HealthForYou 1.11.1 / HealthCoach 2.9.2 Missing Password Policy Vulnerability

HealthForYou version 1.11.1 and HealthCoach version 2.9.2 are missing a server-side password policy. When creating an account or changing your password the mobile and web application both check the password against the password policy. But the API assumes that the given password is already checke...

AyaCMS Cross-Site Request Forgery Vulnerability

AyaCMS is an extremely simple and free open source Php builder. AyaCMS suffers from a cross-site request forgery vulnerability that stems from the software's lack of checking for cross-site request forgery during an administrator password change. An attacker can exploit this vulnerability to chan...

CVE-2020-23686

Cross site request forgery CSRF vulnerability in AyaCMS 3.1.2 allows attackers to change an administrators password or other unspecified impacts...

AyaCMS 跨站请求伪造漏洞

AyaCMS is an extremely simple and free open source Php builder. AyaCMS suffers from a cross-site request forgery vulnerability that stems from the software's lack of checking for cross-site request forgery during an administrator password change. An attacker can exploit this vulnerability to chan...

Vulnerability fixed in HPE iLO

HPE has fixed a vulnerability in iLO Amplifier Pack. HPE iLO Amplifier Pack is an applicance that allows HPE iLO systems to be be managed. The vulnerability allows a malicious party to opportunity to execute arbitrary code on the HPE iLO Amplifier Pack. HPE recommends that after updating the HPE...

CVE-2021-25970

Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. A user that was already logged in, will still have access to the application even after the password was changed...

CVE-2021-25970 Camaleon CMS - Insufficient Session Expiration after Password Change

Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. A user that was already logged in, will still have access to the application even after the password was changed...

CVE-2021-25970 Camaleon CMS - Insufficient Session Expiration after Password Change

Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. A user that was already logged in, will still have access to the application even after the password was changed...

CVE-2021-25970

CVE-2021-25970 : Camaleon CMS (0.1.7–2.6.0) suffers from insufficient session expiration; active sessions aren’t terminated after password changes, allowing logged-in users continued access. Public advisories (GitHub GHSA-438X-2P9V-G8H9, Red Hat RH: CVE-2021-25970) align on the issue and confirm ...

CamaleonCMS 代码问题漏洞

CamaleonCMS is an advanced RubyonRails-based dynamic content management system CMS from the CamaleonCMS team. A security vulnerability exists in Camaleon CMS versions 0.1.7 through 2.6.0, which stems from an issue with the software's password change control that does not terminate a user's active...

in zmister2016/mrdoc

Description When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication. Proof of Concept https://github.com/zmister2016/MrDoc/blob/master/appadmin/views.pyL985 普通用户修改密码 @loginrequired @logger.catch def...

in forkcms/forkcms

Description Insufficient Session expiration even after Credential like password of the account is being updated. Proof of Concept open the same account in multiple browsers. change the password in one Browser. Reload the other one. as a result we can see the account on the other browser is not...

CVE-2021-35214

The vulnerability in SolarWinds Pingdom can be described as a failure to invalidate user session upon password or email address change. When running multiple active sessions in separate browser windows, it was observed a password or email address change could be changed without terminating the us...

CVE-2021-35214

The vulnerability in SolarWinds Pingdom can be described as a failure to invalidate user session upon password or email address change. When running multiple active sessions in separate browser windows, it was observed a password or email address change could be changed without terminating the us...

Design/Logic Flaw

The vulnerability in SolarWinds Pingdom can be described as a failure to invalidate user session upon password or email address change. When running multiple active sessions in separate browser windows, it was observed a password or email address change could be changed without terminating the us...

CVE-2021-35214

CVE-2021-35214 describes a session-management vulnerability in SolarWinds Pingdom: when a user changes password or email, active sessions in other windows were not invalidated, allowing continued access. Documents confirm multiple active sessions could persist across browser windows and that the ...

CVE-2021-33723

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. An authenticated attacker could change the user profile of any user without proper authorization. With this, the attacker could change the password of any user in the affected system...

CVE-2021-33723

Siemens SINEC NMS before version 1.0 SP2 Update 1 contains a vulnerability (CVE-2021-33723) that allows an authenticated attacker to change the user profile of any user, including passwords, due to improper authorization. This affects all versions prior to 1.0 SP2 Update 1. The issue is documente...

Siemens SINEC NMS 安全漏洞

SINEC NMS is a network management system from Siemens for monitoring and managing industrial networks.A user profile change vulnerability exists in versions prior to SINEC NMS 1.0 SP2 Update 1. The vulnerability can be exploited by an attacker to change the user profile of any user without proper...

Solarwinds SolarWinds Pingdom 代码问题漏洞

Solarwinds SolarWinds Pingdom is a complete website monitoring platform from Solarwinds, Inc. It is used to measure the latency of the websites it monitors. A security vulnerability exists in several solarwinds products. The vulnerability stems from the inability to invalidate a user's session...