CVE-2019-9884 eClass platform contains a Broken Access Control vulnerability

eClass platform ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page...

CVE-2019-9884

CVE-2019-9884 affects the eClass platform (version

CVE-2019-9884: Improper Access Control

eClass platform ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page...

PT-2019-19917

Name of the Vulnerable Software and Affected Versions eClass platform version ip.2.5.10.2.1 Description The issue allows an attacker to bypass password validation and access the management page by using the GET method to request the /admin page. Recommendations For eClass platform version...

PT-2021-7981 · Apache · Apache Kafka

Name of the Vulnerable Software and Affected Versions: Apache Kafka versions 2.0.0 through 2.8.0 Description: The issue in Apache Kafka is related to the disclosure of information through inconsistency, allowing a remote attacker to perform a brute force attack. Some components in Apache Kafka us...

HackerOne: Password not checked when disabling 2FA on HackerOne

Hi, when I was submitted a report to a program that request 2FA ON, I notice that if you try to disable this option will ask for backup code - password and if you enter a random password in the request filed and a correct backup code it will be successfully disabled the 2FA without check if the...

Privilege Escalation

craftcms/cms is vulnerable to privilege escalation. The vulnerability exists because it does not validate the original user's password and expects impersonated user's password...

Mac OS X libxpc MITM Privilege Escalation Exploit

This Metasploit module exploits a vulnerability in libxpc on macOS versions 10.13.3 and below. The tasksetspecialport API allows callers to overwrite their bootstrap port, which is used to communicate with launchd. This port is inherited across forks: child processes will use the same bootstrap...

Applayering 4.11- unable to add pvs connector

while adding a pvs connector, we get an error as Failed to validate the Domain User and Password. Check credentials .One or more of the PVS server configuration fields is invalid. Please check your selections...

ovirt-aaa-jdbc-tool unauthorized access vulnerability

ovirt-aaa-jdbc-tool tools is a tool for storing authentication and authorization data in a database. A security vulnerability exists in versions of ovirt-aaa-jdbc-tool tools prior to 1.1.3, which stems from the program failing to properly verify that the current password is not invalid. An attack...

Plone and Zope2 affected by Race Condition

AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation...

Liberapay: Insecure Account Deletion

Hi Team, The removal of account is one of the sensitive part of a web application that needs to protect, therefore removing an account should validate the authenticity of the user, however i have found that when removing an account, the system did not require the user to input the account passwor...

WatchGuard AP100, AP102 and AP200 Security Bypass Vulnerabilities

The WatchGuard AP100, AP102 and AP200 are all different series of indoor wireless access point devices from WatchGuard USA. A security vulnerability exists in the WatchGuard AP100, AP102, and AP200, AP300 that stems from the program failing to properly validate the 'old password' field in the...

CVE-2018-10578

An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices with firmware before 2.0.0.10. Incorrect validation of the "old password" field in the change password form allows an attacker to bypass validation of this field...

Input validation

An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices with firmware before 2.0.0.10. Incorrect validation of the "old password" field in the change password form allows an attacker to bypass validation of this field...

Timing Attack

ozh/phpass is vulnerable to timing attacks. The attacks are possible because it validates the password using == or === in the CheckPassword function rather than a constant time function. Using this flaw, attackers are able to use the time which a password request takes to return to slowly work ou...

Infogram: Bypass insecure password validation

Hi Team, Summary: Registration is checking the password creation if the password is insecure , but the password reset page was not doing the same validation, so when i input an insecure password using the password reset, the validation on the password creation can be bypass because the password...

Legal Robot: Wrong password validation message

Hello, Your password validation message seems to be contradicting with the server side validation of password field during new account sign up at https://app.legalrobot.com/sign-in. When you start typing in password field, it says Passwords must be more than 8 characters but when you type more th...

Weblate: Adding Email lacks Password validation

Affected URL: https://demo.weblate.org/accounts/email/ Issue: The account section of profile says: "You can add another email address on the Authentication tab." But there is no option of adding another email in Authentication. However, I was able to guess the above endpoint. The problem here is,...

Timing Attack

github.com/gogits/gogs is vulnerable to timing attacks. This vulnerability is caused because passwords are not validated in constant time, allowing malicious users to guess valid passwords based on the time that a validation takes...