Force-Password-Change Bypass

Moodle is vulnerable to the bypass of the force-password-change requirement. Even when a password is forced to be changed on login, its possible for the temporary password to be used to create web service tokens, thus extending the life of the temporary password...

Friends In War Make Or Break 1.7 Password Change

Friends in War Make or Break 1.7 - Unauthenticated admin password change Url: http://software.friendsinwar.com/ http://software.friendsinwar.com/downloads.php?catid=2&fileid=9 Author: shinnai mail: shinnaiatautisticidotorg site: http://www.shinnai.altervista.org/...

Friends in War Make or Break 1.7 - Cross-Site Request Forgery (Change Admin Password)

Friends in War Make or Break 1.7 - Cross-Site Request Forgery Change Admin Password Friends in War Make or Break 1.7 - Unauthenticated admin password change Url: http://software.friendsinwar.com/ http://software.friendsinwar.com/downloads.php?catid=2&fileid=9 Author: shinnai mail:...

Televes COAXDATA GATEWAY 1Gbps Device Arbitrary Password Change Vulnerability

The Televes COAXDATA GATEWAY 1Gbps devices is a wireless router device from the Spanish company Televes. A security vulnerability exists in the Televes COAXDATA GATEWAY 1Gbps device that stems from a lack of access control and detection on the client side. An attacker could exploit the...

CVE-2017-9415

Cross-site request forgery CSRF vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target username to hijack the authentication of users for requests that change passwords via a crafted request to userSettings.view...

CVE-2017-6530

Televes COAXDATA GATEWAY 1Gbps devices doc-wifi-hgwv1.02.0014 4.20 do not check password.shtml authorization, leading to Arbitrary password change...

Authorization

Televes COAXDATA GATEWAY 1Gbps devices doc-wifi-hgwv1.02.0014 4.20 do not check password.shtml authorization, leading to Arbitrary password change...

CVE-2017-6530

Televes COAXDATA GATEWAY 1Gbps devices doc-wifi-hgwv1.02.0014 4.20 do not check password.shtml authorization, leading to Arbitrary password change...

CVE-2017-6530

Televes COAXDATA GATEWAY 1Gbps devices (firmware referenced as doc-wifi-hgw_v1.02.0014 4.20) are affected by CVE-2017-6530 due to missing authorization on password change functionality (password.shtml), allowing arbitrary administrator password changes. Multiple sources (NVD/CNVD) describe this v...

Legal Robot: No notification on change password feature

A security researcher discovered that Legal Robot did not send notifications on important account changes, like password changes. While there was no specific security vulnerability, we decided to add notifications for Password Change, TOTP Enable/Disable, U2F Enable/Disable, Recovery Code Use, an...

What is the Default Password for App Layering?

Question: What is the default root password for the Citrix Enterprise Layer Manager ELM via console for App Layering Unidesk? Answer: The default username and password sets for App Layering Unidesk are as follows: rootvia the ELM virtual appliance console - two possible defaults: v9Yx6uj OR...

FAQ: Password change over LDAP on Read Only Domain Controller Servers

Question : Can customer change password over LDAP when using Read only Domain controller RODC? Answer : Password change is not possible on RODC servers. Note: We support referrals only for group extraction, it might not be applicable for password resets. For information on password change in a...

EMC ESRS Policy Manager Undocumented Account Vulnerability

EMC ESRS Policy Manager is affected by an undocumented account vulnerability that could potentially be leveraged by malicious users to compromise the affected system. Versions prior to 6.8 are affected. EMC ESRS Policy Manager Undocumented Account Vulnerability CVE Identifier: CVE-2017-4976...

Ansible: in some circumstances the mysql_user module may fail to correctly change a password

An input validation vulnerability was found in Ansible's mysqluser module which may fail to correctly change a password in certain circumstances. Thus the previous password would still be active when it should have been changed...

WakaTime: Lack of Password Confirmation When Changing Email

When any user wants to change the password, current password is asked for proceeding the request. This should also be implemented on changing the email. Attack Scenerio : When some forget to logout from the account in a publc computer, anyone can change the email to its own and verify it. And aft...

Serviio PRO DLNA Media Streaming Server - REST API Arbitrary Password Change Vulnerability

Serviio PRO is a DLNA media server. An arbitrary password change vulnerability exists in the Serviio PRO DLNA Media Streaming Server - REST API. A remote attacker can exploit this to change the login password of a protected page via a specially crafted request...

CVE-2017-7629

QNAP QTS before 4.2.6 build 20170517 has a flaw in the change password function...

CVE-2017-9673

In SimpleCE 2.3.0, a CSRF vulnerability can be exploited to add an administrator account via the index.php/user/new URI or change its settings via the index.php/user/1 URI, including its password...

CVE-2017-9673

In SimpleCE 2.3.0, a CSRF vulnerability can be exploited to add an administrator account via the index.php/user/new URI or change its settings via the index.php/user/1 URI, including its password...

Cross site request forgery (csrf)

In SimpleCE 2.3.0, a CSRF vulnerability can be exploited to add an administrator account via the index.php/user/new URI or change its settings via the index.php/user/1 URI, including its password...