Arbitrary Password Reset Vulnerability in Website Building System of Guangdong Desheng Technology Co.

Ltd. is a leading domestic integrated service provider for people's livelihood, providing information system construction and related operation services in the fields of human resources and social security, employment, finance, healthcare and big data, etc. It actively promotes the operation...

CVE-2020-15906

tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts...

Default credentials

tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts...

CVE-2020-15906

CVE-2020-15906 affects Tiki Wiki CMS GroupWare before 21.2. The flaw in tiki-login.php allows an authentication bypass: after 50 invalid login attempts, the admin password is set to blank, permitting unauthenticated admin access. Remediation: upgrade to version 21.2 or later. CVSS 3.1 base score ...

PT-2020-14703 · Tiki · Tiki

Name of the Vulnerable Software and Affected Versions: Tiki versions prior to 21.2 Description: The issue allows an attacker to set the admin password to a blank value after a certain number of invalid login attempts. There have been reports of activities targeting this issue. Recommendations: Fo...

SUSE-SU-2020:2876-1 Security update for ardana-ansible, ardana-cinder, ardana-cobbler, ardana-installer-ui, ardana-opsconsole-ui, ardana-osconfig, crowbar-core, grafana, grafana-natel-discrete-panel, openstack-cinder, openstack-dashboard, openstack-ironic, openstack-ironic-python-agent, openstack-manila, openstack-neutron, openstack-neutron-infoblox, openstack-nova, python-Flask-Cors, rubygem-crowbar-client, storm, storm-kit, venv-openstack-cinder, venv-openstack-horizon

This update for ardana-ansible, ardana-cinder, ardana-cobbler, ardana-installer-ui, ardana-opsconsole-ui, ardana-osconfig, crowbar-core, grafana, grafana-natel-discrete-panel, openstack-cinder, openstack-dashboard, openstack-ironic, openstack-ironic-python-agent, openstack-manila,...

CVE-2020-14025

Ozeki NG SMS Gateway through 4.17.6 has multiple CSRF vulnerabilities. For example, an administrator, by following a link, can be tricked into making unwanted changes such as installing new modules or changing a password...

CVE-2020-24046

A sandbox escape issue was discovered in TitanHQ SpamTitan Gateway 7.07. It limits the admin user to a restricted shell, allowing execution of a small number of tools of the operating system. This restricted shell can be bypassed after changing the properties of the user admin in the operating...

Scopia XT Desktop 8.3.915.4 Cross Site Request Forgery

Exploit Title: Scopia XT Desktop 8.3.915.4 - Cross-Site Request Forgery change admin password Google Dork: inurl:scopia+index.jsp Date: 2020-09-09 Exploit Author: v1n1v131r4 Vendor Homepage: https://avaya.com Software Link:...

Scopia XT Desktop 8.3.915.4 - Cross-Site Request Forgery (change admin password)

Exploit Title: Scopia XT Desktop 8.3.915.4 - Cross-Site Request Forgery change admin password Google Dork: inurl:scopia+index.jsp Date: 2020-09-09 Exploit Author: v1n1v131r4 Vendor Homepage: https://avaya.com Software Link:...

CVE-2020-25078

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure...

CVE-2020-25078

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure. Recent assessments: kevthehermit at March 04, 2021 12:03am UTC reported: Vulnerability The D-LInk...

CVE-2020-23836

A Cross-Site Request Forgery CSRF vulnerability in edituser.php in OSWAPP Warehouse Inventory System aka OSWA-INV through 2020-08-10 allows remote attackers to change the admin's password after an authenticated admin visits a third-party site...

CVE-2020-23836

A Cross-Site Request Forgery CSRF vulnerability in edituser.php in OSWAPP Warehouse Inventory System aka OSWA-INV through 2020-08-10 allows remote attackers to change the admin's password after an authenticated admin visits a third-party site...

CVE-2020-23836

A Cross-Site Request Forgery CSRF vulnerability in edituser.php in OSWAPP Warehouse Inventory System aka OSWA-INV through 2020-08-10 allows remote attackers to change the admin's password after an authenticated admin visits a third-party site...

TP-Link TL-WA855RE Elevation of Privilege Vulnerability

The TP-Link TL-WA855RE is a 300Mbps Wi-Fi range extender. An elevation of privilege vulnerability exists in the TP-Link TL-WA855RE V5 version 20200415-rel37464. An attacker can perform a factory reset and reboot via a TDDPRESET POST request, which can be exploited to set a new administrative...

CVE-2020-24363

TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker on the same network to submit a TDDPRESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password...

CVE-2020-24363

TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker on the same network to submit a TDDPRESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password...

PT-2020-15707

Name of the Vulnerable Software and Affected Versions: TP-Link TL-WA855RE version V5 20200415-rel37464 Description: TP-Link TL-WA855RE devices allow an unauthenticated attacker on the same network to submit a TDDP RESET POST request, leading to a factory reset and reboot. This allows the attacker...

TP-Link WDR4300 Remote Code Execution

!/usr/bin/python3 import sys import hashlib import base64 import requests import binascii import socket """ RCE via stack-based overflow on TP-Link WDR4300 N750 devices, using CVE-2017-13772. Tested on Firmware versions 3.13.33, Build 130618 and 3.14.3 Build 150518, hardware WDR4300 v1 Usage: 1...