CVE-2012-5476

Within the RHOS Essex Preview 2012.2 of the OpenStack dashboard package, the file /etc/quantum/quantum.conf is world readable which exposes the admin password and token value...

CVE-2014-3136

Cross-site request forgery CSRF vulnerability in D-Link DWR-113 Rev. Ax with firmware before 2.03b02 allows remote attackers to hijack the authentication of administrators for requests that change the admin password via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in D-Link DWR-113 Rev. Ax with firmware before 2.03b02 allows remote attackers to hijack the authentication of administrators for requests that change the admin password via unspecified vectors...

CVE-2014-3136

CVE-2014-3136 describes a CSRF vulnerability in the D-Link DWR-113 Rev. Ax router, with firmware versions before 2.03b02. The issue allows an authenticated administrator session to be hijacked so an attacker can issue requests that change the admin password via unspecified vectors. The root cause...

PT-2019-13827 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel versions 0.9.8.856 through 0.9.8.864 Description: The issue allows an attacker to obtain a victim's session file name from the /tmp directory and the victim's token value from /usr/local/cwpsrv/logs/access log. This informati...

CVE-2019-10694

The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin password. If they do not use that URL, there is an overlooked default password for the admin user. This was resolved in Puppet Enterprise 2019.0.3 and...

Default credentials

The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin password. If they do not use that URL, there is an overlooked default password for the admin user. This was resolved in Puppet Enterprise 2019.0.3 and...

CVE-2019-10694

The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin password. If they do not use that URL, there is an overlooked default password for the admin user. This was resolved in Puppet Enterprise 2019.0.3 and...

CVE-2019-16674

An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Authentication Information used in a cookie is predictable and can lead to admin password compromise when captured on the network...

CVE-2019-16674

CVE-2019-16674 affects Weidmueller IE-SW-VL05M/IE-SW-VL08MT/IE-SW-PL10M series. The root cause is that authentication information used in a cookie is predictable, enabling admin password compromise when captured over the network. The Red Hat and NVD entries describe a high-risk issue with the coo...

CVE-2019-16674

An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Authentication Information used in a cookie is predictable and can lead to admin password compromise when captured on the network...

CVE-2019-15799

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. User accounts created through the web interface of the device, when given non-admin level privileges, have the same level of privileged access as administrators when connecting to the device via SSH while their...

CVE-2010-3305

Cross-site request forgery CSRF vulnerability in pixelpost 1.7.3 could allow remote attackers to change the admin password...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in pixelpost 1.7.3 could allow remote attackers to change the admin password...

CVE-2010-3305

Cross-site request forgery CSRF vulnerability in pixelpost 1.7.3 could allow remote attackers to change the admin password...

CVE-2010-3305

This entry concerns CVE-2010-3305, a CSRF vulnerability in Pixelpost 1.7.3 that could allow remote attackers to change the admin password. The connected documents confirm the affected software/version and the underlying issue (CSRF) with implications for admin credentials. The provided materials ...

eMerge E3 1.00-06 - Cross-Site Request Forgery Vulnerability

Exploit for hardware platform in category web applications Exploit Title: eMerge E3 1.00-06 - Cross-Site Request Forgery Exploit Author: LiquidWorm Vendor Homepage: http://linear-solutions.com/nscfamily/e3-series/ Software Link: http://linear-solutions.com/nscfamily/e3-series/ Version: 1.00-06...

Nortek Linear eMerge E3 Access Control Cross Site Request Forgery

Nortek Linear eMerge E3 Access Control Cross-Site Request Forgery CVE: CVE-2019-7262 Advisory: https://applied-risk.com/resources/ar-2019-005 Discovered by Gjoko 'LiquidWorm' Krstic input type="hidden" name="DefaultFloorNo" valu...

Privilege Escalation

Overview Versions of strapi prior to 3.0.0-beta.17.5 are vulnerable to Privilege Escalation. The password reset routes allows an unauthenticated attacker to reset an admin's password without providing a valid password reset token. Recommendation Upgrade to version 3.0.0-beta.17.5 or later...

Improper access control

Computing For Good's Basic Laboratory Information System also known as C4G BLIS version 3.4 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may change the password of any administrator-level user...