CVE-2019-3942

Advantech WebAccess 8.3.4 does not properly restrict an RPC call that allows unauthenticated, remote users to read files. An attacker can use this vulnerability to recover the administrator password...

The vulnerability of the HNAP strncmp component in the microprogramming software for wireless routers from D-Link, such as the D-Link DIR-867-US, D-Link DIR-878, and D-Link DIR-882-US, allows a hacker to alter the administrator password.

The vulnerability of the HNAP strncmp component in microprogrammed software for D-Link wireless routers such as D-Link DIR-867-US, D-Link DIR-878, and D-Link DIR-882-US is related to errors in handling empty passwords. Exploiting this vulnerability could allow a remote attacker to change the...

Subrion CMS CSRF Vulnerability

Subrion CMS is a PHP-based content management system CMS from the Subrion team. The system can be integrated into a website and supports a variety of extensions plugins and more. A cross-site request forgery vulnerability exists in Subrion CMS version 4.1.5 previous versions may also be affected....

CVE-2018-21037

Subrion CMS 4.1.5 and possibly earlier versions allow CSRF to change the administrator password via the panel/members/edit/1 URI...

CVE-2020-1731

CVE-2020-1731 affects the Keycloak operator (community) prior to 8.0.2. The operator generates a random admin password during installation, but the same password is used when deployed within the same OpenShift namespace, enabling potential information disclosure. Public documents describe a criti...

CVE-2020-1731

A flaw was found in all versions of the Keycloak operator, before version 8.0.2,community only where the operator generates a random admin password when installing Keycloak, however the password remains the same when deployed to the same OpenShift namespace...

PT-2020-2762

Name of the Vulnerable Software and Affected Versions Keycloak operator versions prior to 8.0.2 Description The issue is related to the Keycloak operator's failure to reset a randomly generated admin password after installation. This could allow a remote attacker to elevate their privileges. The...

CVE-2020-1731: Predictable from Observable State

A flaw was found in all versions of the Keycloak operator, before version 8.0.2,community only where the operator generates a random admin password when installing Keycloak, however the password remains the same when deployed to the same OpenShift namespace...

Moxa AWK-3131A iw_console privilege escalation vulnerability

Added: 02/27/2020 CVE: CVE-2019-5136 Background Moxa AWK-3131A is a 3-in-1 industrial wireless AP/bridge/client device. Problem A privilege escalation vulnerability exists in the iwconsole functionality where a specially crafted menu selection string can cause an escape from the restricted consol...

CVE-2018-13313 Admin Password returned in password.htm

In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScript which is used to confirm the user knows their current password before allowing them to change their password. However, this JavaScript...

SOPlanning Cross-Site Request Forgery Vulnerability (CNVD-2020-10484)

SOPlanning is an online planning tool for efficiently organizing projects and tasks. SOPlanning 1.45 suffers from a cross-site request forgery vulnerability. An attacker can exploit this vulnerability to arbitrarily change the administrator password via process/xajaxserver.php...

CVE-2020-9266

SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajaxserver.php...

CVE-2020-9266

SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajaxserver.php...

Cross site request forgery (csrf)

SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajaxserver.php...

CVE-2020-9266

SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajaxserver.php...

CVE-2020-9266

SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajaxserver.php...

CVE-2020-9266

SOPlanning 1.45 is affected by a Cross-Site Request Forgery (CSRF) vulnerability that lets an attacker arbitrarily change the administrator password via the endpoint process/xajax_server.php. The underlying issue is a CSRF in the admin password change flow; this is documented across multiple sour...

CVE-2020-9266: Cross-Site Request Forgery (CSRF)

SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajaxserver.php...

PT-2020-20560

Name of the Vulnerable Software and Affected Versions SOPlanning version 1.45 Description The issue allows for a CSRF attack, enabling arbitrary changes to the admin password through the "process/xajax server.php" endpoint. Recommendations For SOPlanning version 1.45, consider restricting access ...

SOPlanning 1.45 - Cross-Site Request Forgery (Add User) Vulnerability

Exploit for php platform in category web applications Exploit Title: SOPlanning 1.45 - Cross-Site Request Forgery Add User Exploit Author: J3rryBl4nks Vendor Homepage: https://www.soplanning.org/en/ Software Link: https://sourceforge.net/projects/soplanning/files/soplanning/ Version 1.45 Tested o...