Khan Academy: No Security check at changing password and at adding mobile number which leads to account takeover and spam

Description I have noticed that there is no security check at changing password. If someone gets a logged in account for 5 seconds, they are extremely likely to change the password of the account with the knowledge of the victim. also, while adding a mobile number / changing a mobile number, ther...

CVE-2017-5167

An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. Users do not have any option to change their own passwords...

CVE-2016-9005

IBM System Storage TS3100-TS3200 Tape Library could allow an unauthenticated user with access to the company network, to change a user's password and gain remote access to the system...

CVE-2016-9005

IBM System Storage TS3100-TS3200 Tape Library could allow an unauthenticated user with access to the company network, to change a user's password and gain remote access to the system...

rhev-m-4: Fails to validate existing expired passwords when changing a password

When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools fail to correctly check for the current password if it is expired. This would allow access to an attacker with access to change the password on accounts with expired passwords, gaining access to those accounts...

EMC Documentum eRoom Management Password Change Authentication Bypass Vulnerability

EMC Documentum eRoom is a Web-based shared work platform from EMC that allows project staff to use the Web to store project content, communicate and share ideas, assign tasks, and manage deliverables. A security vulnerability exists in EMC Documentum eRoom. An attacker could exploit this...

CVE-2017-2766

EMC Documentum eRoom version 7.4.4, EMC Documentum eRoom version 7.4.4 SP1, EMC Documentum eRoom version prior to 7.4.5 P04, EMC Documentum eRoom version prior to 7.5.0 P01 includes an unverified password change vulnerability that could potentially be exploited by malicious users to compromise th...

CVE-2017-2766

EMC Documentum eRoom version 7.4.4, EMC Documentum eRoom version 7.4.4 SP1, EMC Documentum eRoom version prior to 7.4.5 P04, EMC Documentum eRoom version prior to 7.5.0 P01 includes an unverified password change vulnerability that could potentially be exploited by malicious users to compromise th...

CVE-2017-2766

CVE-2017-2766 affects EMC Documentum eRoom: vulnerable in versions 7.4.4, 7.4.4 SP1, and prior to 7.4.5 P04 or 7.5.0 P01 due to an unverified password change vulnerability. This could allow a malicious user to compromise the affected system. According to the sources, the issue manifests in the pa...

Credential disclosure in LXCA log files - Lenovo Support US

No description provided...

Polycom VVX Web Interface Forced Admin Password Change Vulnerability

Polycom is a global leader in standards-based unified communications UC solutions for telepresence, video and voice. The Polycom VVX web interface can be forced to change the admin password vulnerability, which requires a user to access the "user" account in the web interface of a Polycom VoIP...

CVE-2017-3795

A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to conduct arbitrary password changes against any non-administrative user. More Information: CSCuz03345. Known Affected Releases: 2.6. Known Fixed Releases: 2.7.1.12...

ntopng Web Interface 2.4.160627 Cross Site Request Forgery Vulnerability

ntopng Web Interface version 2.4.160627 suffers from a cross site request forgery token bypass vulnerability. + + Credits / Discovery: John Page AKA Hyp3rlinX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/NTOPNG-CSRF-TOKEN-BYPASS.txt + ISR: ApparitionSEC...

CVE-2016-7038

In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed...

Default credentials

In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed...

UBUNTU-CVE-2016-7038

In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed...

CVE-2016-7038

CVE-2016-7038 affects Moodle 2.x/3.x where web service tokens are not invalidated when a user password is changed or forced to be changed. The connected documents confirm the vulnerability appears in Moodle web service token handling; no explicit remediation details are provided in the sources. E...

Cisco Webex Meetings Server Arbitrary Password Change Vulnerability

A vulnerability in Cisco Webex Meetings Server could allow an authenticated, remote attacker to conduct arbitrary password changes against any non-administrative user. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright ...

IBM TS3100 and TS3200 Tape Library Privilege Access Vulnerability

IBM TS3100 and TS3200 Tape Library are tape libraries developed by IBM in the United States for small and medium-sized environments to address backup, recovery and archival data storage. A security vulnerability exists in IBM TS3100 and TS3200 Tape Library versions D.60 and earlier. An attacker...

MC Inventory Manager Script - Multiple Vulnerabilities

Exploit for php platform in category web applications Vulnerability: Admin Login Bypass & SQLi Date: 15.01.2017 Vendor Homepage: http://microcode.ws/ Script Name: MC Inventory Manager Script Buy Now: http://microcode.ws/product/mc-inventory-manager-php-script/3885 Author: İhsan Şencan Author Web:...