4975 matches found
CVE-2021-21260
Online Invoicing System OIS is open source software which is a lean invoicing system for small businesses, consultants and freelancers created using AppGini. In OIS version 4.0 there is a stored XSS which can enables an attacker takeover of the admin account through a payload that extracts a csrf...
CVE-2021-25323
The default setting of MISP 2.4.136 did not enable the requirements aka requirepasswordconfirmation to provide the previous password when changing a password...
CVE-2021-25323
The default setting of MISP 2.4.136 did not enable the requirements aka requirepasswordconfirmation to provide the previous password when changing a password...
CVE-2021-25323
The default setting of MISP 2.4.136 did not enable the requirements aka requirepasswordconfirmation to provide the previous password when changing a password...
Mautic 跨站脚本漏洞
Mautic is an open source marketing automation software. The software monitors and manages websites, sends emails and manages customer resources. A cross-site scripting vulnerability exists in versions prior to Mautic 3.2.4, which can be exploited by an attacker to load an external JavaScript file...
MISP 授权问题漏洞
MISP is an open source software solution. The product is used to collect, store, distribute and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A default configuration error vulnerability exists in MISP version 2.4.136, which stems fr...
Mautic 跨站脚本漏洞
Mautic is an open source marketing automation software. The software monitors and manages websites, sends emails and manages customer resources. A security vulnerability exists in versions prior to Mautic 3.2.4, which can be exploited by attackers to perform actions on targeted users. These actio...
postgresql: Stack-based buffer overflow via setting a password
PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the...
Cisco Connected Mobile Experiences Access Control Error Vulnerability
Cisco Connected Mobile Experiences is a connected mobile experience from Cisco USA. An access control error vulnerability exists in Cisco Connected Mobile Experiences that could allow a remote, authenticated attacker with no administrative privileges to change the password of any user on an...
CVE-2021-1144
A vulnerability in Cisco Connected Mobile Experiences CMX could allow a remote, authenticated attacker without administrative privileges to alter the password of any user on an affected system. The vulnerability is due to incorrect handling of authorization checks for changing a password. An...
Cisco Connected Mobile Experiences 访问控制错误漏洞
Cisco Connected Mobile Experiences is a connected mobile experience from Cisco USA. An access control error vulnerability exists in Cisco Connected Mobile Experiences that could allow a remote, authenticated attacker with no administrative privileges to change the password of any user on an...
Ubiquiti: Change Your Password, Enable 2FA
Ubiquiti, a major vendor of cloud-enabled Internet of Things IoT devices such as routers, network video recorders, security cameras and access control systems, is urging customers to change their passwords and enable multi-factor authentication. The company says an incident at a third-party cloud...
CMCC R3S-3 at CMCC IoT Ltd. is vulnerable to logic flaws
The CMCC R3S-3 is a router. A logic flaw vulnerability exists in the CMCC R3S-3 of CMCC Internet of Things Ltd. An attacker can exploit the vulnerability to remotely and arbitrarily change the password of the management side...
MK-AUTH Cross-Site Request Forgery Vulnerability
MK-AUTH is an access control system developed by Pedro Filho, an individual developer in Brazil. A cross-site request forgery vulnerability exists in MK-AUTH through version 19.01 K4.9, which allows passwords to be changed via the central executor central.php. No details of the vulnerability are...
CVE-2020-35745
PHPGURUKUL Hospital Management System V 4.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, doctors, patients, change admin password, get appointment history and access all session logs...
Code injection
PHPGURUKUL Hospital Management System V 4.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, doctors, patients, change admin password, get appointment history and access all session logs...
CVE-2020-35219
The ASUS DSL-N17U modem with firmware 1.1.0.2 allows attackers to access the admin interface by changing the admin password without authentication via a POST request to AdvancedSystemContent.asp with the uiViewToolsusername=admin&uiViewToolsPassword= and uiViewToolsPasswordConfirm= substrings...
Authentication flaw
The ASUS DSL-N17U modem with firmware 1.1.0.2 allows attackers to access the admin interface by changing the admin password without authentication via a POST request to AdvancedSystemContent.asp with the uiViewToolsusername=admin&uiViewToolsPassword= and uiViewToolsPasswordConfirm= substrings...