Insufficient Session Expiration

Description Existing sessions are not invalidated after a password change. Proof of Concept Steps to reproduce: 1. Log in to Humhub 2. Do the same in another browser or a private window, such that there are two different active sessions 3. Update the user's password in either of the two sessions ...

PT-2022-4703 · Cognex · Cognex 3D-A1000 Dimensioning System

Name of the Vulnerable Software and Affected Versions: Cognex 3D-A1000 Dimensioning System versions 1.0.3 and prior Description: The issue is related to missing authentication for critical functions, allowing unauthorized users to change the operator account password via web server commands. This...

CVE-2022-36604

An access control issue in Canaan Avalon ASIC Miner 2020.3.30 and below allows unauthenticated attackers to arbitrarily change user passwords via a crafted POST request...

CVE-2022-36604

An access control issue in Canaan Avalon ASIC Miner 2020.3.30 and below allows unauthenticated attackers to arbitrarily change user passwords via a crafted POST request...

Cross site request forgery (csrf)

An access control issue in Canaan Avalon ASIC Miner 2020.3.30 and below allows unauthenticated attackers to arbitrarily change user passwords via a crafted POST request...

CVE-2022-36604

An access control issue in Canaan Avalon ASIC Miner 2020.3.30 and below allows unauthenticated attackers to arbitrarily change user passwords via a crafted POST request...

CVE-2022-36604

The CVE-2022-36604 issue affects Canaan Avalon ASIC Miner firmware versions 2020.3.30 and earlier, due to an improper access-control vulnerability. An unauthenticated attacker can ACHIEVE arbitrary password changes by sending a crafted POST request, exposing a risk of account takeovers and potent...

Apache ShenYu 安全漏洞

Apache ShenYu is an asynchronous, high-performance, cross-language, responsive API gateway from the Apache Foundation. A security vulnerability exists in Apache ShenYu Admin versions 2.4.2 and 2.4.3, which stems from an insecure privilege that could allow a low-privileged administrator to change...

Canaan Avalon ASIC Miner 访问控制错误漏洞

Canaan Avalon ASIC Miner is a bitcoin mining machine from Canaan, a Chinese company. A security vulnerability exists in Canaan Avalon ASIC Miner version 2020.3.30 and prior versions, which stems from improper access control. An attacker could use this vulnerability to arbitrarily change a user's...

PT-2022-23500 · Canaan · Canaan Avalon Asic Miner

Name of the Vulnerable Software and Affected Versions: Canaan Avalon ASIC Miner versions 2020.3.30 and below Description: The issue is related to an access control problem, allowing unauthenticated attackers to change user passwords using a crafted POST request. Recommendations: For Canaan Avalon...

PT-2022-23508 · Totolink · Totolink A860R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A860R version 4.1.2cu.5182 B20201027 Description: The issue concerns a hardcoded password for the root user located at /etc/shadow.sample. This could potentially allow unauthorized access to the system. Recommendations: For TOTOLINK...

GHSA-CMXC-9GHJ-JP87 Insufficient Session Expiration in snipe/snipe-it

Session Fixation in GitHub repository snipe/snipe-it prior to version 6.0.10. The session is not invalidated after a password change...

Insufficient Session Expiration in snipe/snipe-it

Session Fixation in GitHub repository snipe/snipe-it prior to version 6.0.10. The session is not invalidated after a password change...

The vulnerability of the OctoPrint 3D-printer controller relates to the unsafe management of privileges, allowing a malicious actor to change the account password without knowing the current password.

The vulnerability of the OctoPrint 3D-printer controller is related to insecure management of privileges. Exploiting this vulnerability allows a hacker to change the account password without knowing the current password...

Updated ldb/samba/sssd packages fix security vulnerability

Fixed AD restrictions bypass associated with changing passwords bsc1201495. CVE-2022-2031 Fixed a memory leak in SMB1 bsc1201496. CVE-2022-32742 Fixed an arbitrary password change request for any AD user bsc1201493. CVE-2022-32744 Fixed a remote server crash with an LDAP add or modify request...

MGASA-2022-0299 Updated ldb/samba/sssd packages fix security vulnerability

Fixed AD restrictions bypass associated with changing passwords bsc1201495. CVE-2022-2031 Fixed a memory leak in SMB1 bsc1201496. CVE-2022-32742 Fixed an arbitrary password change request for any AD user bsc1201493. CVE-2022-32744 Fixed a remote server crash with an LDAP add or modify request...

DEBIAN-CVE-2022-32744

A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user can change other users' passwords, enabling full domain takeover...

CVE-2022-32744

A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user can change other users' passwords, enabling full domain takeover...

CVE-2022-32744

A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user can change other users' passwords, enabling full domain takeover...

AZL-37014 CVE-2022-32744 affecting package samba for versions less than 4.18.3-1

A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user can change other users' passwords, enabling full domain takeover...