4964 matches found
RelateIQ: Old Sessions remain valid after the password change.
Industry Standard Procedure When the password is changed or email address has been updated for any particular account,all the sessions which were active with the old password/email should be destroyed. Reason If somehow anybody hacked into your account and you understand that someone has trespass...
HackerOne: All Active user sessions should be deleted when user change his password!
When a user changed his/her password either directly or with reset password flow, existing sessions were kept active. We already invalidate all sessions when a user logs out, but we were not doing the same for password changes. This means that if an attacker were to get access to an account, even...
Cloudflare: csrf on password change functionality
It was observed that the web application ‘www.cloudflare.com’ is vulnerable to cross site request forgery attacks via FORM field reconstruction. Risk : An attacker could force an already authenticated user to perform actions that he or she didn’t intend to do, such as account creation, Updating...
CVE-2014-1990
Cross-site request forgery CSRF vulnerability in TopAccess aka the web-based management utility on TOSHIBA TEC e-Studio 232, 233, 282, and 283 devices allows remote attackers to hijack the authentication of administrators for requests that change passwords...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in TopAccess aka the web-based management utility on TOSHIBA TEC e-Studio 232, 233, 282, and 283 devices allows remote attackers to hijack the authentication of administrators for requests that change passwords...
CVE-2014-1990
CVE-2014-1990 corresponds to a cross-site request forgery (CSRF) in Toshiba TEC e‑Studio series TopAccess web management utility (models 232/233/282/283). The root cause is CSRF allowing an attacker to change administrator passwords by tricking a logged-in admin into visiting a malicious page, po...
CVE-2014-1990
Cross-site request forgery CSRF vulnerability in TopAccess aka the web-based management utility on TOSHIBA TEC e-Studio 232, 233, 282, and 283 devices allows remote attackers to hijack the authentication of administrators for requests that change passwords...
dede getshell exp + temporary patch-vulnerability warning-the black bar safety net
dede good fire old cassock also to scrape together a lively. In fact getshell many methods do not always tangled how to insert mytag table such as near myad table is a good place to update a word did not say more not much to say directly to the getshell exp. getshell exp To change the password wh...
Free Monthly Websites 2.0 - Admin Password Change
Exploit for php platform in category web applications ========================================================================================== Title : Free Monthly Websites 2.0 Administrator Remote Password Change Date : 10/04/2013 Name : Free Monthly Websites Affected Version : 2.0 Vendor :...
KLA10336 Multiple vulnerabilities in Sophos Web Appliance
Multiple critical vulnerabilities have been found in Sophos Web Appliance. Malicious users can exploit these vulnerabilities to execute arbitrary commands or change admin password. Below is a complete list of vulnerabilities 1. Vectors related to the netinterface configuration page can be exploit...
XCloner Standalone 3.5 Cross Site Request Forgery Vulnerability
XCloner Standalone version 3.5 suffers from a cross site request forgery vulnerability. Product: XCloner Standalone Vendor: XCloner Vulnerable Versions: 3.5 and probably prior Tested Version: 3.5 Advisory Publication: March 14, 2014 without technical details Vendor Notification: March 14, 2014...
Quick.CMS 5.4 - Multiple Vulnerabilities
Quick.CMS 5.4 - Multiple Vulnerabilities Exploit Title: QuickCms 5.4 Multiple Vulnerabilites Date: 04/08/2014 Author: shpendk Software Link: http://opensolution.org/download,en,18.html?sFile=Quick.Cms/Quick.Cmsv5.4.zip Version: 5.4 Tested on: Xampp on Windows Reflected XSS Vulnerability in Admin...
QuickCms 5.4 Cross Site Request Forgery / Cross Site Scripting
Exploit Title: QuickCms 5.4 Multiple Vulnerabilites Date: 04/08/2014 Author: shpendk Software Link: http://opensolution.org/download,en,18.html?sFile=Quick.Cms/Quick.Cmsv5.4.zip Version: 5.4 Tested on: Xampp on Windows Reflected XSS Vulnerability in Admin Area: Trigger:...
QuickCms 5.4 - Multiple Vulnerabilites
Exploit for php platform in category web applications Exploit Title: QuickCms 5.4 Multiple Vulnerabilites Date: 04/08/2014 Author: shpendk Software Link: http://opensolution.org/download,en,18.html?sFile=Quick.Cms/Quick.Cmsv5.4.zip Version: 5.4 Tested on: Xampp on Windows Reflected XSS...
LinkEx 20120508 /data/config/config 远程密码修改漏洞
No description provided by source...
MGASA-2014-0138 Updated samba packages fix security vulnerability
In Samba before 3.6.23, the SAMR server neglects to ensure that attempted password changes will update the bad password count, and does not set the lockout flags. This would allow a user unlimited attempts against the password by simply calling ChangePasswordUser2 repeatedly. This is available...
CVE-2013-4198
The CVE-2013-4198 entry applies to Plone: mail_password.py in Plone 2.1–4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1. The vulnerability allows remote authenticated users to bypass the prohibition on password changes via the forgotten-password email flow. Affected component/function/file: mai...
Huawei E355 contains a direct request vulnerability
Overview Huawei E355 USB WiFi adapter with firmware version: 21.157.37.01.910 has been reported to contain a direct request vulnerability in the web interface. CWE-425 Description Huawei E355 USB WiFi adapter with firmware version: 21.157.37.01.910 has been reported to contain a direct request...
shopEx官网修改任意用户密码漏洞
简要描述： RT 详细说明： my.shopex.cn 登录账户处 点击忘记密码 通过注册时使用的手机号码找回密码 这里以我自己的手机号为例，获取一下验证码 输入正确验证码，直接下一步 输入新密码,这里我输的是:wooyun123 在提交确认的时候抓包 将此处手机号修改成要重置的用户手机 这里我测试的时候改成了18688888888这个手机号 显示成功 那么我们登录一下18688888888:wooyun123 成功登录 img src="https://images.seeb...