Pluck 授权问题漏洞

Pluck is a content management system CMS developed using the PHP language. Pluck-CMS Pluck suffers from an authorization issue vulnerability that stems from a session repair vulnerability in login.php that allows an attacker to maintain unauthorized access to the platform. Since Pluck does not...

CVE-2021-41694

An Incorrect Access Control vulnerability exists in Premiumdatingscript 4.2.7.7 via the password change procedure in requests\user.php...

CVE-2021-41694

An Incorrect Access Control vulnerability exists in Premiumdatingscript 4.2.7.7 via the password change procedure in requests\user.php...

Improper access control

An Incorrect Access Control vulnerability exists in Premiumdatingscript 4.2.7.7 via the password change procedure in requests\user.php...

CVE-2021-41694

An Incorrect Access Control vulnerability exists in Premiumdatingscript 4.2.7.7 via the password change procedure in requests\user.php...

PT-2021-23378 · Unknown · Premiumdatingscript

Name of the Vulnerable Software and Affected Versions: Premiumdatingscript version 4.2.7.7 Description: An issue exists due to incorrect access control in the password change procedure. This issue is specifically found in the requestsuser.php file. Recommendations: For Premiumdatingscript version...

Reprise License Manager 14.2 Unauthenticated Password Change Vulnerability

Product: Reprise License Manager 14.2 Vendor: Reprise Software CVE ID: CVE-2021-44152 Vulnerability Title: Unauthenticated Password Change Severity: High Authors: Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard Introduction: Because...

Reprise License Manager 14.2 Unauthenticated Password Change

Product: Reprise License Manager 14.2 Vendor: Reprise Software CVE ID: CVE-2021-44152 Vulnerability Title: Unauthenticated Password Change Severity: High Authors: Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard Date: 2021-11-25...

USN-5180-1 mailman vulnerability

It was discovered that Mailman incorrectly handled CSRF tokens. A remote list member or moderator could possibly use their own token to craft an admin request CSRF attack and set a new admin password or make other changes...

CVE-2021-44227

In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request using that token to set a new admin password or make other changes...

GNU Mailman 跨站请求伪造漏洞

GNU Mailman is a free suite of software from the GNU community for managing e-mail discussions and e-mail lists. The software integrates with Web projects to make it easy for users to manage email subscription accounts and provides built-in archiving, automatic forwarding processing, content...

PT-2021-6019

Name of the Vulnerable Software and Affected Versions GNU Mailman versions prior to 2.1.38 Description The issue is related to insufficient validation of the source of HTTP requests in GNU Mailman, allowing a remote attacker to force a victim to visit a special web page and perform arbitrary...

CVE-2021-40101

An issue was discovered in Concrete CMS before 8.5.7. The Dashboard allows a user's password to be changed without a prompt for the current password...

CVE-2021-40101

An issue was discovered in Concrete CMS before 8.5.7. The Dashboard allows a user's password to be changed without a prompt for the current password...

CVE-2021-40101

An issue was discovered in Concrete CMS before 8.5.7. The Dashboard allows a user's password to be changed without a prompt for the current password...

Default credentials

An issue was discovered in Concrete CMS before 8.5.7. The Dashboard allows a user's password to be changed without a prompt for the current password...

CVE-2021-40101

Concrete CMS before 8.5.7 contains an issue in the Dashboard where a user’s password can be changed without prompting for the current password. Affected component: Dashboard/password change logic. Root cause: lack of a current-password check during password update. Impact stated by sources: passw...

PortlandLabs Concrete CMS 安全漏洞

PortlandLabs Concrete Cms is a team-oriented open source content management system from PortlandLabs, Inc. in the United States. A security vulnerability exists in PortlandLabs Concrete CMS, which stems from the product allowing passwords to be changed without prompting for the current password...

Insecure Cookie Handling

symfony/security-bundle vulnerable to Insecure Cookie Handling attacks. The vulnerability exists because the remember me cookie does not properly invalidate the session after the password change. An attacker could use this flaw to steal sensitive user information and gain access to the applicatio...

CVE-2021-41268

Symfony/SecurityBundle is the security system for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Since the rework of the Remember me cookie in version 5.3.0, the cookie is not invalidated when the user changes their password. Attackers can therefor...