856 matches found
CVE-2021-33723
A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. An authenticated attacker could change the user profile of any user without proper authorization. With this, the attacker could change the password of any user in the affected system...
CVE-2021-41302
ECOA BAS controller stores sensitive data backup exports in clear-text, thus the unauthenticated attacker can remotely query user password and obtain user’s privilege...
Default credentials
ECOA BAS controller stores sensitive data backup exports in clear-text, thus the unauthenticated attacker can remotely query user password and obtain user’s privilege...
CVE-2021-41586
In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially reset the system user password...
Server side request forgery (ssrf)
In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially reset the system user password...
CVE-2021-41586
In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially reset the system user password...
CVE-2021-37184
Siemens Industrial Edge Management is affected by CVE-2021-37184. All versions prior to v1.3 are vulnerable to an authorization bypass where an unauthenticated attacker could change the password of any user, enabling impersonation of any valid user on the system. The root cause is described as a ...
Insecure Encryption
showdoc/showdoc has insecure encryption. The vulnerability exists due to a hardcoded salt in its user password hash function...
Meow Gallery < 4.1.9 - Contributor+ SQL Injection
The plugin does not sanitise, validate or escape the ids attribute of its gallery shortcode available for users as low as Contributor before using it in an SQL statement, leading to an authenticated SQL Injection issue. The injection also allows the returned values to be manipulated in a way that...
GHSA-8VH3-29MR-M9XG Inadequate Encryption Strength in showdoc
showdoc makes use of a hardcoded salt in its user password hash function...
Elpscrk - An Intelligent Common User-Password Profiler Based On Permutations And Statistics
An Intelligent common user-password profiler that's named after the same tool in Mr.Robot series S01E01 In simple words, elpscrk will ask you about all info you know about your target then will try to generate every possible password the target could think of, it all depends on the information yo...
Cross-Site Request Forgery (CSRF) in devcode-it/openstamanager
✍️ Description Attacker able to change users password if users visit attacker site. 🕵️♂️ Proof of Concept 1.Open the PoC.html In Firefox or safari. 2.now you can check that password changed to admin0 // PoC.html history.pushState'', '', '/' document.forms0.submit; 💥 Impact This vulnerability is...
CVE-2021-27495
Ypsomed mylife Cloud, mylife Mobile Application:Ypsomed mylife Cloud,All versions prior to 1.7.2,Ypsomed mylife App,All versions prior to 1.7.5,he Ypsomed mylife Cloud reflects the user password during the login process after redirecting the user from a HTTPS endpoint to a HTTP endpoint...
CVE-2021-27495
Ypsomed mylife Cloud, mylife Mobile Application:Ypsomed mylife Cloud,All versions prior to 1.7.2,Ypsomed mylife App,All versions prior to 1.7.5,he Ypsomed mylife Cloud reflects the user password during the login process after redirecting the user from a HTTPS endpoint to a HTTP endpoint...
How to use Secure LDAP to Change the User Password in NetScaler Gateway
This article provides information on how to use Lightweight Directory Access Protocol LDAP in NetScaler Gateway to change the users passwords. However, Secure LDAP is required to change the password. Note : Windows Server global catalog port 3268 or secure global catalog port 3269 do not support...
CVE-2021-22773
A CWE-620: Unverified Password Change vulnerability exists in EVlink City EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1, EVlink Parking EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1, and EVlink Smart Wallbox EVB1A all versions prior to R8 V3.4.0.1 that could allow an attacker...
Shanghai Chuangtu Network Technology Co., Ltd. culture cloud has a logic flaw vulnerability
Shanghai Chuangtu Network Technology Co., Ltd. specializes in science and technology innovation services in the field of culture and tourism. Shanghai Chuangtu Network Technology Co., Ltd. cultural cloud there is a logic flaw vulnerability, attackers can use the vulnerability to modify the return...
CVE-2021-26037
CVE-2021-26037 affects Joomla! core versions 2.5.0 through 3.9.27. The root cause is that CMS functions did not properly terminate existing user sessions when a user’s password was changed or the user was blocked. This behavioral gap can allow an attacker to retain or regain a session that should...
CVE-2021-32730
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A cross-site request forgery vulnerability exists in versions prior to 12.10.5, and in versions 13.0 through 13.1. It's possible for forge an URL that, when accessed by an admin, will reset th...