PT-2024-19183 · Zte · Zte Zxv10 Xt802/Et301

Name of the Vulnerable Software and Affected Versions: ZTE ZXV10 XT802/ET301 product affected versions not specified Description: The issue is related to a permission and access control vulnerability. Attackers with common permissions can log in to the terminal web and change the administrator's...

CVE-2024-6890

Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password...

GHSA-V99W-R56H-G23V Owncast Cross-Site Request Forgery vulnerability

Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. In versions 0.1.2 and prior, a lenient CORS policy allows attackers to make a cross origin request, reading privileged information. This can be used to leak the admin password. Commit...

Owncast Cross-Site Request Forgery vulnerability

Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. In versions 0.1.2 and prior, a lenient CORS policy allows attackers to make a cross origin request, reading privileged information. This can be used to leak the admin password. Commit...

CVE-2024-31200

A “CWE-201: Insertion of Sensitive Information Into Sent Data” affecting the administrative account allows an attacker with physical access to the machine to retrieve the password in cleartext when an administrative session is open in the browser...

PT-2024-23625 · Plug&Track +1 · Sensor Net Connect V2 +2

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue allows an attacker with physical access to the machine to retrieve the administrative account password in cleartext, unless specific security measures such as full-disk encryptio...

PT-2024-27925 · R Hub · R-Hub Turbomeeting

Name of the Vulnerable Software and Affected Versions: R-HUB TurboMeeting versions through 8.x Description: The password-reset mechanism in the Forgot Password functionality allows unauthenticated remote attackers to force the application into resetting the administrator's password to a random...

CVE-2024-40119

Nepstech Wifi Router xpon terminal model NTPL-Xpon1GFEVN v.1.0 Firmware V2.0.1 contains a Cross-Site Request Forgery CSRF vulnerability in the password change function, which allows remote attackers to change the admin password without the user's consent, leading to a potential account takeover...

PT-2024-28788 · Nepstech · Nepstech Wifi Router Xpon

Name of the Vulnerable Software and Affected Versions: Nepstech Wifi Router xpon terminal model NTPL-Xpon1GFEVN version 1.0 Firmware V2.0.1 Description: The issue concerns a Cross-Site Request Forgery CSRF vulnerability in the password change function. This allows remote attackers to change the...

CVE-2024-40119

CVE-2024-40119 affects Nepstech Wifi Router xpon (terminal), model NTPL-Xpon1GFEVN v1.0 with Firmware V2.0.1. The vulnerability is a CSRF flaw in the password change function that allows remote attackers to change the admin password without user consent, potentially leading to an account takeover...

CVE-2019-16639

An issue was found on the Ruijie EG-2000 series gateway. There is a newcli.php API interface without access control, which can allow an attacker who only has web interface access to use TELNET commands and/or show admin passwords via the modeurl=exec&command= substring. This affects EG-2000SE...

The vulnerability of the “Forgotten Password” function on the IIoT platform of ifm Moneo devices, including IFM QHA300, IFM QHA210, and IFM QVA200, allows a hacker to change the administrator password.

The vulnerability of the “Forgotten Password” function on the IIoT platform of ifm Moneo devices, namely IFM QHA300, IFM QHA210, and IFM QVA200, is related to the lack of a password recovery mechanism. Exploiting this vulnerability could allow an attacker to remotely change the administrator’s...

CVE-2024-39314

The CVE-2024-39314 issue affects toy-blog versions 0.4.3 to before 0.5.0, where the administrative password was leaked via a command line parameter (root cause: command line exposure). A fix is available in version 0.5.0. As a workaround, versions 0.4.14 and later can pass the bearer token via st...

CVE-2024-39314 toy-blog administrative token leaked through the command line parameter

toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative password was leaked through the command line parameter. The problem was patched in version 0.5.0. As a workaround, pass --read-bearer-token-from-stdin to the...

PT-2024-28438 · Toy-Blog · Toy-Blog

Name of the Vulnerable Software and Affected Versions: toy-blog versions 0.4.3 through 0.4.14 toy-blog versions prior to 0.4.14 Description: The administrative password is leaked through the command line parameter. This issue was patched in version 0.5.0. Recommendations: For versions 0.4.14 and...

toy-blog Security Breach

toy-blog is a CMS system by the individual developer Kisaragi. A security vulnerability exists in toy-blog versions prior to 0.4.3 to 0.5.0, which stems from the disclosure of the administrative password via a command line parameter...

CVE-2024-5013

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Denial of Service vulnerability was identified. An unauthenticated attacker can put the application into the SetAdminPassword installation step, which renders the application non-accessible...

CVE-2024-5009

In WhatsUp Gold versions released before 2023.1.3, an Improper Access Control vulnerability in Wug.UI.Controllers.InstallController.SetAdminPassword allows local attackers to modify admin's password...

CVE-2024-5009

In WhatsUp Gold versions released before 2023.1.3, an Improper Access Control vulnerability in Wug.UI.Controllers.InstallController.SetAdminPassword allows local attackers to modify admin's password...

CVE-2024-5009

CVE-2024-5009 : Progress WhatsUp Gold pre-2023.1.3 contains an improper access control in Wug.UI.Controllers.InstallController.SetAdminPassword that allows local attackers to modify the admin password (privilege escalation). Affected product: Progress WhatsUp Gold; vulnerability appears in the Se...