PT-2025-25851

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A buffer overflow issue has been identified in the Linux kernel, specifically in the dell-wmi-sysman platform, within the current password store function. This occurs when the buf array,...

CVE-2024-28143

The CVE-2024-28143 issue affects Image Access Scan2Net software (Image Access Germany) via the password-change function at /cgi/admin.cgi, where the current/old password is not required. This enables an attacker to set a new password for a user without knowing the old one, potentially via CSRF. T...

CVE-2023-47577

An issue discovered in Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 allows for unauthorized password changes due to no check for current password...

CVE-2023-24052

An issue discovered in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain control of the device via the change password functionality as it does not prompt for the current password...

CVE-2023-44828

D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the CurrentPassword parameter in the CheckPasswdSettings function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2020-12067

In Pilz PMC programming tool 3.x before 3.5.17 based on CODESYS Development System, a user's password may be changed by an attacker without knowledge of the current password...

The vulnerability of the OctoPrint 3D-printer controller relates to the unsafe management of privileges, allowing a malicious actor to change the account password without knowing the current password.

The vulnerability of the OctoPrint 3D-printer controller is related to insecure management of privileges. Exploiting this vulnerability allows a hacker to change the account password without knowing the current password...

CVE-2022-30328

An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The username and password setup for the web interface does not require entering the existing password. A malicious user can change the username and password of the interface...

CVE-2021-40101

An issue was discovered in Concrete CMS before 8.5.7. The Dashboard allows a user's password to be changed without a prompt for the current password...

PortlandLabs Concrete CMS 安全漏洞

PortlandLabs Concrete Cms is a team-oriented open source content management system from PortlandLabs, Inc. in the United States. A security vulnerability exists in PortlandLabs Concrete CMS, which stems from the product allowing passwords to be changed without prompting for the current password...

CVE-2021-28128

In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password...

ProSoft Technology ICX-HWC-A Security Vulnerability

The ProSoft Technology ICX35-HWC-A is a hardware device from ProSoft Technology, Inc. It provides network connectivity. A security vulnerability exists in ICX35-HWC-A: Versions 1.9.62 and prior and ICX35-HWC-E: Versions 1.9.62 and prior, which arises from a change of password on the module's web...

Acronis: Missing rate limit for current password field (Password Change) Account Takeover

Vulnerability: Missing Rate Limit for Current Password field Password Change Account Takeover Steps to reproduce the bug: 1Go to Profile Password. Enter any wrong password In current password filed. 2Now enter the new password and Turn the Intercept ON. 3Capture the request & Send the request to...

CVE-2018-13313

In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScript which is used to confirm the user knows their current password before allowing them to change their password. However, this JavaScript...

CVE-2018-12315

Missing verification of a password in ASUSTOR ADM version 3.1.1 allows attackers to change account passwords without entering the current password...

Dolibarr ERP/CRM Arbitrary Password Change Vulnerability

Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. A security vulnerability exists in Dolibarr ERP/CRM version...

UBUNTU-CVE-2017-8879

Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attackers to obtain access via an unattended workstation...

PT-2017-18601 · Dolibarr · Dolibarr Erp/Crm

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP/CRM version 4.0.4 Description: The issue allows password changes without requiring the current password, making it easier for attackers with physical access to obtain access via an unattended workstation. Recommendations: For...

DEBIAN-CVE-2013-4471

The Identity v3 API in OpenStack Dashboard Horizon before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for remote attackers to change a user password by leveraging the authentication token for that user...

D-Link DIR-635 - Multiple Vulnerabilities

D-Link DIR-635 - Multiple Vulnerabilities Device Name: DIR-635 Vendor: D-Link ============ Vulnerable Firmware Releases: ============ Firmwareversion: 2.34EU Hardware-Version: B1 Produktseite: DIR-635 ============ Vulnerability Overview: ============ Stored XSS - Status - WLAN - SSID Injecting...