39 matches found
CVE-2018-6180
A flaw in the profile section of Online Voting System 1.0 allows an unauthenticated user to set an arbitrary password for other accounts...
Roundcube Webmail < 1.0.11, 1.1.x < 1.1.9, 1.2.x < 1.2.5 Password Reset Vulnerability
Roundcube Webmail is prone to an arbitrary password reset vulnerability. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is fre...
D-Link DSL-2730U Cross-Site Request Forgery Vulnerability
The D-link DI-604 is a small router device. The D-Link DSL-2730U C1 IN1.00 device has a cross-site request forgery vulnerability in its implementation that could allow a remote attacker to change the DNS or firewall configuration or arbitrary passwords...
BMC Remedy AR System Server Password Reset Vulnerability
BMC Remedy is BMC Software's mobile digital enterprise management platform for IT departments, of which Remedy AR System Server is the server side. A security vulnerability exists in the Remedy AR System Server in BMC Remedy. An attacker can exploit this vulnerability to reset arbitrary passwords...
CVE-2016-5890
IBM Sterling B2B Integrator 5.2 before 502050014 and 5.2 06 before 50206021 allows remote authenticated users to change arbitrary passwords via unspecified vectors...
Code injection
IBM Sterling B2B Integrator 5.2 before 502050014 and 5.2 06 before 50206021 allows remote authenticated users to change arbitrary passwords via unspecified vectors...
CVE-2016-4505
Resource Data Management RDM Intuitive 650 TDB Controller devices before 2.1.24 allow remote authenticated users to modify arbitrary passwords via unspecified vectors...
Code injection
Tollgrade SmartGrid LightHouse Sensor Management System SMS Software EMS before 5.1, and 4.1.0 Build 16, allows remote authenticated users to change arbitrary passwords via unspecified vectors...
CVE-2015-8267
The PasswordReset.Controllers.ResetController.ChangePasswordIndex method in PasswordReset.dll in Dovestones AD Self Password Reset before 3.0.4.0 allows remote attackers to reset arbitrary passwords via a crafted request with a valid username...
Design/Logic Flaw
The PasswordReset.Controllers.ResetController.ChangePasswordIndex method in PasswordReset.dll in Dovestones AD Self Password Reset before 3.0.4.0 allows remote attackers to reset arbitrary passwords via a crafted request with a valid username...
CVE-2015-4262
The password-change feature in Cisco Unified MeetingPlace Web Conferencing before 8.55 MR3 and 8.6 before 8.62 does not check the session ID or require entry of the current password, which allows remote attackers to reset arbitrary passwords via a crafted HTTP request, aka Bug ID CSCuu51839...
CVE-2012-2977
The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows remote attackers to change arbitrary passwords via crafted input to an application script...
VulnCheck KEV: CVE-2011-1035
The password reset in PivotX before 2.2.4 allows remote attackers to modify the passwords of arbitrary users via unspecified vectors...
CVE-2008-4427
changepassword.php in Phlatline's Personal Information Manager pPIM 1.0 and earlier does not require administrative authentication, which allows remote attackers to change arbitrary passwords...
Authentication flaw
changepassword.php in Phlatline's Personal Information Manager pPIM 1.0 and earlier does not require administrative authentication, which allows remote attackers to change arbitrary passwords...
CVE-2008-4427
changepassword.php in Phlatline's Personal Information Manager pPIM 1.0 and earlier does not require administrative authentication, which allows remote attackers to change arbitrary passwords...
CVE-2007-5060
Cross-site request forgery CSRF vulnerability in the cpass functionality in an admin action in index.php in XCMS allows remote attackers to change arbitrary passwords via certain password and rpassword parameters, possibly related to timestamp values...
Corsaire Security Advisory - VMware ESX Server Password Cross Site Request Forgery issue
-- Corsaire Security Advisory -- Title: VMware ESX Server Password Cross Site Request Forgery issue Date: 14.11.05 Application: VMware ESX prior to 2.5.3 upgrade patch 2 VMware ESX prior to 2.1.3 upgrade patch 1 VMware ESX prior to 2.0.2 upgrade patch 1 Environment: VMware ESX Author: Stephen de...