CVE-2017-12584

There is no CSRF mitigation in SLiMS 8 Akasia through 8.3.1. Also, an entire user profile including the password can be updated without sending the current password. This allows remote attackers to trick a user into changing to an attacker-controlled password, a complete account takeover, via the...

Insecure Password Updates

openmeetings-db does not securely update passwords. When updating a password for a user, it does not check that the Crypt is up to date, resulting in the password not being saved securely...

CVE-2017-7688

Apache OpenMeetings 1.0.0 updates user password in insecure manner...

Default credentials

Apache OpenMeetings 1.0.0 updates user password in insecure manner...

CVE-2017-7688: Undefined Security Weakness

Apache OpenMeetings 1.0.0 updates user password in insecure manner...

CVE-2017-7688

Apache OpenMeetings 1.0.0 updates user password in insecure manner...

PT-2017-17887

Name of the Vulnerable Software and Affected Versions Apache OpenMeetings versions prior to 3.3.0 Description The issue concerns an insecure manner of updating user passwords. This problem is fixed in version 3.3.0. Recommendations For versions prior to 3.3.0, update to version 3.3.0 to resolve t...

RHEL 7 : ovirt-engine-extension-aaa-jdbc (RHSA-2017:0257)

An update for ovirt-engine-extension-aaa-jdbc is now available for RHEV Engine version 4.0. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

DEXIS Imaging Suite 10 contains hard-coded credentials

Overview DEXIS is a dental x-ray imaging software that manages patient records. DEXIS Imaging Suite 10 contains several hard-coded credentials allowing administrative or root access to the patient database. Description CWE-798: Use of Hard-coded Credentials - CVE-2016-6532 DEXIS Imaging Suite 10...

Q-shell - Quick Shell for Unix Administrator

q-shell is quick shell for remote login into Unix system, it use blowfish crypt algorithm to protect transport data from client to server, you can get two program: 'qsh' for client, and 'qshd' for server, those program can rename by any name with you prefer. Compile Just enter 'make' and it will...

WordPress Calculated Fields Form 1.0.10 SQL Injection

Calculated Fields Form Wordpress Plugin = 1.0.10 - Remote SQL Injection Vulnerability + Author: Ibrahim Raafat + Twitter: https://twitter.com/RaafatSEC + Plugin: https://wordpress.org/plugins/calculated-fields-form/ + TimeLine - Feb 6 2015, The vulnerabilities reported - Feb 7 2015, Response and...

Linksys WET11 Password Update Remote Authentication Bypass Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13051/info A remote authentication bypass vulnerability affects Linksys WET11. This issue is due to a failure of the application to validate authentication credentials when processing password change requests. An attacker...

PHPMyWind任意用户密码重置

简要描述： PHPMyWind任意用户密码重置 详细说明： phpmywind 4.6.6 在忘记密码，重置密码时，虽然后安全问题限制，但是在最后修改密码，update时，存在设计缺陷 导致可轻松重置任意用户密码。 文件member.php 在重置密码前有验证问题： //找回密码 else if$a == 'quesfind' if!isset$POST'uname' header'location:?c=findpwd'; exit; //验证输入数据 if$question == '-1' or $answer == '' header'location:?c=findpwd';...

CVE-2013-2013

The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows local users to obtain sensitive information by listing the process...

PYSEC-2013-24

The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows local users to obtain sensitive information by listing the process...

CVE-2013-2013

The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows local users to obtain sensitive information by listing the process...

CVE-2013-2013

The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows local users to obtain sensitive information by listing the process...

CVE-2013-2013

The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows local users to obtain sensitive information by listing the process...

CVE-2013-2013: Exposure of Sensitive Information to an Unauthorized Actor

The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows local users to obtain sensitive information by listing the process...

PT-2013-3503

Name of the Vulnerable Software and Affected Versions python-keystoneclient versions prior to 0.2.4 Description The issue allows local users to obtain sensitive information by listing the process, due to the user-password-update command in python-keystoneclient accepting the new password in the...