CVE-2018-11474

Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&userid=1 does not invalidate a session that is open in a different browser...

CVE-2018-11475

Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser...

CVE-2018-11475

Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser...

CVE-2018-11475

Summary : Monstra CMS 3.0.4 is affected by a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser. Impact : a user’s active session remains valid in other browsers after a password change (per the CVE descri...

CVE-2018-11474

Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&userid=1 does not invalidate a session that is open in a different browser...

CVE-2018-11474

Monstra CMS 3.0.4 is affected by a Session Management Issue in the Administrations Tab (admin/index.php?id=users&action=edit&user_id=1). According to CVE-2018-11474, changing a user password does not invalidate an active session from another browser, enabling an existing session to remain authent...

Teradek Slice 7.3.15 - Cross-Site Request Forgery

...

CVE-2018-1148

In Nessus before 7.1.0, Session Fixation exists due to insufficient session management within the application. An authenticated attacker could maintain system access due to session fixation after a user password change...

CVE-2018-1148

In Nessus before 7.1.0, Session Fixation exists due to insufficient session management within the application. An authenticated attacker could maintain system access due to session fixation after a user password change...

CVE-2018-1148

In Nessus before 7.1.0, Session Fixation exists due to insufficient session management within the application. An authenticated attacker could maintain system access due to session fixation after a user password change...

D-Link DIR-868L Cross-Site Request Forgery Vulnerability

D-Link DIR-868L is a wireless router product from AUO D-Link. A cross-site request forgery vulnerability exists in the hedwig.cgi and pigwidgeon.cgi files in the D-Link DIR-868L. A remote attacker can exploit this vulnerability to change the Admin password...

Easy Hosting Control Panel Password Change Vulnerability

Easy Hosting Control Panel EHCP is an open source hosting control panel that is used to manage domains, emails, ftp users and more. A security vulnerability exists in EHCP version 0.37.12.b. The vulnerability stems from the program failing to request the current password when a new password is se...

CVE-2018-6617

Easy Hosting Control Panel EHCP v0.37.12.b, when using a local MySQL server, allows attackers to change passwords of arbitrary database users by leveraging failure to ask for the current password...

Design/Logic Flaw

Easy Hosting Control Panel EHCP v0.37.12.b, when using a local MySQL server, allows attackers to change passwords of arbitrary database users by leveraging failure to ask for the current password...

CVE-2018-6617

Easy Hosting Control Panel EHCP v0.37.12.b, when using a local MySQL server, allows attackers to change passwords of arbitrary database users by leveraging failure to ask for the current password...

CVE-2018-6617

Easy Hosting Control Panel EHCP v0.37.12.b, when using a local MySQL server, allows attackers to change passwords of arbitrary database users by leveraging failure to ask for the current password...

CVE-2018-6617

EHCP v0.37.12.b is affected: when using a local MySQL server, an attacker can change passwords of arbitrary database users because EHCP fails to prompt for the current password when setting a new one. This is a local-attack vector with high impact on confidentiality and integrity of database cred...

Easy Hosting Control Panel 0.37.12.b Unverified Password Change

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/EHCP-v0.37.12.b-UNVERIFIED-PASSWORD-CHANGE.txt + ISR: Apparition Security Greetz: indoushka|Eduardo|Dirty0tis Vendor: ============= www.ehcp.net Product: =========== Easy Hosting Control...

Timely Password-Change Call from Twitter, as Bugs Hit WebEx and GPON routers

The cyber security news cycle is always active, so to help you stay in the loop here’s a selection of incidents that caught our attention over the past week or so involving, among others, Twitter, Cisco and GPON routers. Twitter picks a good day for password-change call As “change your password”...

PT-2018-3909 · D Link · D-Link Dir-868L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-868L affected versions not specified Description: The issue is related to a CSRF Cross-Site Request Forgery attack, which can be exploited by a remote attacker. This could allow the attacker to perform actions such as changing the...