UBUNTU-CVE-2017-0921

GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an unverified password change issue in the PasswordsController component resulting in potential account takeover if a victim's session is compromised...

Microsoft Windows: Disable machine account password changes

This test checks the setting for policy OpenVAS Vulnerability Test $Id: windomainmachineaccountpasswdchanges.nasl 11532 2018-09-21 19:07:30Z cfischer $ Check value for Domain member: Disable machine account password changes Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH...

Tenable Nessus Session Fixation Vulnerability

Tenable Network Security Nessus is an open source vulnerability scanner from Tenable Network Security, USA. A session fixation vulnerability exists in Tenable Network Security Nessus versions prior to 7.1.0. An attacker could exploit this vulnerability to gain access to the system even after a us...

Fastweb FASTGate 0.00.47 Cross Site Request Forgery

Exploit Title: Fastweb FASTgate 0.00.47 CSRF Date: 09-05-2018 Exploit Authors: Raffaele Sabato Contact: https://twitter.com/syrion89 Vendor: Fastweb Product Web Page: http://www.fastweb.it/adsl-fibra-ottica/dettagli/modem-fastweb-fastgate/ Version: 0.00.47 CVE: CVE-2018-6023 I DESCRIPTION...

Fastweb FASTGate 0.00.47 - Cross-site Request Forgery

Exploit for hardware platform in category web applications Exploit Title: Fastweb FASTgate 0.00.47 CSRF Exploit Authors: Raffaele Sabato Contact: https://twitter.com/syrion89 Vendor: Fastweb Product Web Page: http://www.fastweb.it/adsl-fibra-ottica/dettagli/modem-fastweb-fastgate/ Version: 0.00.4...

CVE-2017-18042

The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify user data including passwords via a Cross-site request forgery CSRF vulnerability...

CVE-2017-5254

In version 3.5 and prior of Cambium Networks ePMP firmware, the non-administrative users 'installer' and 'home' have the capability of changing passwords for other accounts, including admin, after disabling a client-side protection mechanism...

Multiple Vulnerabilities in the EnjoyShop App

Enjoy a purchase app is an online shopping application. There are vulnerabilities in arbitrary user password change, arbitrary account login, arbitrary user payment password reset and payment design of Enjoy a purchase app. An attacker can reset any user, login to any account, reset any payment...

On Wine App Has Logic Flaws

On Wine APP is a wine appraisal platform. There is a logic vulnerability in On Wine APP, which can be exploited by an attacker to arbitrarily register users, arbitrarily log in users, and arbitrarily change passwords...

Search Easy Borrowing App Exists with Arbitrary Password Reset Vulnerability

Search Easy Borrow APP is a smart loan search information service platform. There is an arbitrary password reset vulnerability in SearchEaseLendAPP, which allows an attacker to change the account password of the whole website in bulk by cooperating with the username enumeration...

Today is System Administrator Appreciation Day

And we are enormously grateful. What started off as a tongue-and-cheek offshoot of Administrative Professionals Day has now become a special holiday that people around the world recognize and practice. Dear reader, today is System Administrator Appreciation Day. Let’s be honest, maintaining the...

CVE-2017-9415

Cross-site request forgery CSRF vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target username to hijack the authentication of users for requests that change passwords via a crafted request to userSettings.view...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target username to hijack the authentication of users for requests that change passwords via a crafted request to userSettings.view...

CVE-2017-6530

Televes COAXDATA GATEWAY 1Gbps devices doc-wifi-hgwv1.02.0014 4.20 do not check password.shtml authorization, leading to Arbitrary password change...

Design/Logic Flaw

Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attackers to obtain access via an unattended workstation...

CVE-2017-8879

Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attackers to obtain access via an unattended workstation...

UBUNTU-CVE-2017-8879

Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attackers to obtain access via an unattended workstation...

Default credentials

360fly 4K cameras allow unauthenticated Wi-Fi password changes and complete access with REST by using the Bluetooth Low Energy pairing procedure, which is available at any time and does not require a password. This affects firmware 2.1.4. Exploitation can use the 360fly Android or iOS application...

Unauthorized Change Of Password

loopback is vulnerable to unauthorized password changes. The vulnerability exists as loopback accepts a change of user password without having the user to confirm their old password, leading to an account takeover. The attack is possible as long as an attacker can perform some form of social...

PT-2018-5044 · Red Hat +1 · Ansible +1

Name of the Vulnerable Software and Affected Versions: Ansible versions prior to 2.2.1.0 Description: An input validation issue was discovered in the mysql user module, potentially causing password changes to fail under certain conditions, resulting in the previous password remaining active...