4972 matches found
CVE-2018-18191
Cross-site request forgery CSRF vulnerability in /admin.php?c=member&m=edit&uid=1 in dayrui FineCms 5.4 allows remote attackers to change the administrator's password...
WSS Project Management System version 1.3.2 suffers from an override access vulnerability
WSS Project Management System is a browser-based collaborative office platform that integrates "Project Management", "Task Management", "Work Hour Management", "Work Log Management" and "Work Log Management". management" as one of the collaborative office platform. An override access vulnerabilit...
CVE-2018-17986
rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user...
CVE-2018-17986
CVE-2018-17986 affects razorCMS 3.4.8. The vulnerability is a Cross-Site Request Forgery (CSRF) in the rars/user/data page that allows changing the password of an admin user. No exploitation details are provided in the connected documents. Impact is described by multiple sources as enabling passw...
CVE-2018-17881
On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 SetPasswdSettings commands without authentication to trigger an admin password change...
Authentication flaw
On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 SetPasswdSettings commands without authentication to trigger an admin password change...
CVE-2018-17881
On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 SetPasswdSettings commands without authentication to trigger an admin password change...
GuangWei GuangWei Honda APPv2.1 has information leakage vulnerability
GuangWei GAC Honda APP is an APP that provides car owners with remote control of their cars, one-click car inspection, GPS positioning, violation information query, fuel consumption analysis, convenient merchant interaction, quick query of car information and other functions. A vulnerability exis...
CVE-2018-9082
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the password changing functionality available to authenticated users does not require the user's current password to set a new one. As a result, attackers with access to the user's session tokens can change their...
CVE-2018-9082
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the password changing functionality available to authenticated users does not require the user's current password to set a new one. As a result, attackers with access to the user's session tokens can change their...
Default credentials
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the password changing functionality available to authenticated users does not require the user's current password to set a new one. As a result, attackers with access to the user's session tokens can change their...
CVE-2018-9082 Iomega and LenovoEMC NAS Web UI Vulnerabilities
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the password changing functionality available to authenticated users does not require the user's current password to set a new one. As a result, attackers with access to the user's session tokens can change their...
CVE-2018-9082
CVE-2018-9082 affects Iomega/LenovoEMC NAS devices (notably versions 4.1.402.34662 and earlier). The vulnerability allows an authenticated user to change the target account password without providing the current password, enabling session token-based takeover and persistent access. Exploitation c...
Backdoor Vulnerability in NUUO NVRMini2
NUUO is one of the surveillance solution providers and NUUO NVRMini 2 is the NVR solution with NAS functionality. A backdoor vulnerability exists in NUUO NVRMini 2. When a specific file /tmp/moses/ exists in the file system of the target device, the backdoor will be opened, and any unauthorized...
NUUO NVR < 3.9.1 Backdoor Activated - Active Check
The Backdoor in NUUO NVR is active. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nuuo:nuuo"; if description...
QuickAppsCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-19557)
QuickAppsCMS aka QACMS is an open source content management system CMS developed using the MVC framework. A cross-site request forgery vulnerability exists in QuickAppsCMS 2.0.0-beta2 and earlier versions. A remote attacker can exploit this vulnerability to change the administrator password with...
Cagintranet GetSimple CMS Cross-Site Request Forgery Vulnerability
Cagintranet GetSimple CMS is an XML-based content management system CMS from Cagintranet Networks, USA. The system includes a theme selector and editor, component editor, image and file managers, and more. A cross-site request forgery vulnerability exists in Cagintranet GetSimple CMS version...
Oracle WebCenter Interaction Cross-Site Request Forgery Vulnerability
Oracle WebCenter Interaction, part of the Oracle WebCenter Suite, is a comprehensive, integrated set of components for creating enterprise portals, collaborative communities, portfolio applications and social applications. A cross-site request forgery vulnerability exists in Oracle WebCenter...
NUUO NVRMini2 Multiple Vulnerabilities
The version of NUUO NVRMini2 installed on the remote host is affected by multiple vulnerabilities: - NUUO NVRMini2 web server utilizes CGI binaries in order to handle a variety of commands that require authenticated interaction. Implemented session handling mechanism doesn't validate user's input...