20395 matches found
ASB-A-327645387
In onCreate of ChooserActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
ASB-A-327748846
In shouldSkipForInitialSUW of AdvancedPowerUsageDetail.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...
CVE-2024-8449
Certain switch models from PLANET Technology have a Hard-coded Credential in the password recovering functionality, allowing an unauthenticated attacker to connect to the device via the serial console and use this credential to reset any user's password...
PT-2024-39019 · Planet Technology · Planet Technology Switch
Name of the Vulnerable Software and Affected Versions: PLANET Technology switches affected versions not specified Description: The issue concerns a hard-coded credential in the password recovering functionality of certain switch models from PLANET Technology. This allows an unauthenticated attack...
CVE-2024-8449: Use of Hard-coded Credentials
Certain switch models from PLANET Technology have a Hard-coded Credential in the password recovering functionality, allowing an unauthenticated attacker to connect to the device via the serial console and use this credential to reset any user's password...
PLANET switch devices 信任管理问题漏洞
PLANET switch devices are a family of switch devices from PLANET Corporation in China. A trust management issue vulnerability exists in PLANET switch devices that stems from hard-coded credentials in the password recovery feature, allowing an unauthenticated attacker to connect to the device via...
U.S. Dept Of Defense: Lack of rate limiting in https://███/PKI/PassReset.aspx leads to PII disclosure and potential account takeover
The password reset functionality of AFPC Secure allowed users to provide their Social Security Account Number SSAN and Mother's Maiden Name to reset their password. The issue was that the system informed the user if the SSAN was associated with an active PKI credential, leading to potential...
CVE-2024-45982
A host header injection vulnerability in scheduleR v0.0.18 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This allows attackers to arbitrarily reset other users' passwords and compromise their accounts...
CVE-2024-45981
A host header injection vulnerability in BookReviewLibrary 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link...
CVE-2024-45979
A host header injection vulnerability in Lines Police CAD 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This allows attackers to arbitrarily reset other users' passwords and compromise their accounts...
CVE-2024-45980
A host header injection vulnerability in MEANStore 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This allows attackers to arbitrarily reset other users' passwords and compromise their accounts...
scheduleR 安全漏洞
scheduleR is a framework available to bart6114 individual developers for deploying R tasks, reports and applications. A security vulnerability exists in scheduleR version 0.0.18, which stems from the presence of a host header injection vulnerability that allows an attacker to obtain a password...
CVE-2024-45980
A host header injection vulnerability in MEANStore 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This allows attackers to arbitrarily reset other users' passwords and compromise their accounts...
CVE-2024-45982
A host header injection vulnerability in scheduleR v0.0.18 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This allows attackers to arbitrarily reset other users' passwords and compromise their accounts...
CVE-2024-45979
Lines Police CAD version 1.0 is impacted by a host header injection vulnerability. This flaw allows an attacker to obtain a password reset token by tricking a user into interacting with a crafted password reset link . Once obtained, the attacker can arbitrarily reset other users' passwords and co...
CVE-2024-45979
A host header injection vulnerability in Lines Police CAD 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This allows attackers to arbitrarily reset other users' passwords and compromise their accounts...
CVE-2024-45981
A host header injection vulnerability in BookReviewLibrary 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link...
CVE-2024-45982
The scheduleR framework (version 0.0.18 ) is susceptible to a host header injection vulnerability. This flaw allows an attacker to obtain a password reset token by tricking a user into interacting with a crafted password reset link. Successful exploitation enables an attacker to arbitrarily reset...
CVE-2024-45982
A host header injection vulnerability in scheduleR v0.0.18 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This allows attackers to arbitrarily reset other users' passwords and compromise their accounts...