198 matches found
GHSA-99PC-69Q9-JXF2 Elasticsearch allows insertion of sensitive information into log files when using deprecated URIs
Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied when requests to Elasticsearch use certain deprecated URIs for APIs. The impact of this flaw is that sensitive information such as passwords...
PT-2023-26654
Name of the Vulnerable Software and Affected Versions msaad1999's PHP-Login-System version 2.0.1 Description A reflected cross-site scripting XSS issue allows remote attackers to execute arbitrary JavaScript in the web browser of a user. This is achieved by including a malicious payload into the...
PT-2023-28048 · Ruijie · Ruijie Rg-Ew1200G
Name of the Vulnerable Software and Affected Versions: Ruijie RG-EW1200G version 1.01B1P5 Description: A critical issue has been found in the Administrator Password Handler component, specifically affecting an unknown functionality of the file "/api/sys/set passwd". This leads to improper access...
CVE-2023-34927
Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery CSRF in the endpoint /api/set-password. This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL...
CVE-2021-36436
An issue in Mobicint Backend for Credit Unions v3 allows attackers to retrieve partial email addresses and user entered information via submission to the forgotten-password endpoint...
CVE-2021-36436
An issue in Mobicint Backend for Credit Unions v3 allows attackers to retrieve partial email addresses and user entered information via submission to the forgotten-password endpoint...
Session fixation
An issue in Mobicint Backend for Credit Unions v3 allows attackers to retrieve partial email addresses and user entered information via submission to the forgotten-password endpoint...
CVE-2021-36436
An issue in Mobicint Backend for Credit Unions v3 allows attackers to retrieve partial email addresses and user entered information via submission to the forgotten-password endpoint...
PT-2023-12274 · Unknown · Mobicint Backend For Credit Unions
Name of the Vulnerable Software and Affected Versions: Mobicint Backend for Credit Unions version 3 Description: An issue in the software allows attackers to retrieve partial email addresses and user-entered information via submission to the "forgotten-password endpoint". Recommendations: For...
PT-2023-16444 · Xxl-Job · Xxl-Job
Name of the Vulnerable Software and Affected Versions: XXL-JOB version 2.3.1 Description: A vulnerability has been found in the New Password Handler component, specifically affecting some unknown functionality of the file /user/updatePwd. This issue leads to cross-site request forgery and can be...
CVE-2022-47116
Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the SYSPS parameter at /goform/SysToolChangePwd...
RuoYi 安全漏洞
RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi v4.7.2, which originates from the fact that in the RuoYi v4.7.2 interface, the user test1 does not have the privilege to reset the password of the user test3, but can request...
CVE-2021-44627
A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloudconfig/routerpost/getresetpwdveirfycode feature, which allows malicious users to execute arbitrary code on the system via a crafted post request...
PT-2022-16293 · Saviynt · Saviynt Enterprise Identity Cloud
Name of the Vulnerable Software and Affected Versions: Saviynt Enterprise Identity Cloud EIC version 5.5 SP2.x Description: An issue was discovered that allows an authentication bypass. Specifically, the endpoint /ECM/maintenance/forgotpasswordstep1 is vulnerable, enabling an unauthenticated user...
CVE-2021-44848
In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username exists...
PT-2018-2678 · Centos · Centos Web Panel
Name of the Vulnerable Software and Affected Versions: CentOS Web Panel versions through 0.9.8.740 Description: The issue is related to insufficient authentication of executed requests in the CentOS Web Panel application, specifically affecting the "admin/index.php?module=rootpwd" endpoint. This...
studenten-wohnung.de XSS vulnerability
Vulnerable URL: http://www.studenten-wohnung.de/lostpassword.php Details: Description| Value ---|--- Patched:| No Latest check for patch:| 09.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 684328 VIP website status:| No Coordinated Disclosure Timeline:...