4969 matches found
XenMobile: Error "Incorrect Credentials" for AD user during enrollment
Issue: User whose AD password is changed recently is facingan enrollment issue. After entering AD username/password it gives error message "Incorrect Credentials". SHP login fails too...
User Login and Management - Multiple Vulnerabilities
Exploit for php platform in category web applications ----------------------------------------------------------------------------------- | |---------------------------------------------------------------------------------- 1 admin dashboard authentication bypass Description : An Attackers are ab...
GSA Bounty: 2FA bypass - confirmation tokens don't expire
Hi there, Because of the limitation of the site, accounts may be locked down for 10 minutes. I found 2 ways to bypass this lock period. First one with the confirmation mail that we get when we sign on. If we get the token this way below, we can change account password and bypass the lock period a...
Matrimony 2.7 Cross Site Request Forgery
======================================================== Matrimony 2.7 Admin account takeover Cross site request forgery Description : change password functionality in the admin panel does not check for current password and no CSRF token in place which allow an Attackers to be able to completely...
Default credentials
ZTE ADSL ZXV10 W300 modems W300V2.1.0fER7PEO57 and W300V2.1.0hER7PEO57 allow remote authenticated non-administrator users to change the admin password by intercepting an outgoing password change request, and changing the username parameter from "support" to "admin"...
CVE-2015-7257
ZTE ADSL ZXV10 W300 modems W300V2.1.0fER7PEO57 and W300V2.1.0hER7PEO57 allow remote authenticated non-administrator users to change the admin password by intercepting an outgoing password change request, and changing the username parameter from "support" to "admin"...
CVE-2015-7257
The CVE-2015-7257 entry concerns ZTE ADSL ZXV10 W300 modems (versions W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57). A remote authenticated non-administrator user can change the administrator password by intercepting an outgoing password-change request and tampering the username parameter fr...
CVE-2015-7257
ZTE ADSL ZXV10 W300 modems W300V2.1.0fER7PEO57 and W300V2.1.0hER7PEO57 allow remote authenticated non-administrator users to change the admin password by intercepting an outgoing password change request, and changing the username parameter from "support" to "admin"...
Legal Robot: Change password session fixed
vulnerability: While changing the password it should show that the password was changed successfully and then it should log out instead it remains on the same webpage.It does not even show that the old password entered is correct or not.when we enter the new password in both the fields incorrect...
AirMaster 3000M - Multiple Vulnerabilities
?php Exploit Title: AirMaster 3000M multiple Vulnerabilities Date: 2017/08/12 Exploit Author: Koorosh Ghorbani Author Homepage: http://8thbit.net/ Vendor Homepage: http://mobinnet.ir/ Software Version: V2.0.1B1044 Web Server: GoAhead-Webs/2.5.0 define'isDebug',false; define'specialCookie','Cookie...
SLiMS Cross-Site Request Forgery Vulnerability
SLiMS 8 Akasia is an open source, free library management system. A security vulnerability exists in SLiMS 8 Akasia 8.3.1 and earlier versions. A remote attacker can leverage the 'passwd1' and 'passwd2' in the admin/modules/system/appuser.php changecurrent=true operation to trick users into...
Design/Logic Flaw
Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an addOrModifyUser operation to servlets/DCOperationsServlet...
CVE-2015-2560
Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an addOrModifyUser operation to servlets/DCOperationsServlet...
CVE-2015-2560
Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an addOrModifyUser operation to servlets/DCOperationsServlet...
CVE-2015-2560
CVE-2015-2560 affects ManageEngine Desktop Central 9 before build 90135. The flaw in DCOperationsServlet (addOrModifyUser) allows remote unauthenticated users to change Administrator (DCAdmin) passwords, enabling full or partial admin access. Remediation: update to build 90135 or apply vendor gui...
Legal Robot: Change password logic inversion
A security researcher discovered that during the password change process, the new password was validated before verifying the old password's accuracy, despite the user entering the values and submitting on a single form. If a user was logged in on a shared machine, this could have led to a...
Friends in War Make or Break Cross-Site Request Forgery Vulnerability
Friends in War Make or Break is a foreign web application. Friends in War Make or Break cross-site request forgery vulnerability. The vulnerability can be exploited to change the administrator password...
Chyrp Lite Cross-Site Request Vulnerability
Chyrp Lite is an open source PHP and MySQL based lightweight blog Blog engine . A cross-site request vulnerability exists in the user settings function in Chyrp Lite version 2016.04. A remote attacker could exploit the vulnerability to change account information including passwords...
