4972 matches found
CVE-2018-19350
In SeaCMS v6.6.4, there is stored XSS via the member.php?action=chgpwdsubmit email parameter during a password change, as demonstrated by a data: URL in an OBJECT element...
Cross site scripting
In SeaCMS v6.6.4, there is stored XSS via the member.php?action=chgpwdsubmit email parameter during a password change, as demonstrated by a data: URL in an OBJECT element...
CVE-2018-19350
In SeaCMS v6.6.4, there is stored XSS via the member.php?action=chgpwdsubmit email parameter during a password change, as demonstrated by a data: URL in an OBJECT element...
CVE-2018-19350
In SeaCMS v6.6.4, there is stored XSS via the member.php?action=chgpwdsubmit email parameter during a password change, as demonstrated by a data: URL in an OBJECT element...
CVE-2018-19350
SeaCMS v6.6.4 is vulnerable to a stored XSS via the email parameter in member.php?action=chgpwdsubmit during password changes. The issue is demonstrated by a data: URL inside an OBJECT element. Confirmed by multiple sources (NVD entry CVE-2018-19350 and CNVD/CVEs referencing SeaCMS 6.6.4). The vu...
Mailing Tech Support a Bomb
I understand his frustration, but this is extreme: When police asked Cryptopay what could have motivated Salonen to send the company a pipe bomb or, rather, two pipe bombs, which is what investigators found when they picked apart the explosive package the only thing the company could think of...
Smule: Missing Rate Limit in Password Change
Incorrect or missing rate limits related to account features...
CVE-2018-18711
An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's password via index.php?m=core&f=panel&v=editinfo...
CVE-2018-18711
The CVE-2018-18711 case concerns WUZHI CMS 4.1.0, where a Cross-Site Request Forgery (CSRF) vulnerability exists that allows an attacker to change the super administrator’s password through the request at index.php?m=core&f=panel&v=edit_info. The connected documents corroborate the CSRF issue in ...
Moxa ThingsPro Password Management Vulnerability
Moxa ThingsPro is a suite of IoT gateway and device management solutions from Moxa. A security vulnerability exists in Moxa ThingsPro version 2.1. A remote attacker could exploit the vulnerability to change a user's password...
CVE-2018-1822
CVE-2018-1822 affects IBM FlashSystem 840 and 900 GUI. The vulnerability allows a crafted attack to bypass authentication, enabling remote escalation of privileges and potential administrative control or denial of service. Affected MTMs include FlashSystem 840 (9840-AE1, 9843-AE1) and FlashSystem...
CVE-2018-1822
IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the ability to remotely change the superuser password. This can be used by an attacker to gain administrative control or to deny service. IBM X-Force ID: 150296...
Moderate severity vulnerability that affects org.apache.ranger:ranger
In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role...
GHSA-VHXC-8JJQ-859J Moderate severity vulnerability that affects org.apache.ranger:ranger
In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role...
CVE-2018-15539
Agentejo Cockpit lacks an anti-CSRF protection mechanism. Thus, an attacker is able to change API tokens, passwords, etc...
HaPe PKH 1.1 Cross Site Request Forgery
Exploit Title: HaPe PKH 1.1 - Cross-Site Request Forgery Update Admin Dork: N/A Date: 2018-10-12 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.sitejo.id Software Link: https://sourceforge.net/projects/hape-pkh/files/latest/download Version: 1.1 Category: Webapps Tested on:...
Huawei Mate 10 Pro Improper Authentication Vulnerability
Huawei Mate 10 Pro is a smartphone product from Chinese company Huawei Huawei. An improper authentication vulnerability exists in Huawei Mate 10 Pro BLA-AL00B 8.1.0.326C00, which can be exploited by an attacker to directly change the app lock password and use a locked app...
Improper Input Validation in ansible
An input validation vulnerability was found in Ansible's mysqluser module before 2.2.1.0, which may fail to correctly change a password in certain circumstances. Thus the previous password would still be active when it should have been changed...
GHSA-X4CM-M36H-C6QJ Improper Input Validation in ansible
An input validation vulnerability was found in Ansible's mysqluser module before 2.2.1.0, which may fail to correctly change a password in certain circumstances. Thus the previous password would still be active when it should have been changed...