CVE-2021-43737: Cross-Site Request Forgery (CSRF)

An issus was discovered in xiaohuanxiong CMS 5.0.17. There is a CSRF vulnerability that can modify administrator account's password...

Mageia: Security Advisory (MGASA-2018-0201)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2022-15677

Name of the Vulnerable Software and Affected Versions Charactell - FormStorm Enterprise affected versions not specified Description The issue allows an attacker to modify the passwords file for all users, enabling account takeover. The xx users.ini file in the FormStorm folder stores usernames in...

Reprise License Manager 14.2 Unauthenticated Password Change

Product: Reprise License Manager 14.2 Vendor: Reprise Software CVE ID: CVE-2021-44152 Vulnerability Title: Unauthenticated Password Change Severity: High Authors: Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard Date: 2021-11-25...

Exploit for Code Injection in Gitlab

CVE-2021-22205 GitLab CE/EE Preauth RCE using ExifTool This...

CVE-2021-20264

An insecure modification flaw in the /etc/passwd file was found in the openjdk-1.8 and openjdk-11 containers. This flaw allows an attacker with access to the container to modify the /etc/passwd and escalate their privileges. The highest threat from this vulnerability is to confidentiality,...

CVE-2021-22773

A CWE-620: Unverified Password Change vulnerability exists in EVlink City EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1, EVlink Parking EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1, and EVlink Smart Wallbox EVB1A all versions prior to R8 V3.4.0.1 that could allow an attacker...

CVE-2021-22773

A CWE-620: Unverified Password Change vulnerability exists in EVlink City EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1, EVlink Parking EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1, and EVlink Smart Wallbox EVB1A all versions prior to R8 V3.4.0.1 that could allow an attacker...

CVE-2021-22773: Unverified Password Change

A CWE-620: Unverified Password Change vulnerability exists in EVlink City EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1, EVlink Parking EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1, and EVlink Smart Wallbox EVB1A all versions prior to R8 V3.4.0.1 that could allow an attacker...

Authorization

There is an arbitrary password modification vulnerability in a D-LINK DSL-2888A router product. An attacker can use this vulnerability to modify the password of the admin user without authorization...

CVE-2021-33346

There is an arbitrary password modification vulnerability in a D-LINK DSL-2888A router product. An attacker can use this vulnerability to modify the password of the admin user without authorization...

CVE-2021-33346

The CVE-2021-33346 entry concerns the D-LINK DSL-2888A router. The vulnerability allows an attacker to modify the admin password without authorization, enabling unauthorized admin access. Documents consistently identify the affected product as the D-LINK DSL-2888A and describe the issue as an arb...

PT-2021-20121

Name of the Vulnerable Software and Affected Versions D-LINK DSL-2888A router affected versions not specified Description The issue concerns an arbitrary password modification vulnerability. An attacker can exploit this to modify the admin user's password without authorization. Recommendations At...

CVE-2021-33346: Missing Authentication for Critical Function

There is an arbitrary password modification vulnerability in a D-LINK DSL-2888A router product. An attacker can use this vulnerability to modify the password of the admin user without authorization...

CVE-2020-20466

White Shark System WSS 1.3.2 is vulnerable to unauthorized access via usereditpassword.php, remote attackers can modify the password of any user...

CVE-2020-20466

White Shark System WSS 1.3.2 is vulnerable to unauthorized access via usereditpassword.php, remote attackers can modify the password of any user...

Cross site request forgery (csrf)

White Shark System WSS 1.3.2 is vulnerable to CSRF. Attackers can use the usereditpassword.php file to modify the user password...

PT-2021-10492

Name of the Vulnerable Software and Affected Versions: White Shark System WSS version 1.3.2 Description: The issue allows remote attackers to gain unauthorized access via the user edit password.php file, enabling them to modify the password of any user. Recommendations: For White Shark System WSS...

PT-2021-10494

Name of the Vulnerable Software and Affected Versions: White Shark System WSS version 1.3.2 Description: The issue allows attackers to perform Cross-Site Request Forgery CSRF attacks. Specifically, attackers can exploit the user edit password.php file to modify user passwords. Recommendations: Fo...

CVE-2020-20466: Incorrect Authorization

White Shark System WSS 1.3.2 is vulnerable to unauthorized access via usereditpassword.php, remote attackers can modify the password of any user...