CVE-2018-10544: Improper Authentication

Meross MSS110 devices through 1.1.24 contain an unauthenticated admin.htm administrative interface...

CVE-2018-4841

A vulnerability has been identified in TIM 1531 IRC All versions V1.1. A remote attacker with network access to port 80/tcp or port 443/tcp could perform administrative operations on the device without prior authentication. Successful exploitation could allow to cause a denial-of-service, or read...

Friends In War Make Or Break 1.7 Password Change

Friends in War Make or Break 1.7 - Unauthenticated admin password change Url: http://software.friendsinwar.com/ http://software.friendsinwar.com/downloads.php?catid=2&fileid=9 Author: shinnai mail: shinnaiatautisticidotorg site: http://www.shinnai.altervista.org/...

Design/Logic Flaw

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirmhash value to verify.php...

CVE-2017-7615

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirmhash value to verify.php...

CVE-2017-7615

CVE-2017-7615 affects MantisBT up to version 2.30 (e.g., 2.3.0/2.3.1). The vulnerability is in verify.php where an empty confirm_hash enables pre-auth remote password reset and unauthenticated admin access, allowing unauthorized password changes and admin access. Public exploit references exist (...

CVE-2017-7615: Weak Password Recovery Mechanism for Forgotten Password

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirmhash value to verify.php...

PT-2017-17844 · Mantisbt · Mantisbt

Name of the Vulnerable Software and Affected Versions: MantisBT versions prior to 2.3.1 Description: The issue allows for arbitrary password reset and unauthenticated admin access. This is achieved by providing an empty confirm hash value to the "verify.php" endpoint. Recommendations: For version...

Teleopti WFM <= 7.1.0 Multiple Vulnerabilities

Teleopti WFM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:teleopit:wfm"; if description...

Davolink DV-2051 - Multiple Vulnerabilities

Davolink DV-2051 - Multiple Vulnerabilities =================================================================== Title: Unauthenticated admin password change Product: Davolink modem Tested model: DV-2051 Vulnerability Type: Missing Function Level Access Control CWE-306 Risk Level: High Solution...