exists due to lack of restrictions in the password change function which allows an attacker to successfully update the password by changing one character...

Crowd DC Critical Security Misconfiguration Vulnerability - CVE-2022-43782

Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and call privileged endpoints in Crowd's REST API under the usermanagement path. This vulnerability can only be exploited by IPs specified under the crowd application...

CVE-2022-43364

An access control issue in the password reset page of IP-COM EW9 V15.11.0.149732 allows unauthenticated attackers to arbitrarily change the admin password...

CVE-2022-43364

CVE-2022-43364 affects IP-COM EW9 (firmware V15.11.0.14(9732)). An access-control flaw on the password-reset page allows unauthenticated attackers to arbitrarily change the admin password. CVSSv3.1 metrics in NVD/CVE entries: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (base score 7.5, HIGH). Attack vect...

CVE-2020-23648

Asus RT-N12E 2.0.0.39 is affected by an incorrect access control vulnerability. Through system.asp / startapply.htm, an attacker can change the administrator password without any authentication...

CVE-2020-23648

Asus RT-N12E 2.0.0.39 is affected by an incorrect access control vulnerability. Through system.asp / startapply.htm, an attacker can change the administrator password without any authentication...

PT-2022-8690 · Asus · Asus Rt-N12+

Name of the Vulnerable Software and Affected Versions: Asus RT-N12E version 2.0.0.39 Description: The issue is related to incorrect access control. An attacker can change the administrator password without authentication through the "system.asp" and "start apply.htm" API endpoints. Recommendation...

CVE-2022-3582

A vulnerability has been found in SourceCodester Simple Cold Storage Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument change password leads to cross-site request forgery. The attack can be launched...

PT-2022-22965 · Unknown · Sourcecodester Simple Cold Storage Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Cold Storage Management System version 1.0 Description: A vulnerability has been found in the system, classified as problematic, affecting an unknown functionality. The manipulation of the change password argument leads ...

CVE-2022-41474

RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily change the password of any account...

CVE-2022-41474

RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily change the password of any account...

CVE-2022-41474

RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily change the password of any account...

RPCMS 跨站请求伪造漏洞

RPCMS is a software application. A website CMS system. A security vulnerability exists in RPCMS version v3.0.2, which stems from a vulnerability that allows an attacker to arbitrarily change the password of any account...

CVE-2022-41474

RPCMS v3.0.2 is affected by a Cross-Site Request Forgery (CSRF) that allows attackers to arbitrarily change the password of any account. The CVE entry documents this CSRF issue as the underlying vulnerability; there are no public details in the provided documents about the exact root cause, affec...

CVE-2022-31765

Siemens SCALANCE and RUGGEDCOM devices are affected by CVE-2022-31765 due to missing authorization in the web interface change-password function. Affected products (multiple SCALANCE and RUGGEDCOM models) before the fixed version (V7.1.2) allow low-privileged users to escalate privileges, with CV...

Siemens RUGGEDCOM RM1224 安全漏洞

The Siemens RUGGEDCOM RM1224 is a wireless router from Siemens, Germany. It provides data communication to and from a remote location, provides 4G LTE connectivity and automatically falls back to a 3G UMTS or EVDO cellular network. A security vulnerability exists in the Siemens RUGGEDCOM RM1224...