WordPress plugin Miniorange OTP Verification with Firebase 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

WordPress UltimateAI plugin <= 2.8.3 - Limited User Password Change due to Improper Empty and Missing Default Value Check vulnerability

Limited User Password Change due to Improper Empty and Missing Default Value Check vulnerability discovered by István Márton in WordPress Plugin UltimateAI versions = 2.8.3...

The software’s vulnerability regarding centralized device management by Fortinet FortiManager and the network firewall FortiAnalyzer is related to the lack of necessary checks during password changes. This allows attackers to alter administrator passwords.

The vulnerability of the software for centralized device management of Fortinet’s FortiManager and FortiAnalyzer devices stems from the lack of necessary checks during password changes. Exploiting this vulnerability allows a hacker to alter administrator passwords...

MegaBIP Security Vulnerabilities

MegaBIP is a software used to create BIP websites. A security vulnerability exists in MegaBIP 5.09 and earlier versions that stems from the presence of a SQL injection vulnerability that allows an attacker to gain site administrator privileges, including access to the administration panel and the...

The vulnerability of the platform for monitoring, managing, and improving LLM applications arises from the lack of a password recovery mechanism, allowing attackers to use the token for repeatedly changing user passwords.

The vulnerability of the platform for monitoring, managing, and improving LLM applications is related to the lack of a password recovery mechanism. Exploiting this vulnerability allows an attacker who operates remotely to use the token for repeatedly changing user passwords...

CVE-2024-33753

Section Camera V2.5.5.3116-S50-SMA-B20160811 and earlier versions allow the accounts and passwords of administrators and users to be changed without authorization...

Section Camera 安全漏洞

Section Camera is a series of cameras from Section. A security vulnerability exists in Section Camera version V2.5.5.3116-S50-SMA-B20160811 and prior versions, which stems from a vulnerability that allows unauthorized changes to administrator and user accounts and passwords...

Puwell Cloud Tech 360Eyes Pro 安全漏洞

Puwell Cloud Tech 360Eyes Pro is a home-oriented surveillance camera mobile platform application from Puwell Cloud Tech. A security vulnerability exists in the Puwell Cloud Tech 360Eyes Pro v3.9.5.16 3090516 version, which stems from a vulnerability that allows an attacker to intercept and access...

USN-6687-1 accountsservice vulnerability

It was discovered that AccountsService called a helper incorrectly when performing password change operations. A local attacker could possibly use this issue to obtain encrypted passwords...

CVE-2024-23637 OctoPrint Unverified Password Change via Access Control Settings

OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an adm...

CVE-2023-47577

An issue discovered in Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 allows for unauthorized password changes due to no check for current password...

CVE-2023-47577

An issue discovered in Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 allows for unauthorized password changes due to no check for current password...

CVE-2023-47577: Insufficiently Protected Credentials

An issue discovered in Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 allows for unauthorized password changes due to no check for current password...

CVE-2023-47577

CVE-2023-47577 affects Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0. The root cause is lack of current-password verification when changing passwords, enabling unauthorized changes. CVSSv3.1 base score is 9.8 (CRITICAL) with Network attack vector, Low attack complexity, Privileges Required: None, U...

CVE-2023-44374

A vulnerability has been identified in RUGGEDCOM RM1224 LTE4G EU 6GK6108-4AM00-2BA2 All versions V8.0, RUGGEDCOM RM1224 LTE4G NAM 6GK6108-4AM00-2DA2 All versions V8.0, SCALANCE M804PB 6GK5804-0AP00-2AA2 All versions V8.0, SCALANCE M812-1 ADSL-Router 6GK5812-1AA00-2AA2 All versions V8.0, SCALANCE...

PT-2023-29989 · Loytec · Liob-588 +6

Name of the Vulnerable Software and Affected Versions: LOYTEC LINX-151 affected versions not specified LOYTEC LINX-212 version 6.2.4 LOYTEC LVIS-3ME12-A1 version 6.2.2 LOYTEC LIOB-586 version 6.2.3 LOYTEC LIOB-580 V2 affected versions not specified LOYTEC LIOB-588 affected versions not specified...

Pimcore Security Vulnerability

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce framework and product information management applications. A security vulnerability exists in Pimcore...

PT-2023-6588 · Sielco · Sielco Polyeco1000

Name of the Vulnerable Software and Affected Versions: Sielco PolyEco1000 affected versions not specified Description: The issue is related to inadequate access control in the Sielco PolyEco1000 digital fm-transmitter's software. An attacker can exploit this by modifying passwords in POST request...

GHSA-G9V2-WQCJ-J99G Uptime Kuma has Persistentent User Sessions

Summary Attackers with access to a users' device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity-periods. Details uptime-kuma sets JWT tokens for users after successful authentication. These tokens have...

CVE-2023-44400

Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity periods. Version 1.23.3 has a patch for the...