206 matches found
Windows Security Feature Bypass Vulnerability
A security feature bypass vulnerability exists in Windows 10 when third party filters are called during a password update. Successful exploitation of the vulnerability could allow a user to make use of a blocked password for their account. To exploit the vulnerability, an attacker would need have...
Incorrect Session Invalidation
Contao has done incorrect session invalidation. It does not perform correct session invalidation for existing sessions when users update their passwords in frontend or backend...
Eaton UPS 9PX 8000 SP Cross-Site Request Forgery Vulnerability
The Eaton UPS 9PX 8000 SP is a power management device from Eaton USA. A cross-site request forgery vulnerability exists in the change-password feature in the Eaton UPS 9PX 8000 SP, which can be exploited by a remote attacker to force an administrator logged in to the device to unknowingly perfor...
Cross site scripting
An issue was discovered on Eaton UPS 9PX 8000 SP devices. The administration panel is vulnerable to a CSRF attack on the change-password functionality. This vulnerability could be used to force a logged-in administrator to perform a silent password update. The affected forms are also vulnerable t...
CVE-2018-9281
An issue was discovered on Eaton UPS 9PX 8000 SP devices. The administration panel is vulnerable to a CSRF attack on the change-password functionality. This vulnerability could be used to force a logged-in administrator to perform a silent password update. The affected forms are also vulnerable t...
CVE-2018-16345
An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent...
Cross site request forgery (csrf)
An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent...
CVE-2017-2614
When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the current password if it is expired. This would allow access to an attacker with access to change the password on accounts with expired passwords, gaining access to those account...
Default credentials
When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the current password if it is expired. This would allow access to an attacker with access to change the password on accounts with expired passwords, gaining access to those account...
CVE-2017-2614
When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the current password if it is expired. This would allow access to an attacker with access to change the password on accounts with expired passwords, gaining access to those account...
CVE-2017-2614
The CVE-2017-2614 issue affects ovirt-engine-extension-aaa-jdbc and the ovirt-aaa-jdbc-tool prior to 1.1.3. The root cause is that the tool fails to correctly verify the current password when it is expired during password updates in the rhvm database, allowing an attacker with access to change su...
Gitlab -- multiple vulnerabilities
GitLab reports: Removing public deploy keys regression Users can update their password without entering current password Persistent XSS - Selecting users as allowed merge request approvers Persistent XSS - Multiple locations of user selection drop downs include directive in .gitlab-ci.yml allows...
Design/Logic Flaw
The javax.naming.directory.AttributeInUseException class in the Virtual Member Manager in IBM WebSphere Application Server WAS 6.1 before 6.1.0.43, 7.0 before 7.0.0.21, and 8.0 before 8.0.0.2 does not properly update passwords on a configuration using Tivoli Directory Server, which might allow...
CVE-2011-4889
The javax.naming.directory.AttributeInUseException class in the Virtual Member Manager in IBM WebSphere Application Server WAS 6.1 before 6.1.0.43, 7.0 before 7.0.0.21, and 8.0 before 8.0.0.2 does not properly update passwords on a configuration using Tivoli Directory Server, which might allow...
CVE-2011-4889
CVE-2011-4889 affects IBM WebSphere Application Server via the Virtual Member Manager. The root cause is aPassword update flaw in the Tivoli Directory Server configuration caused by the javax.naming.directory.AttributeInUseException, which might allow a remote attacker to gain access using an old...
CVE-2017-12584
There is no CSRF mitigation in SLiMS 8 Akasia through 8.3.1. Also, an entire user profile including the password can be updated without sending the current password. This allows remote attackers to trick a user into changing to an attacker-controlled password, a complete account takeover, via the...
CVE-2017-12584
There is no CSRF mitigation in SLiMS 8 Akasia through 8.3.1. Also, an entire user profile including the password can be updated without sending the current password. This allows remote attackers to trick a user into changing to an attacker-controlled password, a complete account takeover, via the...
Insecure Password Updates
openmeetings-db does not securely update passwords. When updating a password for a user, it does not check that the Crypt is up to date, resulting in the password not being saved securely...