Question2Answer User Account Creation Vulnerability

Question2Answer is a PHP implementation of the class StackOverflow website question and answer system . A security vulnerability exists in the qa-include/qa-install.php file in Question2Answer versions prior to 1.7.5. A remote attacker can exploit this vulnerability to create multiple user accoun...

Code injection

qa-include/qa-install.php in Question2Answer before 1.7.5 allows remote attackers to create multiple user accounts...

CVE-2017-12775

qa-include/qa-install.php in Question2Answer before 1.7.5 allows remote attackers to create multiple user accounts...

CVE-2017-12775

qa-include/qa-install.php in Question2Answer before 1.7.5 allows remote attackers to create multiple user accounts...

CVE-2017-12775

qa-include/qa-install.php in Question2Answer before 1.7.5 allows remote attackers to create multiple user accounts...

CVE-2017-12775

CVE-2017-12775 affects Question2Answer (qa-install.php) prior to version 1.7.5. The vulnerability allows remote attackers to create multiple user accounts, due to an issue in the installation script. Exploitation details are not explicitly provided beyond the description in the connected sources;...

PostgreSQL Database Core Server non-libpq Client Policy Bypass (CVE-2017-7546)

A security policy bypass vulnerability exists in the core server component of the PostgreSQL database server. The vulnerability is due to improper authentication of user accounts with empty passwords for clients that do not use libpq. A remote attacker could send maliciously crafted requests to a...

CVE-2015-7259

ZTE ADSL ZXV10 W300 modems W300V2.1.0fER7PEO57 and W300V2.1.0hER7PEO57 allow user accounts to have multiple valid username and password pairs, which allows remote authenticated users to login to a target account via any of its username and password pairs...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack the authentication of authenticated users for requests that 1 add or 2 delete user accounts via a request to phpsftpd/users.php...

CVE-2017-12970

Cross-site request forgery CSRF vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack the authentication of authenticated users for requests that 1 add or 2 delete user accounts via a request to phpsftpd/users.php...

Cisco Policy Suite Software Elevation of Privilege Vulnerability

Cisco Policy Suite CPS Software is a suite of next-generation policy management software from Cisco. The software provides user-based business rules, real-time management of applications and network resources, etc. shell user accounts is one of the account management components. An elevation of...

Cisco Policy Suite Privilege Escalation Vulnerability

A vulnerability in the management of shell user accounts for Cisco Policy Suite CPS Software for CPS appliances could allow an authenticated, local attacker to gain elevated privileges on an affected system. The affected privilege level is not at the root level. The vulnerability is due to...

Code injection

DISPUTED An issue was discovered in SMA Solar Technology products. By sending crafted packets to an inverter and observing the response, active and inactive user accounts can be determined. This aids in further attacks such as a brute force attack as one now knows exactly which users exist and...

CVE-2017-9852

An Incorrect Password Management issue was discovered in SMA Solar Technology products. Default passwords exist that are rarely changed. User passwords will almost always be default. Installer passwords are expected to be default or similar across installations installed by the same company but a...

CVE-2017-9858

An issue was discovered in SMA Solar Technology products. By sending crafted packets to an inverter and observing the response, active and inactive user accounts can be determined. This aids in further attacks such as a brute force attack as one now knows exactly which users exist and which do no...

Hardcoded credentials

DISPUTED An Incorrect Password Management issue was discovered in SMA Solar Technology products. Default passwords exist that are rarely changed. User passwords will almost always be default. Installer passwords are expected to be default or similar across installations installed by the same...

CVE-2017-9858

CVE-2017-9858 affects SMA Solar Technology inverters (Sunny Boy TLST-21, TL-21; Sunny Tripower TL-10, TL-30). By sending crafted packets to the inverter and observing responses, an attacker can determine which user accounts are active or inactive, enabling brute-force planning. The vendor notes t...

CVE-2017-9852

An Incorrect Password Management issue was discovered in SMA Solar Technology products. Default passwords exist that are rarely changed. User passwords will almost always be default. Installer passwords are expected to be default or similar across installations installed by the same company but a...

CVE-2017-9852

CVE-2017-9852 affects SMA Solar Technology products (notably Sunny Boy TLST-21/TL-21 and Sunny Tripower TL-10/TL-30). It describes an Incorrect Password Management issue: default passwords are rarely changed; user passwords are often default; installer passwords are often default or similar acros...

CVE-2017-9858

An issue was discovered in SMA Solar Technology products. By sending crafted packets to an inverter and observing the response, active and inactive user accounts can be determined. This aids in further attacks such as a brute force attack as one now knows exactly which users exist and which do no...