4969 matches found
Default credentials
In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role...
CVE-2016-6815
In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role...
CVE-2016-6815
In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role...
ProMinent MultiFLEX M10a Controller Password Change Vulnerability
The MultiFLEX M10a Controller is a water treatment controller. A password change vulnerability exists in the ProMinent MultiFLEX M10a Controller, where the application does not require the user to know the original password when setting a new password for the user, which can be exploited by an...
Override Access Vulnerability in Flying Fishstar VE Series Routers
Flyingfish Star VE series router 1021 firmware is a router product developed by Chengdu Flyingfish Star Technology Development Co. An unauthorized access vulnerability exists in the Flying Fish Star VE Series Router 1021 firmware. An attacker could use this vulnerability to remotely change the...
Unikrn: Weak Session ID Implementation - No Session change on Password change
Summary: Weak session id implementation Description: Unikrn does not change session id after password is changed. Reusing same session ids, after password is changed is highly risky. Example scenario: Hacker has successfully brute forced the password of a victim and has access to the account. The...
Hikvision IP Camera Unauthenticated Password Change Via Improper Authentication Logic
Many Hikvision IP cameras contain improper authentication logic which allows unauthenticated impersonation of any configured user account. The vulnerability has been present in Hikvision products since 2014. In addition to Hikvision-branded devices, it affects many white-labeled camera products...
WSO2 Data Analytics Server Cross-Site Scripting Vulnerability
WSO2 Data Analytics Server is a data analytics server from WSO2, Inc. that provides real-time analysis of data streams, complex event processing, and machine learning. A cross-site scripting vulnerability exists in the carbon/resources/addcollectionajaxprocessor.jsp file in WSO2 Data Analytics...
View App has a logic design flaw
Viewtec APP is an interactive mobile internet product with video as the main content carrier. There is a vulnerability in the logic design of Videotek APP, which allows an attacker to arbitrarily register users and change account passwords by grabbing packets...
Mail.ru: A manager of a determinate group of users still might have access to any user account from any group that he doesn't administrate anymore.
Domain, site, application: biz.mail.ru Testing environment: Lastest Chrome Steps to reproduce: Ok, this one is pretty much depending on scenario, so lets assume that there is the Evil Manager exists with network knowledge on higher than medium level. At first lets say that there is such role as...
Beijing Hanbang Hanbanggaoke IP Camera Arbitrary Password Change Vulnerability
Beijing Hanbang Hanbanggaoke IP Camera is a network camera from China Hanbang Gaoke. A security vulnerability in the processing of requests in Beijing Hanbang Hanbanggaoke IP Camera /ISAPI/Security/users/1 could be exploited by remote attackers to submit a special request to change the...
WordPress BulletProof Security Plugin Cross-Site Scripting Vulnerability
WordPress is a blogging platform developed in PHP by the WordPress Software Foundation, which supports setting up personal blog sites on PHP and MySQL servers.BulletProof Security is one of the security plug-ins against brute-force cracking. A cross-site scripting vulnerability exists in the...
Default credentials
On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1 allows an admin password change...
CVE-2017-14335
On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1 allows an admin password change...
CVE-2017-14335
Beijing Hanbang Hanbanggaoke IP Camera devices are affected. A vulnerability exists due to insufficient sanitization of user-controlled input, allowing a remote attacker to change the administrator password by sending a PUT request to /ISAPI/Security/users/1. The PoC demonstrates changing admin/p...
Hanbanggaoke IP Camera Arbitrary Password Change
Vulnerability summary The following advisory describes an arbitrary password change vulnerability found in Hanbanggaoke webcams. Beijing Hanbang Technology, “one of the first enterprises entering into digital video surveillance industry, has been focusing on R&D of products and technology of...
Hanbanggaoke IP Camera - Arbitrary Password Change
Vulnerability summary The following advisory describes an arbitrary password change vulnerability found in Hanbanggaoke webcams. Beijing Hanbang Technology, “one of the first enterprises entering into digital video surveillance industry, has been focusing on R&D of products and technology of...
Hanbanggaoke IP Camera - Arbitrary Password Change
Hanbanggaoke IP Camera - Arbitrary Password Change Vulnerability summary The following advisory describes an arbitrary password change vulnerability found in Hanbanggaoke webcams. Beijing Hanbang Technology, “one of the first enterprises entering into digital video surveillance industry, has been...
Logic design flaws in Link Travel App
Liancheng Mobility APP is a time-sharing O2O model of new energy vehicle mobility mobile products. There is a logical design loophole in Liancheng Mobility APP. After logging in to the system, an attacker can arbitrarily register users and change their passwords and perform unauthorized operation...
Secure Web and Authentication flow.
The following table notes whether Secure Web prompts a user for credentials, based on the configuration and site type: Connection mode| Site type| Password caching?| SSO configured for NetScaler Gateway?| Secure Web prompts for credentials? ---|---|---|---|--- On first access of a website| On...