506 matches found
Multiple Pivotal products expire old reset password link vulnerability
Pivotal Cloud Foundry PCF Runtime cf-release and others are products of Pivotal Software, Inc. PCF is an open source Platform-as-a-Service PaaS cloud computing platform that provides container scheduling, continuous delivery, and automated service deployment. cf-release is a release version of PC...
CVE-2015-3189
With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions 2.2.5 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier, old Password Reset Links are not expired after the user changes their current email address to a new one. This vulnerability is applicable...
Cuvva: No Notification Sent When Email Is Changed.
We weren't sending notifications when a customer changed the email address on their account. This meant it was less likely the customer would notice if this happened maliciously. A simple best practise issue...
Weblate: Weak e-mail change functionality could lead to account takeover
Hi, Summary I have found a design issue on the e-mail change functionality offered by the "/accounts/profile" handler. In particular, the e-mail change functionality does not require the current user password to be completed. Since the e-mail could be used to reset the password of the account, an...
Nextcloud: Password reset link remains valid after email change
Hey! I found a token miss configuration flaw in Nextcloud 9.0.50 Latest version, When we reset password for a user a link is sent to the registered email address but incase it remain unused and email is updated by user from control panel then too that old token reset link sent at old email addres...
Skype Manager - (Email Change) Filter Bypass Vulnerability
Document Title: =============== Skype Manager - Email Change Filter Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1672 MSRC Case 32353 TRK:0001002845 Release Date: ============= 2016-05-08 Vulnerability Laboratory ID VL-ID:...
Uber: Changing Driver Passwords With Only an Authenticated Session (no password, no email)
It is possible to completely take over a driver's account with only an authenticated session. If a driver is logged on and wants to change their password, they will be asked for their current password changePassword.png, but when they want to change their email, they are not asked for their curre...
CVE-2015-3191 - CSRF attack on change email | Cloud Foundry
CVE-2015-3191 – CSRF attack on change email Low Vendor Cloud Foundry Foundation Versions Affected cf-release versions prior to v210 UAA versions prior to 2.3.0 Description The changeemail form in UAA is vulnerable to a CSRF attack. This allows an attacker to trigger an e-mail change for a user...
Grindr v2.1.1 iOS Bounty #1 - Auth Bypass Vulnerabilities
Document Title: =============== Grindr v2.1.1 iOS Bounty 1 - Auth Bypass Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1419 Release Date: ============= 2015-05-04 Vulnerability Laboratory ID VL-ID: ====================================...
Guppy CMS 5.0.95.00.10 - Authentication BypassChange Email
Guppy CMS 5.0.95.00.10 - Authentication BypassChange Email !-- Exploit Title: GuppY CMS 5.0.9 & 5.00.10 Authentication bypass/Change email. Other versions may be vulnerable but weren't tested. Date: 2/17/2015 Exploit Author: Brandon Murphy Vendor Homepage: http://freeguppy.org Software Link:...
GuppY CMS 5.0.9 / 5.00.10 Authentication Bypass / Change Email
!-- Exploit Title: GuppY CMS 5.0.9 & 5.00.10 Authentication bypass/Change email. Other versions may be vulnerable but weren't tested. Date: 2/17/2015 Exploit Author: Brandon Murphy Vendor Homepage: http://freeguppy.org Software Link: Windows-5.00.10...
HackerOne: Account Hijacking (Only rare case scenario)
Hi, This is a logical flaw in the application which may allow any arbitrary user to obtain account access of another user. Below is the exploit scenario which may lead to potential account takeover in certain circumstances: User changes email while he is logged in his own account Some wrong email...
HackerOne: Email changing
Hello When someone chnage his email he doesn't have to confirm the change of the email from both emails I suggest you must use a confirmation from both emails specially the old email Because If an attacker compromises the password of a hackone user the user will not be able to reset his password...
PHPmotion <= 2.1 CSRF Vulnerability
No description provided by source. PHPmotion = 2.1 CSRF vulnerability Author: Ausome1 Email: [email protected] Website: http://www.enigmagroup.org Description: Change a member's password and/or email...
lulieblog 1.2 - Multiple Vulnerabilities
No description provided by source. LulieBlog 1.2 Multiple Remote Vulnerabilities Admin Auth Bypass, Upload File, Blind SQL Injection Author: Cod3rZ Site: http://cod3rz.helloweb.eu Site: http://devilsnight.altervista.org Date: 06/05/2008 dd/mm/yyyy Admin Auth Bypass: Modify Articles: send a reques...
Sourcebans <= 1.4.2 Arbitrary Change Admin Email Vulnerability
No description provided by source. Sourcebans PHP sb-callback.php Author: Mr. Anonymous ------ Vendor:http://www.sourcebans.com Affected Versions: = 1.4.2 ----- Exploit sb-callback lines 185-204: ------------- function ChangeEmail$aid, $email ...SNIP... $GLOBALS'db'-ExecuteUPDATE .DBPREFIX.admins...
iScripts MultiCart <= 2.4 - Persistent XSS / CSRF / XSS+CSRF Mass Accounts takeover
Exploit for php platform in category web applications Exploit Title : iScripts MultiCart same product id for which you submited the review. Cross-site request forgery form nam...
HackerOne: Logical issues with account settings
earlier email was not allowed to change ,but now there is no verification on changing email. when user try to change the password , they were asked to verify the request by entering old password. For the same reason a verification should be there on changing email.The worst part is hackone send...
iScripts MultiCart 2.4 - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Cross-Site Scripting / Cross-Site Request Forgery / Mass Accounts Takeover
Exploit Title : iScripts MultiCart same product id for which you submited the review. Cross-site request forgery input type...