CVE-2018-7831

An Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to send a specially crafted URL to a currently authenticated web server user to execute a...

CVE-2018-7809

An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the password delete function of the web server...

Default credentials

An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the change password function of the web server...

CVE-2018-7811

CVE-2018-7811 affects Schneider Electric Modicon M340, Premium, Quantum PLCs and BMXNOR0200. The embedded web servers expose an Unverified Password Change vulnerability that allows an unauthenticated remote attacker to access the change password function. This is a server-side authentication/auth...

CVE-2018-7811

An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the change password function of the web server...

CVE-2018-7831

This entry documents CVE-2018-7831, affecting Schneider Electric Modicon embedded web servers in M340, Premium, Quantum PLCs and BMXNOR0200. The vulnerability is an improper neutralization of script-related HTML tags (Basic XSS) that can be exploited by sending a specially crafted URL to a curren...

CVE-2018-7809

The CVE-2018-7809 issue affects Schneider Electric Modicon embedded Web servers in M340, Premium, Quantum PLCs and BMXNOR0200. The root cause is an Unverified Password Change vulnerability that allows an unauthenticated remote attacker to access the password delete function via the web server. Im...

CVE-2018-7809

An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the password delete function of the web server...

Dunkin Donuts Perks loyalty data breach: Change your password

By Waqas Dunkin Donuts says it has suffered a data breach in which customer data of its DD Perks loyalty program may have been stolen - The DD Perk is a reward program for the company's regular customers. According to a now-inaccessible security advisory, Dunkin Donuts stated that the data breach...

Cross-site scripting vulnerability in multiple Schneider Electric products (CNVD-2018-25427)

Schneider Electric Modicon M340, etc. are programmable logic controller products of Schneider Electric France. A cross-site scripting vulnerability exists in the embedded web server in several Schneider Electric products, which can be exploited by remote attackers to change passwords on the web...

TOTOLINK A3002RU Access Control Error Vulnerability

The TOTOLINK A3002RU is an AC1200 wireless dual-band Gigabit router. An access control error vulnerability exists in formPasswordSetup in TOTOLINK A3002RU version 1.0.8, which can be exploited by an attacker to change the password of an administrator user via an unauthenticated POST request...

CVE-2018-13315

Incorrect access control in formPasswordSetup in TOTOLINK A3002RU version 1.0.8 allows attackers to change the admin user's password via an unauthenticated POST request...

CVE-2018-13315

Incorrect access control in formPasswordSetup in TOTOLINK A3002RU version 1.0.8 allows attackers to change the admin user's password via an unauthenticated POST request...

CVE-2018-13315

CVE-2018-13315 affects TOTOLINK A3002RU (firmware 1.0.8). The Root Cause is incorrect access control in formPasswordSetup, enabling an unauthenticated POST to change the administrator password. As per NVD, the CVSS‑3 base score is 9.8 (CRITICAL; NETWORK, no user interaction, high confidentiality/...

CVE-2018-19555

tp4a TELEPORT 3.1.0 has CSRF via user/do-reset-password to change any password, such as the administrator password...

TELEPORT Cross-Site Request Forgery Vulnerability

tp4a TELEPORT is a bastion system. The system supports hopping and management of RDP and SSH protocols. A cross-site request forgery vulnerability exists in tp4a TELEPORT version 3.1.0. A remote attacker can exploit this vulnerability to change arbitrary passwords e.g., administrator password wit...

CVE-2018-19437

UCMS 1.4.7 allows remote authenticated users to change the administrator password because $COOKIE'admin'.cookiehash is used for arbitrary cookie values that are set and not empty...

UCMS Administrator Password Change Vulnerability

UCMS is a content management system written in PHP. A security vulnerability exists in UCMS version 1.4.7, where the vulnerable program uses COOKIE'admin'.cookiehash for arbitrary cookie values. A remote attacker can exploit the vulnerability to change the administrator password...

CVE-2018-18773

CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=rootpwd, as demonstrated by changing the root password...

SeaCMS cross-site scripting vulnerability (CNVD-2019-08330)

SeaCMS Ocean CMS is a professional open source free PHP film and television system. A stored cross-site scripting vulnerability exists in SeaCMS 6.6.4, which can be exploited by an attacker during a password change via the member.php?action=chgpwdsubmit email parameter...