MGASA-2014-0138 Updated samba packages fix security vulnerability

In Samba before 3.6.23, the SAMR server neglects to ensure that attempted password changes will update the bad password count, and does not set the lockout flags. This would allow a user unlimited attempts against the password by simply calling ChangePasswordUser2 repeatedly. This is available...

CVE-2013-4198

The CVE-2013-4198 entry applies to Plone: mail_password.py in Plone 2.1–4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1. The vulnerability allows remote authenticated users to bypass the prohibition on password changes via the forgotten-password email flow. Affected component/function/file: mai...

Huawei E355 contains a direct request vulnerability

Overview Huawei E355 USB WiFi adapter with firmware version: 21.157.37.01.910 has been reported to contain a direct request vulnerability in the web interface. CWE-425 Description Huawei E355 USB WiFi adapter with firmware version: 21.157.37.01.910 has been reported to contain a direct request...

shopEx官网修改任意用户密码漏洞

简要描述： RT 详细说明： my.shopex.cn 登录账户处 点击忘记密码 通过注册时使用的手机号码找回密码 这里以我自己的手机号为例，获取一下验证码 输入正确验证码，直接下一步 输入新密码,这里我输的是:wooyun123 在提交确认的时候抓包 将此处手机号修改成要重置的用户手机 这里我测试的时候改成了18688888888这个手机号 显示成功 那么我们登录一下18688888888:wooyun123 成功登录 img src="https://images.seeb...

CVE-2013-6731

IBM Netezza Performance Portal 2.x before 2.0.0.3 allows remote authenticated users to change arbitrary passwords via an HTTP POST request...

Cross site request forgery (csrf)

IBM Netezza Performance Portal 2.x before 2.0.0.3 allows remote authenticated users to change arbitrary passwords via an HTTP POST request...

CVE-2013-6731

IBM Netezza Performance Portal 2.x before 2.0.0.3 allows remote authenticated users to change arbitrary passwords via an HTTP POST request...

Trendchip HG520 ADSL2+ Wireless Modem CSRF Vulnerability

Exploit for hardware platform in category web applications Cross Site Request Forgery This Modem's Web Application , suffers from Cross-site request forgery through which attacker can manipulate user data via sending him malicious craft url. The Modems's Application not using any security token t...

Lexmark laser printers contain multiple vulnerabilities

Overview Certain Lexmark devices are vulnerable to unverified password changes and stored cross-site scripting attacks. Description CWE-620: Unverified Password Change - CVE-2013-6032Certain models of Lexmark laser printers and MarkNet devices are vulnerable to an attack which allows a remote...

BLUE COM Router 536052018 - Password Reset

BLUE COM Router 536052018 - Password Reset Exploit Title: BLUE COM Router - 5360/52018 Password Reset Exploit Date: 20/1/2013 Exploit Author: KAI kaisai12 Home: CEH.VN Version: BCOM - 5360 vulnerability - change password easy ! no protect ! var loc = 'password.cgi?'; switch idx case 2: loc +=...

PHPJabbers Job Listing脚本多个漏洞

No description provided by source. Job Listing Script - Multiple Vulnerabilties ==================================================================== .:. Author : HackXBack .:. Contact : [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script :...

BLUE COM Router 5360/52018 - Password Reset

Exploit Title: BLUE COM Router - 5360/52018 Password Reset Exploit Date: 20/1/2013 Exploit Author: KAI kaisai12 Home: CEH.VN Version: BCOM - 5360 vulnerability - change password easy ! no protect ! var loc = 'password.cgi?'; switch idx case 2: loc += 'sptPassword=' + encodeUrlpwdNew.value; break;...

cmseasy modify any of the administrator password vulnerability-vulnerability warning-the black bar safety net

Brief description: In fact, I was to brush an ordinary white hat...cmseasy to GET filtered more stringent,for the POST basic no filtering,various cross-site variety contains. Detailed description: lib/default/useract.php function editaction iffront::post'submit' unsetfront::$post'groupid';...

[CVE-2013-5116] Evernote Android Insecure Password Change (one-click setup)

Evernote Android Insecure Password Change one-click setup Product: Evernote Android Project Homepage: evernote.com Internal Advisory ID: c22-2013-05 Vulnerable Versions: Android version 5.5.0 and prior Tested Version: Android 5.x Android 4.2/4.3 Vendor Notification: Aug 13, 2013 Public Disclosure...

Security Dog new version mention the right to protection of one small flaw-a vulnerability warning-the black bar safety net

Brief description: The security dogs provided the right to protection of a small defect Detailed description: Small defects can be through the privilege elevation tool Perform net1 user to change the administrator password for direct login The previous version interception to change the password...

CVE-2013-6976

Cross-site request forgery CSRF vulnerability in goform/Quicksetup on Cisco EPC3925 devices allows remote attackers to hijack the authentication of administrators for requests that change a password via the Password and PasswordReEnter parameters, aka Bug ID CSCuh37496...

CVE-2013-6976

Cross-site request forgery CSRF vulnerability in goform/Quicksetup on Cisco EPC3925 devices allows remote attackers to hijack the authentication of administrators for requests that change a password via the Password and PasswordReEnter parameters, aka Bug ID CSCuh37496...

GLSA-201312-12 : MIT Kerberos 5: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201312-12 MIT Kerberos 5: Multiple vulnerabilities Multiple vulnerabilities have been discovered in the Key Distribution Center in MIT Kerberos 5. Please review the CVE identifiers referenced below for details. Impact : A remote...

iScripts MultiCart 2.4 - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Cross-Site Scripting / Cross-Site Request Forgery / Mass Accounts Takeover

Exploit Title : iScripts MultiCart same product id for which you submited the review. Cross-site request forgery input type...

MIT Kerberos 5: Multiple vulnerabilities

Background MIT Kerberos 5 is a suite of applications that implement the Kerberos network protocol. Description Multiple vulnerabilities have been discovered in the Key Distribution Center in MIT Kerberos 5. Please review the CVE identifiers referenced below for details. Impact A remote attacker...