3059 matches found
Cross site request forgery (csrf)
Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian is a specific version of the Plesk product: version numbers were used through version 12, and then the convention was changed so that versions are identified by names...
CVE-2022-45130
Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian is a specific version of the Plesk product: version numbers were used through version 12, and then the convention was changed so that versions are identified by names...
CVE-2022-45130
Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian is a specific version of the Plesk product: version numbers were used through version 12, and then the convention was changed so that versions are identified by names...
PT-2022-27411 · Plesk · Plesk Obsidian
Name of the Vulnerable Software and Affected Versions: Plesk Obsidian Description: The issue allows a CSRF attack, for example, via the "/api/v2/cli/commands" REST API to change an Admin password. This affects Plesk Obsidian, which is a specific version of the Plesk product where versions are...
CVE-2022-45130
CVE-2022-45130 describes a CSRF vulnerability in Plesk Obsidian that can enable an attacker to change the administrator password via the REST API endpoint /api/v2/cli/commands. The issue affects Plesk Obsidian (Obsidian naming convention for versions) and is triggered when an authenticated user i...
CVE-2022-43031
DedeCMS v6.1.9 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily add Administrator accounts and modify Admin passwords...
Exploit for Path Traversal in Mikrotik Routeros
By the Way By the Way is an exploit that enables a root shell...
CVE-2022-43364
An access control issue in the password reset page of IP-COM EW9 V15.11.0.149732 allows unauthenticated attackers to arbitrarily change the admin password...
CVE-2022-43364
An access control issue in the password reset page of IP-COM EW9 V15.11.0.149732 allows unauthenticated attackers to arbitrarily change the admin password...
Default credentials
An access control issue in the password reset page of IP-COM EW9 V15.11.0.149732 allows unauthenticated attackers to arbitrarily change the admin password...
CVE-2022-43364
An access control issue in the password reset page of IP-COM EW9 V15.11.0.149732 allows unauthenticated attackers to arbitrarily change the admin password...
PT-2022-26066 · Delta Electronics · Infrasuite Device Master
Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions 00.00.01a and prior Description: The issue allows unauthenticated users to trigger the WriteConfiguration method. This could enable an attacker to modify user configuration files, such as...
CVE-2022-43364
An access control issue in the password reset page of IP-COM EW9 V15.11.0.149732 allows unauthenticated attackers to arbitrarily change the admin password...
PT-2022-26872 · Ip Com · Ip-Com Ew9
Name of the Vulnerable Software and Affected Versions: IP-COM EW9 version 15.11.0.149732 Description: The issue is related to an access control problem in the password reset page, allowing unauthenticated attackers to change the admin password arbitrarily. Recommendations: For IP-COM EW9 version...
PT-2022-6362 · Tp Link · Tp-Link Tl-Wr940N
Name of the Vulnerable Software and Affected Versions: TP-Link router TL-WR940N V6 version 3.19.1 Build 180119 Description: The issue is related to the use of a deprecated MD5 algorithm to hash the admin password used for basic authentication. This could allow a remote attacker to gain unauthoriz...
CVE-2022-43364
CVE-2022-43364 affects IP-COM EW9 (firmware V15.11.0.14(9732)). An access-control flaw on the password-reset page allows unauthenticated attackers to arbitrarily change the admin password. CVSSv3.1 metrics in NVD/CVE entries: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (base score 7.5, HIGH). Attack vect...
CVE-2022-43364: Undefined Security Weakness
An access control issue in the password reset page of IP-COM EW9 V15.11.0.149732 allows unauthenticated attackers to arbitrarily change the admin password...
Delta Electronics InfraSuite Device Master 访问控制错误漏洞
Delta Electronics InfraSuite Device Master is a device used to simplify and automate the monitoring of critical devices from Delta Electronics Taiwan, China. An access control error vulnerability exists in versions prior to Delta Electronics InfraSuite Device Master 00.00.01a that stems from...
CVE-2022-42467
When running in prototype mode, the h2 webconsole module accessible from the Prototype menu is automatically made available with the ability to directly query the database. It was felt that it is safer to require the developer to explicitly enable this capability. As of 2.0.0-M8, this can now be...