4973 matches found
CVE-2019-16106
The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to change the password of any user via the recruitmentonline/personalData/actacounttab.cfm txtNewUserName and hdNP fields...
Design/Logic Flaw
In CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail password of a victim account via an attacker account...
CVE-2019-16106
The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to change the password of any user via the recruitmentonline/personalData/actacounttab.cfm txtNewUserName and hdNP fields...
Protect
An Improper Authorization vulnerability in the SSL VPN web portal may allow an unauthenticated attacker to change the password of an SSL VPN web portal user via specially crafted HTTP requests...
Chengdu RenWeiHang Technology Co., Ltd. mobile mall system has a logic flaw vulnerability
Chengdu RenWeiHang Technology Limited Liability Company is a company that focuses on enterprise-level e-commerce service technology and provides traditional enterprises + Internet with all kinds of specialized e-commerce solutions and software systems from light application, professional level to...
Logic Flaw Vulnerability in Mobile Mall System of Chengdu Renwang Technology Limited Liability Company (CNVD-2019-30697)
Chengdu RenWeiHang Technology Limited Liability Company is a company that focuses on enterprise-level e-commerce service technology and provides traditional enterprises + Internet with all kinds of specialized e-commerce solutions and software systems from light application, professional level to...
PYSEC-2019-174
Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /comment/add/, /documents/1/view/, /documents/create/, /opportunities/create/, and /login/...
CVE-2019-4169
CVE-2019-4169 affects IBM Open Power Firmware OP910 and OP920. The issue allows BMC access via IPMI using the default OpenBMC password even after the BMC password has been changed. IBM’s bulletin confirms affected Power9 OpenPOWER releases OP910 and OP920 and provides remediation: OP910 users sho...
Chengdu Renwu Technology Co., Ltd. e-commerce system has a logic flaw vulnerability
Chengdu RenWeiHang Technology Co., Ltd. focuses on enterprise-level e-commerce service technology, and provides various specialized e-commerce solutions and software systems from light application, professional level to platform level for traditional enterprises + Internet. Chengdu RenWeiHang...
The vulnerability of the password_change.cgi web interface of the system administration interface for UNIX-like operating systems, Webmin, allows a hacker to execute arbitrary code.
The vulnerability of the passwordchange.cgi web interface of the system administration interface for UNIX-like operating systems in Webmin is related to the improper elimination of special elements used in commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary code ...
CentOS Web Panel Cross-Site Request Forgery Vulnerability (CNVD-2019-40074)
CentOS Web Panel CWP is a free web-hosting control panel that makes it easy to manage multiple servers without having to access the server via SSH for every little task that needs to be done. A cross-site request forgery vulnerability exists in the "Forgot Password" feature in CentOS Web Panel...
CVE-2019-5638
Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unrelated credential leak, that user...
Session fixation
Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unrelated credential leak, that user...
Cross site request forgery (csrf)
In CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.837, CSRF in the forgot password function allows an attacker to change the password for the root account...
Backdoor Found in Utility for Linux, Unix Servers
In an unnerving twist, when a critical zero-day vulnerability was reported in a Unix administration tool, called Webmin, it was revealed the flaw was no accident. According to researchers, the vulnerability was a secret backdoor planted in the popular utility nearly a year before its discovery. T...
PT-2019-17796 · Rapid7 · Rapid7 Nexpose
Name of the Vulnerable Software and Affected Versions: Rapid7 Nexpose versions 6.5.50 and prior Description: The issue arises from insufficient session expiration when an administrator performs a security-relevant edit on an existing, logged-on user. For example, if a user's password is changed b...
CentOS Control Web Panel (CWP) 0.9.8.851 phpMyAdmin Password Change Vulnerability
Exploit for linux platform in category web applications Exploit Title : CWP CentOS Control Web Panel Reset other phpMyadmin password Exploit Author : Pongtorn Angsuchotmetee, Nissana Sirijirakal, Narin Boonwasanarak Vendor Homepage : https://control-webpanel.com/ Software Link : Not available, us...
CentOS-WebPanel.com Control Web Panel (CWP) 0.9.8.851 phpMyAdmin Password Change
Exploit Title : CWP CentOS Control Web Panel Reset other phpMyadmin password Date : 24 Jul 2019 Exploit Author : Pongtorn Angsuchotmetee, Nissana Sirijirakal, Narin Boonwasanarak Vendor Homepage : https://control-webpanel.com/ Software Link : Not available, user panel only available for lastest...
