4989 matches found
Siemens RUGGEDCOM RM1224 安全漏洞
The Siemens RUGGEDCOM RM1224 is a wireless router from Siemens, Germany. It provides data communication to and from a remote location, provides 4G LTE connectivity and automatically falls back to a 3G UMTS or EVDO cellular network. A security vulnerability exists in the Siemens RUGGEDCOM RM1224...
Huawei EulerOS: Security Advisory for samba (EulerOS-SA-2022-2480)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Information Disclosure
rdiffweb is vulnerable to Information Disclosure. The vulnerability is due to not having a rate limit on the password change feature which allows an attacker to bruteforce the existing password and set a new password...
CVE-2022-3422
Account Takeover :: when see the info i can see the hash pass i can creaked it ............... Account Takeover :: when see the info i can see the forgotpasswordtoken the hacker can send the request and changed the pass...
Rdiffweb 安全漏洞
Rdiffweb is a web application by Patrik Dufresne, an individual developer in the USA. It provides quick access to your files through an efficient web interface. A security vulnerability exists in Rdiffweb versions prior to 2.5.0a4, which stems from a failure to require a password setting that...
Insufficient Session Expiration
Description Active sessions are not invalidated after a password change or after an admin resets the user's password. Proof of Concept Steps to reproduce: 1. Log in to Elgg with any user 2. Do the same in another browser or a private window, such that there are two different active sessions 3...
No rate limit on old password parameter allows attacker to bruteforce the existing password and set a new password
Description There is no rate limit on the password change feature on https://rdiffweb-demo.ikus-soft.com/prefs/general which allows an attacker to bruteforce the old password and set a new password for the account Proof of Concept 1 Go to https://rdiffweb-demo.ikus-soft.com/prefs/general 2 Here y...
Cookie is persisting in the browser which leads to Session Fixation
Description After logging in and logging out, the application continues to use the preauthentication cookies. The cookies are same after closing the browser and after password change .And also same cookies are reassigning for another user's login which can leads to session fixation. Proof of...
Password can be set extremely weak
Description In this scenario, I use the demo website. It allows us to add more user to test. With password, we can set it 1 Or any charater. There is no policy for password or no password checking. Moreover, it also allows us to change password and the new password also can be set with password...
CVE-2022-3152
Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20...
CVE-2022-3152
Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20...
Default credentials
Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20...
CVE-2022-3152 Unverified Password Change in phpfusion/phpfusion
Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20...
CVE-2022-3152 Unverified Password Change in phpfusion/phpfusion
Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20...
CVE-2022-3152
CVE-2022-3152 affects phpfusion/phpfusion prior to 9.10.20. The issue is described as an unverified password change, enabling account takeover. Connected documents corroborate the vulnerability class as improper/authentication weakness and consistently point to versions before 9.10.20. The remedi...
phpfusion 授权问题漏洞
PHPFusion is a Malaysian PHPFusion company based on MySql and PHP open source lightweight content management system . The system contains modules for news, articles and forums. A security vulnerability exists in PHPFusion versions prior to 9.10.20, which stems from an unverified password change...
PT-2022-20790 · Unknown · Php-Fusion
Name of the Vulnerable Software and Affected Versions: phpfusion/phpfusion versions prior to 9.10.20 Description: The issue concerns an unverified password change in the GitHub repository phpfusion/phpfusion. Recommendations: For versions prior to 9.10.20, update to version 9.10.20 or later to...
PT-2022-23161 · Unknown · Rubygems.Org
Name of the Vulnerable Software and Affected Versions: RubyGems.org affected versions not specified Description: A bug in the password and email change confirmation code allowed an attacker to change their RubyGems.org account's email to an unowned email address. This could enable the attacker to...
CVE-2022-1368
The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 3354 and prior is vulnerable to CWE-306: Missing Authentication for Critical Function, which allows unauthorized users to change the operator account password via webserver commands by monitoring web socket communications from an...
CVE-2022-1522
The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 3354 and prior is vulnerable to CWE-117: Improper Output Neutralization for Logs, which allows an attacker to create false logs that show the password as having been changed when it is not, complicating forensics...