203 matches found
CVE-2023-47350
Cross-Site Request Forgery CSRF vulnerability in SwiftyEdit Content Management System prior to v1.2.0, allows remote attackers to escalate privileges via the user password update functionality...
CVE-2023-47350
Cross-Site Request Forgery CSRF vulnerability in SwiftyEdit Content Management System prior to v1.2.0, allows remote attackers to escalate privileges via the user password update functionality...
PT-2023-30424 · Unknown · Swiftyedit Content Management System
Name of the Vulnerable Software and Affected Versions: SwiftyEdit Content Management System versions prior to 1.2.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability, which allows remote attackers to escalate privileges via the user password update functionality...
CVE-2023-47350
Cross-Site Request Forgery CSRF vulnerability in SwiftyEdit Content Management System prior to v1.2.0, allows remote attackers to escalate privileges via the user password update functionality...
CVE-2023-41335
CVE-2023-41335 affects the Synapse Matrix homeserver. When users update passwords, the new credentials may be briefly held in the server’s database, potentially ending up in backups longer than expected. The issue does not grant new capabilities but violates expectations around password storage. ...
Authorization Bypass
github.com/gravitl/netmaker is vulnerable to authorization bypass. The vulnerability exists due to an Insecure Direct Object Reference, which allows an attacker to update a password of another user...
GHSA-256M-J5QW-38F4 Netmaker IDOR Allows User to Update Other User's Password
Impact An IDOR vulnerability was found in the user update function. By specifying another user's username it is possible to update the other user's password. Patches Issue is patched in 0.17.1, and fixed in 0.18.6+. If Users are using 0.17.1, they should run "docker pull gravitl/netmaker:v0.17.1"...
PT-2023-25793 · Yzncms · Yzncms
Name of the Vulnerable Software and Affected Versions: YznCMS version 1.1.0 Description: A Cross-Site Request Forgery CSRF issue in the /public/admin/profile/update.html component allows attackers to change the Administrator password using a crafted POST request. Recommendations: For YznCMS versi...
SUSE CVE-2023-32682
Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for login via the...
DEBIAN-CVE-2023-32682
Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for login via the...
PYSEC-2023-84
Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for login via the...
UBUNTU-CVE-2023-32682
Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for login via the...
PT-2023-20626 · Unknown · Sourcecodester File Tracker Manager System
Name of the Vulnerable Software and Affected Versions: SourceCodester File Tracker Manager System version 1.0 Description: A critical issue was found in the SourceCodester File Tracker Manager System. This issue affects the file register/update password.php of the component POST Parameter Handler...
PT-2023-19931 · Apple +2 · Apple Macos +3
Name of the Vulnerable Software and Affected Versions: PowerPanel Business Local/Remote for Windows versions 4.8.6 and earlier PowerPanel Business Management for Windows versions 4.8.6 and earlier PowerPanel Business Local/Remote for Linux 32bit versions 4.8.6 and earlier PowerPanel Business...
CVE-2022-3930 Directorist < 7.4.2.2 - Subscriber+ Arbitrary User Password Update via IDOR
The Directorist WordPress plugin before 7.4.2.2 suffers from an IDOR vulnerability which an attacker can exploit to change the password of arbitrary users instead of his own...
WordPress Directorist plugin <= 7.4.2.1 - Auth. Insecure Direct Object References (IDOR) vulnerability
Auth. Insecure Direct Object References IDOR vulnerability leading to arbitrary user password update discovered by cydave in the WordPress Directorist plugin versions = 7.4.2.1. Solution Update the WordPress Directorist plugin to the latest available version at least 7.4.2.2...
PT-2022-23845 · Ruoyi · Ruoyi
Name of the Vulnerable Software and Affected Versions: RuoYi version 3.8.3 Description: The issue is related to a weak password in the management system. Recommendations: For RuoYi version 3.8.3, update the password to a stronger one to mitigate the risk...
GHSA-8Q2M-PWXF-JC7G python-keystoneclient unsecure user password update
The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows local users to obtain sensitive information by listing the process...
gitea -- password hash quality
The Gitea team reports: This PR refactors and improves the password hashing code within gitea and makes it possible for server administrators to set the password hashing parameters. In addition it takes the opportunity to adjust the settings for pbkdf2 in order to make the hashing a little...
Session Fixation in pheditor/pheditor
Description Session Fixation vulnerability found in pheditor in which it doesn't expire the sessions after password update. Proof of Concept // PoC 1. Open normal tab and one private tab 2. Open the pheditor on both of them and log in as a user 3. From private tab change the user password and log...