4975 matches found
Moneybird: Pending MFA logins aren't immediatly expired after a password change
Researcher found an issue with sessions not all being terminated when password is changed. The 2FA implementation was at fault in this scenario as the session was found to be active even after the password was changed and two-step verification was turned off...
Stripo Inc: Able to change password by entering wrong old password
Vulnerability Name: Able to change password by entering wrong old password. Description: The password change mechanism which is located at https://my.stripo.email/cabinet//profile is insecure as the password can be changed without knowing the old password. Any unauthorized user can access the...
SITOS six build license issue vulnerability
SITOS is a modular e-learning system. The system includes features such as audio playback, video playback, forums, blogs and social media. An authorization issue vulnerability exists in SITOS six Build v6.2.1. An attacker can exploit the vulnerability to change the passwords and email addresses o...
Stripo Inc: OLD SESSION DOES NOT EXPIRE AFTER PASSWORD CHANGE
OLD SESSION DOES NOT EXPIRE AFTER PASSWORD CHANGE Description: On changing password both session using which user changes password and old sessions in any other browser or device does not expire and remains active. STEPS TO REPRODUCE: 1. Log in to Browser A and make sure to check 'stay logged in ...
CVE-2010-3305
Cross-site request forgery CSRF vulnerability in pixelpost 1.7.3 could allow remote attackers to change the admin password...
CVE-2010-3305
This entry concerns CVE-2010-3305, a CSRF vulnerability in Pixelpost 1.7.3 that could allow remote attackers to change the admin password. The connected documents confirm the affected software/version and the underlying issue (CSRF) with implications for admin credentials. The provided materials ...
CVE-2019-17605
A mass assignment vulnerability in eyecomms eyeCMS through 2019-10-15 allows any candidate to take over another candidate's account by also exploiting CVE-2019-17604 via a modified candidate id and an additional password parameter. The outcome is that the password of this other candidate is chang...
CVE-2019-5617
Computing For Good's Basic Laboratory Information System also known as C4G BLIS version 3.4 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may change the password of any administrator-level user...
ALPINE-CVE-2019-14833
A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or a new password for a samba user. The Samba Active Directory Domain Controller can be configured to use a custom script to check for passwo...
CVE-2018-4064
An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a unverified device configuration change, resulting in an unverified change of the user password on the...
CVE-2018-4064
An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a unverified device configuration change, resulting in an unverified change of the user password on the...
Cross site request forgery (csrf)
An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a unverified device configuration change, resulting in an unverified change of the user password on the...
CVE-2018-4064
CVE-2018-4064 affects Sierra Wireless AirLink ES450 FW 4.9.3 in ACEManager upload.cgi: an authenticated HTTP request can trigger an unverified password change on the device, enabling configuration changes and password alteration. The vulnerability is part of a set of ACEManager flaws (upload.cgi ...
CVE-2018-4064
An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a unverified device configuration change, resulting in an unverified change of the user password on the...
Leading Web Domain Name Registrars Disclose Data Breach
Another day, another massive data breach—this time affecting a leading web technology company, as well as both of its subsidiaries, from where millions of customers around the world have purchased domain names for their websites. The world's top domain registrars Web.com, Network Solutions, and...
ZTE 9000E Privilege Permission and Access Control Issues Vulnerability
The ZTE 9000E is a carrier-grade multi-service packet platform product from China's ZTE Corporation ZTE. A privilege permission and access control issue vulnerability exists in ZTE 9000E 9000EV5.0R1B12 and earlier versions, which can be exploited by an attacker to directly setup and change the...
ClonOs WEB UI 19.09 - Improper Access Control Exploit
Exploit for php platform in category web applications Exploit Title: ClonOs WEB UI 19.09 - Improper Access Control Exploit Author: İbrahim Hakan Şeker Vendor Homepage: https://clonos.tekroutine.com/ Software Link: https://github.com/clonos/control-pane Version: 19.09 Tested on: ClonOs CVE :...
ClonOs WEB UI 19.09 - Improper Access Control
Exploit Title: ClonOs WEB UI 19.09 - Improper Access Control Date: 2019-10-19 Exploit Author: İbrahim Hakan Şeker Vendor Homepage: https://clonos.tekroutine.com/ Software Link: https://github.com/clonos/control-pane Version: 19.09 Tested on: ClonOs CVE : 2019-18418 import requests from bs4 import...
ClonOS WEB control panel authorization issue vulnerability
ClonOS is an open source platform based on FreeBSD. The platform is mainly used for the creation and management of virtual environments. web control panel is one of the web-based ClonOS control panel. An authorization issue vulnerability exists in the clonos.php file in ClonOS WEB control panel...