4973 matches found
CVE-2019-14260
On the Alcatel-Lucent Enterprise ALE 8008 Cloud Edition Deskphone VoIP phone with firmware 1.50.13, a command injection missing input validation issue in the password change field for the Change Password interface allows an authenticated remote attacker in the same network to trigger OS commands...
Default credentials
cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands SEC-65...
CVE-2018-20882
cPanel before 74.0.8 allows arbitrary file-write operations in the context of the root account during WHM Force Password Change SEC-447...
CVE-2018-20882
cPanel before 74.0.8 allows arbitrary file-write operations in the context of the root account during WHM Force Password Change SEC-447...
Default credentials
cPanel before 74.0.8 allows arbitrary file-write operations in the context of the root account during WHM Force Password Change SEC-447...
CVE-2018-20882
CVE-2018-20882 affects cPanel prior to 74.0.8, enabling arbitrary file-write under the root context during WHM Force Password Change (SEC-447). This is a local-attack vector impacting systems running affected cPanel versions. The vulnerability arises in the root context during the password-change...
CVE-2018-20882
cPanel before 74.0.8 allows arbitrary file-write operations in the context of the root account during WHM Force Password Change SEC-447...
Cisco Catalyst 3850 Series Device Manager 3.6.10E Cross Site Request Forgery
Product : Catalyst 3850 Series Device Manager Version : 3.6.10E Date: 01.08.2019 Vendor Homepage: https://www.cisco.com Exploit Author: Alperen Soydan Description : The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify...
Alcatel-Lucent Enterprise 8008 Cloud Edition Deskphone VoIP Command Injection Vulnerability
ALE 8008 Cloud Edition Deskphone VoIP is a cloud edition desktop IP phone from ALE France. A command injection vulnerability exists in the password change field of the password change screen in the Alcatel-Lucent Enterprise ALE 8008 Cloud Edition Deskphone VoIP with firmware version 1.50.13, whic...
Design/Logic Flaw
cPanel before 76.0.8 unsafely performs PostgreSQL password changes SEC-366...
CVE-2018-20862
The CVE-2018-20862 issue affects cPanel prior to 76.0.8, where PostgreSQL password changes are performed unsafely (SEC-366). Affected: cPanel’s password-change workflow for PostgreSQL. Impact: potential improper handling of password changes; CVSS indicates high impact (confidentiality, integrity,...
CVE-2018-20862
cPanel before 76.0.8 unsafely performs PostgreSQL password changes SEC-366...
Kartpay: Being able to change account contents even after password change
Improper Handling of Sessions leads to this vulnerability where users can try to login with 2 different sessions in 2 different browsers. changing any data doesn't reflect all the logged-in sessions...
Schneider Electric Modicon Multiple Authentication Bypass Vulnerabilities (CVE-2018-7809; CVE-2018-7810; CVE-2018-7811)
Multiple authentication bypass vulnerabilities exist in Schneider Electric Modicon. A remote, unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request to the affected page. Successful exploitation results in the attacker being able to change the password for...
SyGuestBook A5 Cross-Site Request Forgery Vulnerability
SyGuestBook A5 is a PHP-based open source message board system . A cross-site request forgery vulnerability exists in SyGuestBook A5 version 1.2. An attacker can use this vulnerability to change the administrator password...
Dolibarr ERP/CRM Cross-Site Request Forgery Vulnerability
Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. A cross-site request forgery vulnerability exists in Dolibarr...
CVE-2019-13949
SyGuestBook A5 Version 1.2 has no CSRF protection mechanism, as demonstrated by CSRF for an index.php?c=Administrator&a=update admin password change...
CVE-2019-13949
SyGuestBook A5 Version 1.2 has no CSRF protection mechanism, as demonstrated by CSRF for an index.php?c=Administrator&a=update admin password change...