CVE-2022-22111

Affected product: DayByDay CRM (version 2.2.0). Vulnerability: Missing authorization allows any application user with update-user permission to change other users’ passwords, including the administrator, enabling highest-privilege access. Root cause (as described): Insufficient access control for...

DayByDay CRM 授权问题漏洞

DayByDay CRM is an open source CRM Customer Relationship Management software, based on Laravel, that helps users keep track of clients, tasks, meetings and more. A security bypass vulnerability exists in DayByDay CRM, which can be exploited by an attacker to change any user's password and gain...

Trendnet AC2600 访问控制错误漏洞

Trendnet AC2600 TEW-827DRU is a wireless router. version 2.08B01 of the Trendnet AC2600 TEW-827DRU contains a security vulnerability that stems from a hidden administrative command that could be exploited to force an attacker to change the administrator password...

Stormshield Network Security Code Issue Vulnerability

Stormshield Network Security is a next-generation UTM Unified Threat Management firewall from Stormshield France. Stormshield Network Security SNS suffers from a code issue vulnerability that stems from the first SSH password change not properly clearing the old password under certain update...

CVE-2021-45885

An issue was discovered in Stormshield Network Security SNS 4.2.2 through 4.2.7 fixed in 4.2.8. Under a specific update-migration scenario, the first SSH password change does not properly clear the old password...

CVE-2021-45885

An issue was discovered in Stormshield Network Security SNS 4.2.2 through 4.2.7 fixed in 4.2.8. Under a specific update-migration scenario, the first SSH password change does not properly clear the old password...

Default credentials

An issue was discovered in Stormshield Network Security SNS 4.2.2 through 4.2.7 fixed in 4.2.8. Under a specific update-migration scenario, the first SSH password change does not properly clear the old password...

CVE-2021-45885

Stormshield Network Security (SNS) versions 4.2.2–4.2.7 are affected by a password handling issue where the first SSH password change does not properly clear the old password during a specific update-migration scenario. This can impact confidentiality (as per CVSS 3.1 base score 7.5) and is mitig...

CVE-2021-43858

MinIO is a Kubernetes native application for cloud storage. Prior to version RELEASE.2021-12-27T07-23-18Z, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version RELEASE.2021-12-27T07-23-18Z changes the...

CVE-2021-20049

A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses. This vulnerability impacts 10.2.1.2-24sv, 10.2.0.8-37sv and earlier 10.x versions...

CVE-2021-20049

A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses. This vulnerability impacts 10.2.1.2-24sv, 10.2.0.8-37sv and earlier 10.x versions...

CVE-2021-20049

A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses. This vulnerability impacts 10.2.1.2-24sv, 10.2.0.8-37sv and earlier 10.x versions...

Code injection

A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses. This vulnerability impacts 10.2.1.2-24sv, 10.2.0.8-37sv and earlier 10.x versions...

CVE-2021-20049

CVE-2021-20049 affects SonicWall SMA100, where the password change API can be probed by an unauthenticated remote attacker to enumerate usernames based on server responses. Affected versions include 10.2.1.2-24sv, 10.2.0.8-37sv and earlier 10.x releases. The core issue is non-defensive handling o...

The vulnerability of the WISE-4060 Ethernet module’s microprogramming software, related to shortcomings in password change procedures via the web server, allows a hacker to gain full access to the device with administrator privileges.

The vulnerability of the WISE-4060 Ethernet module’s microprogramming software is related to deficiencies in the password change process via the web server. Exploiting this vulnerability could allow an attacker to gain full access to the device with administrator privileges...

CVE-2021-26800

Cross Site Request Forgery CSRF vulnerability in Change-password.php in phpgurukul user management system in php using stored procedure V1.0, allows attackers to change the password to an arbitrary account...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF vulnerability in Change-password.php in phpgurukul user management system in php using stored procedure V1.0, allows attackers to change the password to an arbitrary account...

User Management System 跨站请求伪造漏洞

User Management System is a Php user management system using stored procedures by Anuj Kumar, an individual developer. A security vulnerability exists in user management system that allows an attacker to change passwords to arbitrary accounts...

Pluck Authorization Issues Vulnerabilities

Pluck is a content management system CMS developed using the PHP language. Pluck-CMS Pluck suffers from an authorization issue vulnerability that stems from a session repair vulnerability in login.php that allows an attacker to maintain unauthorized access to the platform. Since Pluck does not...

Zucchetti Axess CLOKI Access Control 1.64 Cross Site Request Forgery

!-- Zucchetti Axess CLOKI Access Control 1.64 CSRF Disable Access Control Vendor: Zucchetti Axess S.p.A. Product web page: https://www.axesstmc.com Affected version: 1.64 1.63 1.54 Summary: CLOKI is the pre-installed application on our terminals that provides simple to use access control manageme...