4979 matches found
Insecure Session Management
shopware uses insecure session management. The library does not log out user sessions after the user password change using password recovery, allowing an attacker to gain access to the system if an old session token was obtained...
Insufficient Session Expiration
Description The application failed to invalidate the session after changing the password and In this scenario changing the password doesn't destroy the other sessions which are logged in with old passwords. Proof of Concept 1.Login same account in two different browsers. 2.Try to change the...
Microsoft Azure Defender for IoT Password Change Command Injection Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Azure Defender for IoT. An attacker must first obtain the ability to execute code as the www-data user on the target system in order to exploit this vulnerability. The specific flaw exists with...
Microsoft Azure Defender for IoT Password Change Command Injection Privilege Escalation Vulnerability
This vulnerability allows remote attackers to escalate privileges on affected installations of Microsoft Azure Defender for IoT. Authentication is required to exploit this vulnerability. The specific flaw exists within the password change mechanism. The issue results from the lack of proper...
Fortinet FortiAnalyzer Privilege Licensing and Access Control Issues Vulnerability
Fortinet FortiAnalyzer is a centralized network security reporting solution from Fortinet USA. The product is used to collect network log data and analyze, report, and archive security events, network traffic, and Web content in the logs through the reporting suite.Fortinet FortiAnalyzer is...
CVE-2022-22300
A improper handling of insufficient permissions or privileges in Fortinet FortiAnalyzer version 5.6.0 through 5.6.11, FortiAnalyzer version 6.0.0 through 6.0.11, FortiAnalyzer version 6.2.0 through 6.2.9, FortiAnalyzer version 6.4.0 through 6.4.7, FortiAnalyzer version 7.0.0 through 7 .0.2,...
CVE-2022-22300
A improper handling of insufficient permissions or privileges in Fortinet FortiAnalyzer version 5.6.0 through 5.6.11, FortiAnalyzer version 6.0.0 through 6.0.11, FortiAnalyzer version 6.2.0 through 6.2.9, FortiAnalyzer version 6.4.0 through 6.4.7, FortiAnalyzer version 7.0.0 through 7 .0.2,...
CVE-2022-22300
A improper handling of insufficient permissions or privileges in Fortinet FortiAnalyzer version 5.6.0 through 5.6.11, FortiAnalyzer version 6.0.0 through 6.0.11, FortiAnalyzer version 6.2.0 through 6.2.9, FortiAnalyzer version 6.4.0 through 6.4.7, FortiAnalyzer version 7.0.0 through 7 .0.2,...
Input validation
A improper handling of insufficient permissions or privileges in Fortinet FortiAnalyzer version 5.6.0 through 5.6.11, FortiAnalyzer version 6.0.0 through 6.0.11, FortiAnalyzer version 6.2.0 through 6.2.9, FortiAnalyzer version 6.4.0 through 6.4.7, FortiAnalyzer version 7.0.0 through 7 .0.2,...
Fortinet FortiAnalyzer 权限许可和访问控制问题漏洞
Fortinet FortiAnalyzer is a centralized network security reporting solution from Fortinet USA. The product is used to collect network log data and analyze, report, and archive security events, network traffic, and Web content in the logs through the reporting suite.Fortinet FortiAnalyzer is...
FortiAnalyzer, FortiManager - bypass of client-side password change policy enforcement
An improper handling of insufficient permissions or privileges vulnerability CWE-280 in FortiAnalyzer and FortiManager may allow an authenticated attacker to bypass the device policy and force the password-change action for its user...
CVE-2022-24341
In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user...
CVE-2022-24341
In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user...
CVE-2022-24341
In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user...
Default credentials
In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user...
CVE-2022-24341
In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user...
JetBrains TeamCity 代码问题漏洞
JetBrains TeamCity is a set of distributed build management and continuous integration tools from JetBrains Czech Republic. The tool provides continuous unit testing, code quality analysis, and build issue analysis reporting. JetBrains TeamCity is vulnerable to a code issue that could be exploite...
Warning — Deadbolt Ransomware Targeting ASUSTOR NAS Devices
ASUSTOR network-attached storage NAS devices have become the latest victim of Deadbolt ransomware, less than a month after similar attacks singled out QNAP NAS appliances. In response to the infections, the company has released firmware updates ADM 4.0.4.RQO2 to "fix related security issues." The...
cyrus-sasl: failure to properly escape SQL input allows an attacker to execute arbitrary SQL commands
A flaw was found in the SQL plugin shipped with Cyrus SASL. The vulnerability occurs due to failure to properly escape SQL input and leads to an improper input validation vulnerability. This flaw allows an attacker to execute arbitrary SQL commands and the ability to change the passwords for othe...
Shopify: Bypass of fix #1370749
Hello team, on report 1370749 the reporter found that the preview link is not expiring. So when someone will gain access to the preview link, he can access it for whole life as the preview link remains the same even after changing the storefont password. I have reported the issue 1401525 where i ...