PT-2018-14353

Name of the Vulnerable Software and Affected Versions FineCms version 5.4 Description A cross-site request forgery CSRF issue exists, allowing remote attackers to modify the administrator's password through the "/admin.php?c=member&m=edit&uid=1" endpoint. Recommendations For FineCms version 5.4, ...

PT-2018-13553

Name of the Vulnerable Software and Affected Versions FUEL CMS version 1.4 Description A cross-site request forgery issue exists, allowing remote attackers to modify the administrator's password via the "my profile/edit?inline=" endpoint. Recommendations For FUEL CMS version 1.4, consider disabli...

Logic Design Vulnerability in LeShang Mall System v2.2.0

LeShang mall system is a based on THINKPHP5.0 as the core development of a free open source professional mall system. LeShang Mall System v2.2.0 has a logical design vulnerability. Attackers can overstep their authority to modify other users' personal information, including user passwords, by...

CVE-2018-7951

The iBMC Intelligent Baseboard Management Controller of some Huawei servers have a JSON injection vulnerability due to insufficient input validation. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Successful exploit may allow attackers to...

PT-2018-18348

Name of the Vulnerable Software and Affected Versions: Huawei iBMC affected versions not specified Description: The issue is related to a JSON injection vulnerability due to insufficient input validation in the iBMC of some Huawei servers. An authenticated, remote attacker can exploit this to...

PT-2018-18346

Name of the Vulnerable Software and Affected Versions: Huawei iBMC affected versions not specified Description: The issue is related to a privilege escalation vulnerability in the Intelligent Baseboard Management Controller iBMC of some Huawei servers. A remote attacker can send specially crafted...

CVE-2018-7951: Improper Control of Generation of Code

The iBMC Intelligent Baseboard Management Controller of some Huawei servers have a JSON injection vulnerability due to insufficient input validation. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Successful exploit may allow attackers to...

CVE-2018-7950: Improper Control of Generation of Code

The iBMC Intelligent Baseboard Management Controller of some Huawei servers have a JSON injection vulnerability due to insufficient input validation. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Successful exploit may allow attackers to...

CVE-2018-7949: Improper Authentication

The iBMC Intelligent Baseboard Management Controller of some Huawei servers have a privilege escalation vulnerability. A remote attacker may send some specially crafted login messages to the affected products. Due to improper authentication design, successful exploit enables low privileged users ...

Design/Logic Flaw

Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Due to insufficient verification of the input, this could be exploited to obtain the management...

Design/Logic Flaw

Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Due to insufficient verification of the input, this could be exploited to obtain the management...

CVE-2018-7904

Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Due to insufficient verification of the input, this could be exploited to obtain the management...

CVE-2018-7902

Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Due to insufficient verification of the input, this could be exploited to obtain the management...

CVE-2018-7903

Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Due to insufficient verification of the input, this could be exploited to obtain the management...

CVE-2018-7903

CVE-2018-7903 affects Huawei 1288H V5 and 2288H V5 with software V100R005C00. The vulnerability arises from insufficient input validation in the iBMC JSON handling, allowing an authenticated, remote attacker to perform a JSON injection to change the administrator password and potentially gain man...

CVE-2018-7902: Undefined Security Weakness

Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Due to insufficient verification of the input, this could be exploited to obtain the management...

CVE-2018-7904: Undefined Security Weakness

Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Due to insufficient verification of the input, this could be exploited to obtain the management...

PT-2018-18315

Name of the Vulnerable Software and Affected Versions: Huawei 1288H V5 and 288H V5 version V100R005C00 Description: The issue allows an authenticated, remote attacker to launch a JSON injection attack, potentially modifying the administrator's password due to insufficient input verification. This...

CVE-2018-7903: Undefined Security Weakness

Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Due to insufficient verification of the input, this could be exploited to obtain the management...

CVE-2018-8898

A flaw in the authentication mechanism in the Login Panel of router D-Link DSL-3782 A1WI20170303 || SWVer="V100R001B012" FWVer="3.10.0.24" FirmVer="TT77616E6771696F6E67" allows unauthenticated attackers to perform arbitrary modification read, write to passwords and configurations meanwhile an...