5 matches found
CVE-2026-44733 OpenProject: Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass password requirements
OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass password requirements. A password validation flaw in the change password behavior allows attackers to chan...
PT-2023-6360 · Connectize · Connectize Ac21000 G6
Name of the Vulnerable Software and Affected Versions: Connectize AC21000 G6 version 641.139.1.1256 Description: An issue in the change password functionality of the Connectize AC21000 G6 allows attackers to gain control of the device without prompting for the current password. This is related to...
CVE-2019-18418
clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no session management...
Eaton UPS 9PX 8000 SP Cross-Site Request Forgery Vulnerability
The Eaton UPS 9PX 8000 SP is a power management device from Eaton USA. A cross-site request forgery vulnerability exists in the change-password feature in the Eaton UPS 9PX 8000 SP, which can be exploited by a remote attacker to force an administrator logged in to the device to unknowingly perfor...