24 matches found
CVE-2026-18638
Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist...
EUVD-2026-56185
Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist...
CVE-2026-18638 Velociraptor server crash via the SetPassword API
Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist...
CVE-2026-18638
CVE-2026-18638 : Velociraptor server can be terminated by any authenticated user (even reader role) via SetPassword with a non-existent username, potentially crashing the entire server. Documented impact is server process termination (availability impact: High). No remediation or patch details ar...
CVE-2026-18638 Velociraptor server crash via the SetPassword API
Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist...
PT-2026-70234
Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist...
CVE-2026-33297
WWBN AVideo is an open source video platform. Prior to version 26.0, the setPassword.json.php endpoint in the CustomizeUser plugin allows administrators to set a channel password for any user. Due to a logic error in how the submitted password value is processed, any password containing non-numer...
WWBN AVideo 安全漏洞
WWBN AVideo is a video platform building system developed by the WWBN team using PHP. Versions of WWBN AVideo prior to 26.0 contained security vulnerabilities. These vulnerabilities stemmed from a logical error in the setPassword.json.php endpoint of the CustomizeUser plugin. This error could cau...
AVideo: IDOR - Any Admin Can Set Another User's Channel Password Via SetPassword.json.php
Summary The "setPassword.json.php" endpoint in the CustomizeUser plugin allows administrators to set a channel password for any user. Due to a logic error in how the submitted password value is processed, any password containing non-numeric characters is silently coerced to the integer zero befor...
CVE-2013-6852
Cross-site request forgery CSRF vulnerability in html/json.html on HP 2620 switches allows remote attackers to hijack the authentication of administrators for requests that change an administrative password via the setPassword method...
Exploit for Improper Check for Unusual or Exceptional Conditions in Polkit_Project Polkit
CVE-2021-3560 is an authenticatio...
Cross-Site Request Forgery (CSRF)
github.com/casdoor/casdoor is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists in the SetPassword function at user.go due to a lack of CSRF token, which allows an attacker to change a users password...
Exploit for Incorrect Authorization in Polkit_Project Polkit
polkit-auto-exploit Automatic Explotation PoC for Polkit CVE-2...
GHSA-WVH7-5P38-2QFC Storing Password in Local Storage
The setPassword method http://parseplatform.org/Parse-SDK-JS/api/2.9.1/Parse.User.htmlsetPassword stores the user's password in localStorage as raw text making it vulnerable to anyone with access to your localStorage. We believe this is the only time that password is stored at all. In the...
uniForum <= 4 - (wbsearch.aspx) Remote SQL Injection Vulnerability
No description provided by source. Title : uniForum = v4 wbsearch.aspx Remote SQL Injection Vulnerability Author : ajann Contact : : S.Page : ... Vendor : http://uniforum.biz/ $$ : $99 SQL--------------------------------------------------------- http://target/path//wbsearch.aspx POST Method SQL...
CVE-2010-0833
The pamlsass library in Likewise Open 5.4 and CIFS 5.4 before build 8046, and 6.0 before build 8234, as used in HP StorageWorks X9000 Network Storage Systems and possibly other products, uses "SetPassword logic" when running as part of a root service, which allows remote attackers to bypass...
CVE-2010-0833
The pamlsass library in Likewise Open 5.4 and CIFS 5.4 before build 8046, and 6.0 before build 8234, as used in HP StorageWorks X9000 Network Storage Systems and possibly other products, uses "SetPassword logic" when running as part of a root service, which allows remote attackers to bypass...
CVE-2010-0833
The pamlsass library in Likewise Open 5.4 and CIFS 5.4 before build 8046, and 6.0 before build 8234, as used in HP StorageWorks X9000 Network Storage Systems and possibly other products, uses "SetPassword logic" when running as part of a root service, which allows remote attackers to bypass...
PT-2008-5562 · Microsoft · Internet Information Services
Name of the Vulnerable Software and Affected Versions: Microsoft Internet Information Services IIS affected versions not specified Description: A certain ActiveX control in iisext.dll allows remote attackers to set a password via a string argument to the SetPassword method. However, this issue...