Design/Logic Flaw

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. A format error in /etc/shadow, coupled with a logic bug in the LuCI - OpenWrt Configuration Interface framework, allows the undocumented system account mofidev to login to the cgi-bin/luci/quick/wizard management interfac...

Terramaster TOS Authorization Issues Vulnerability

Terramaster TOS is a Linux-based operating system dedicated to the erraMaster Cloud Storage NAS server from Shenzhen Tumi Electronic Technology Terramaster in China. An authorization issue vulnerability exists in TerraMaster TOS version 4.2.06 and prior versions, which originates from email...

DEBIAN-CVE-2020-26965

Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password. If, when using a software keyboard that remembers user input, a user typed their password and used that feature, the type of the password field wa...

CVE-2020-7483

VERSION NOT SUPPORTED WHEN ASSIGNED A vulnerability could cause certain data to be visible on the network when the 'password' feature is enabled. This vulnerability was discovered in and remediated in versions v4.9.1 and v4.10.1 on May 30, 2013. The 'password' feature is an additional optional...

Design/Logic Flaw

VERSION NOT SUPPORTED WHEN ASSIGNED A vulnerability with the former 'password' feature could allow a denial of service attack if the user is not following documented guidelines pertaining to dedicated TriStation connection and key-switch protection. This vulnerability was discovered and remediate...

Design/Logic Flaw

VERSION NOT SUPPORTED WHEN ASSIGNED A vulnerability could cause certain data to be visible on the network when the 'password' feature is enabled. This vulnerability was discovered in and remediated in versions v4.9.1 and v4.10.1 on May 30, 2013. The 'password' feature is an additional optional...

CVE-2020-7484

CVE-2020-7484 concerns Schneider Electric TriStation 1131 (and related Triconex components) where the legacy password feature could cause uncontrolled resource consumption, yielding a denial-of-service condition when users do not follow documented connection and key-switch protections. The vulner...

CVE-2020-7483

CVE-2020-7483 affects legacy Schneider Electric TriStation 1131 software (TriStation 1131 v1.0.0–4.9.0, v4.10.0 and 4.12.0) where the optional password feature can cause certain data to be transmitted in cleartext over the network. Schneider Electric remediated this by releasing TriStation v4.9.1...

CVE-2020-7483

VERSION NOT SUPPORTED WHEN ASSIGNED A vulnerability could cause certain data to be visible on the network when the 'password' feature is enabled. This vulnerability was discovered in and remediated in versions v4.9.1 and v4.10.1 on May 30, 2013. The 'password' feature is an additional optional...

Design/Logic Flaw

An Insecure Direct Object Reference IDOR vulnerability in the Change Password feature of Subex ROC Partner Settlement 10.5 allows remote authenticated users to achieve account takeover via manipulation of POST parameters. NOTE: This vulnerability may only affect a testing version of the applicati...

CVE-2019-9059

An issue was discovered in CMS Made Simple 2.2.8. It is possible, with an administrator account, to achieve command injection by modifying the path of the e-mail executable in Mail Settings, setting "sendmail" in the "Mailer" option, and launching the "Forgot your password" feature...

Sql injection

CubeCart before 6.1.13 has SQL Injection via the validate parameter of the "I forgot my Password!" feature...

ProMinent MultiFLEX M10a Controller Password Disclosure Vulnerability

The MultiFLEX M10a Controller is a water treatment controller. A password disclosure vulnerability exists in the ProMinent MultiFLEX M10a Controller, where an authenticated user using the "Change Password" feature in the application specifies the user's current password in cleartext, allowing an...

b2evolution Arbitrary User Password Reset Vulnerability

b2evolution is a PHP and MySQL based blogging software developed by software developer Francois Planque. A security vulnerability exists in the 'lost password' feature in b2evolution versions prior to 6.7.9. The vulnerability can be exploited by a remote attacker to reset the password of any user...

CA UniCenter Management Portal Username Enumeration Vulnerability

CA UniCenter Management Portal Username Enumeration Vulnerability Package: CA UniCenter Management Portal Vendor Web Site: http://www.ca.com Versions: UniCenter Management Portal 2.0 and 3.1 Platform: Windows Local: No Remote: Yes Fix Available: Yes Advisory Author: Thomas Adams...

Geeklog 1.3.8 - Forgot Password SQL Injection

Geeklog 1.3.8 - Forgot Password SQL Injection source: https://www.securityfocus.com/bid/8849/info An SQL injection vulnerability has been reported in the Geeklog "forgot password" feature introduced in Geeklog 1.3.8. Due to insufficient sanitization of user-supplied input, it is possible for remo...

Power On Software On Guard for MacOS 3.2 - Emergency Password

source: https://www.securityfocus.com/bid/553/info On Guard, a security program for MacOS, includes an emergency password feature in the event that the administrative password is lost or forgotten. If the user name 'emergency' is entered, On Guard will generate an Emergency Code. The user must th...