4979 matches found
CVE-2021-44152
An issue was discovered in Reprise RLM 14.2. Because /goform/changepasswordprocess does not verify authentication or authorization, an unauthenticated user can change the password of any existing user. This allows an attacker to change the password of any known user, thereby preventing valid user...
CVE-2021-44152
An issue was discovered in Reprise RLM 14.2. Because /goform/changepasswordprocess does not verify authentication or authorization, an unauthenticated user can change the password of any existing user. This allows an attacker to change the password of any known user, thereby preventing valid user...
CVE-2021-44152
An issue was discovered in Reprise RLM 14.2. Because /goform/changepasswordprocess does not verify authentication or authorization, an unauthenticated user can change the password of any existing user. This allows an attacker to change the password of any known user, thereby preventing valid user...
CVE-2021-44152
Summary of CVE-2021-44152 (Reprise RLM 14.2): The Goform/change_password_process API does not verify authentication or authorization, allowing an unauthenticated user to change the password of any existing user. This enables an attacker to disable legitimate access by changing user passwords and ...
PT-2021-24049 · Reprise · Reprise Rlm
Name of the Vulnerable Software and Affected Versions: Reprise RLM version 14.2 Description: An issue was discovered where the "/goform/change password process" API endpoint does not verify authentication or authorization, allowing an unauthenticated user to change the password of any existing...
Cybele Software Thinfinity VirtualUI授权问题漏洞
Cybele Software Thinfinity VirtualUI is a solution from Cybele Software, Inc. that supports embedding remote Windows applications into standard web applications to allow two-way interaction with Javascript programming. A security vulnerability exists in Cybele Software Thinfinity VirtualUI, which...
CVE-2021-44152
An issue was discovered in Reprise RLM 14.2. Because /goform/changepasswordprocess does not verify authentication or authorization, an unauthenticated user can change the password of any existing user. This allows an attacker to change the password of any known user, thereby preventing valid user...
CVE-2021-31745
Session Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to sustain unauthorized access to the platform. Because Pluck does not invalidate prior sessions after a password change, access can be sustained even after an administrator performs regular remediation...
Session fixation
Session Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to sustain unauthorized access to the platform. Because Pluck does not invalidate prior sessions after a password change, access can be sustained even after an administrator performs regular remediation...
GHSA-3H68-WVV6-8R5H Improper Removal of Sensitive Information Before Storage or Transfer in Apache Jackrabbit Oak
The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensitive information disclosure vulnerability. The code mandates the changed password to be passed as an additional attribute to the credentials object but does n...
Pluck 授权问题漏洞
Pluck is a content management system CMS developed using the PHP language. Pluck-CMS Pluck suffers from an authorization issue vulnerability that stems from a session repair vulnerability in login.php that allows an attacker to maintain unauthorized access to the platform. Since Pluck does not...
CVE-2021-41694
An Incorrect Access Control vulnerability exists in Premiumdatingscript 4.2.7.7 via the password change procedure in requests\user.php...
CVE-2021-41694
An Incorrect Access Control vulnerability exists in Premiumdatingscript 4.2.7.7 via the password change procedure in requests\user.php...
Improper access control
An Incorrect Access Control vulnerability exists in Premiumdatingscript 4.2.7.7 via the password change procedure in requests\user.php...
CVE-2021-41694
An Incorrect Access Control vulnerability exists in Premiumdatingscript 4.2.7.7 via the password change procedure in requests\user.php...
PT-2021-23378 · Unknown · Premiumdatingscript
Name of the Vulnerable Software and Affected Versions: Premiumdatingscript version 4.2.7.7 Description: An issue exists due to incorrect access control in the password change procedure. This issue is specifically found in the requestsuser.php file. Recommendations: For Premiumdatingscript version...
Reprise License Manager 14.2 Unauthenticated Password Change Vulnerability
Product: Reprise License Manager 14.2 Vendor: Reprise Software CVE ID: CVE-2021-44152 Vulnerability Title: Unauthenticated Password Change Severity: High Authors: Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard Introduction: Because...
Reprise License Manager 14.2 Unauthenticated Password Change
Product: Reprise License Manager 14.2 Vendor: Reprise Software CVE ID: CVE-2021-44152 Vulnerability Title: Unauthenticated Password Change Severity: High Authors: Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard Date: 2021-11-25...
USN-5180-1 mailman vulnerability
It was discovered that Mailman incorrectly handled CSRF tokens. A remote list member or moderator could possibly use their own token to craft an admin request CSRF attack and set a new admin password or make other changes...