PT-2022-10329 · Baijiacms · Baijiacms

Name of the Vulnerable Software and Affected Versions: baijiacms version 4 Description: An issue was discovered that allows modification of store information and login password due to a CSRF vulnerability. Recommendations: For baijiacms version 4, update to a version that includes a fix for this...

Cross site request forgery (csrf)

An issus was discovered in xiaohuanxiong CMS 5.0.17. There is a CSRF vulnerability that can modify administrator account's password...

CVE-2021-43737

CVE-2021-43737 affects xiaohuanxiong CMS 5.0.17. The issue is a cross-site request forgery (CSRF) in the WEB application that allows an attacker to modify the password of the administrator account. Root cause described in sources is insufficient validation that requests originate from a trusted u...

Mageia: Security Advisory (MGASA-2018-0201)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Reprise License Manager 14.2 Unauthenticated Password Change

Product: Reprise License Manager 14.2 Vendor: Reprise Software CVE ID: CVE-2021-44152 Vulnerability Title: Unauthenticated Password Change Severity: High Authors: Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard Date: 2021-11-25...

Exploit for Code Injection in Gitlab

CVE-2021-22205 GitLab CE/EE Preauth RCE using ExifTool This...

CVE-2021-20264

An insecure modification flaw in the /etc/passwd file was found in the openjdk-1.8 and openjdk-11 containers. This flaw allows an attacker with access to the container to modify the /etc/passwd and escalate their privileges. The highest threat from this vulnerability is to confidentiality,...

CVE-2021-22773

A CWE-620: Unverified Password Change vulnerability exists in EVlink City EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1, EVlink Parking EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1, and EVlink Smart Wallbox EVB1A all versions prior to R8 V3.4.0.1 that could allow an attacker...

CVE-2021-22773

A CWE-620: Unverified Password Change vulnerability exists in EVlink City EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1, EVlink Parking EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1, and EVlink Smart Wallbox EVB1A all versions prior to R8 V3.4.0.1 that could allow an attacker...

Authorization

There is an arbitrary password modification vulnerability in a D-LINK DSL-2888A router product. An attacker can use this vulnerability to modify the password of the admin user without authorization...

CVE-2021-33346

The CVE-2021-33346 entry concerns the D-LINK DSL-2888A router. The vulnerability allows an attacker to modify the admin password without authorization, enabling unauthorized admin access. Documents consistently identify the affected product as the D-LINK DSL-2888A and describe the issue as an arb...

CVE-2021-33346

There is an arbitrary password modification vulnerability in a D-LINK DSL-2888A router product. An attacker can use this vulnerability to modify the password of the admin user without authorization...

CVE-2020-20466

White Shark System WSS 1.3.2 is vulnerable to unauthorized access via usereditpassword.php, remote attackers can modify the password of any user...

CVE-2020-20466

White Shark System WSS 1.3.2 is vulnerable to unauthorized access via usereditpassword.php, remote attackers can modify the password of any user...

Cross site request forgery (csrf)

White Shark System WSS 1.3.2 is vulnerable to CSRF. Attackers can use the usereditpassword.php file to modify the user password...

Logic flaw vulnerability in the management center of the Jiafa inspection command system

Chengdu Jiafa Antai Education Technology Co., Ltd. is a company whose business scope includes: sales of commercial cryptographic products that have been approved by the State Cryptography Administration and have passed the product quality testing of designated testing organizations valid for...

Industrial Control Device Vulnerability in NA400 PLC at Aptar Technology Co.

NA400 PLC is a high performance programmable controller from OPTOTECHNIK Co. A vulnerability exists in the NA400PLC of Aptar Technology Corporation for industrial control devices, which can be exploited by an attacker to modify a user's password...

Logic Flaw Vulnerability in RG-UAC Riptide Unified Internet Behavior Management and Audit System

Ltd. is a company that utilizes new technologies such as cloud computing, SDN, mobile Internet, big data, and Internet of Things to provide end-to-end solutions for users in various industries. A logic flaw vulnerability exists in the RG-UAC Ruijie Unified Internet Behavior Management and Auditin...

Logic Flaw Vulnerability in YZMCMS Content Management System

YZMCMS content management system is an all-in-one website building system. A logic flaw vulnerability exists in the YZMCMS Content Management System, which can be exploited by an attacker to modify a user's password...

Logic flaw vulnerability in ZZCMS (CNVD-2021-14557)

ZZCMS is a completely open source based on PHP, ASP's product investment website management system , project investment website management system , enterprise website management system . ZZCMS logic flaws exist in the vulnerability , attackers can use the vulnerability to modify the existing user...