CVE-2014-6412

WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach...

Design/Logic Flaw

WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach...

CVE-2014-6412

WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach...

CVE-2014-6412

WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach...

CVE-2014-6412

CVE-2014-6412 affects WordPress prior to 4.4, where the password-recovery token generation is vulnerable due to weak randomness. This can enable remote attackers to brute-force or predict tokens, potentially compromising password resets. Reports across multiple feeds (NVD entry, Ubuntu/Debian adv...

CVE-2018-9233

Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xml, which makes it easier for attackers to determine a cleartext password, and subsequently choose unsafe malware settings, via rainbow tables or other...

CVE-2018-1447

The GSKit IBM Spectrum Protect 7.1 and 7.2 and IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6 CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak password may be recovered. Note: After update the customer should change password to...

Hikvision IP Camera versions 5.2.0 - 5.3.9 (Builds 140721 < 170109) - Access Control Bypass Explo

Exploit for hardware platform in category web applications Exploit Title: Hikvision IP Camera versions 5.2.0 - 5.3.9 Builds: 140721 - 170109 Backdoor Date: 15-03-2018 Vendor Homepage: http://www.hikvision.com/en/ Exploit Author: Matamorphosis Category: Web Apps Description: Exploits a backdoor in...

CloudBees Jenkins Credentials Binding Plugin Information Disclosure Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software release/testing projects and some of the timed execution of the task.Credentials Binding...

Center for Internet Security CIS-CAT Pro Dashboard Privilege Gain Vulnerability

Center for Internet Security CIS-CAT Pro Dashboard is a set of panels used to display system compliance on a dashboard. An access control error vulnerability exists in versions of Center for Internet Security CIS-CAT Pro Dashboard prior to 1.0.4. An attacker can exploit this vulnerability to gain...

The software vulnerabilities of Cloud Foundry Runtime cf-release, UAA Standalone, and Pivotal Cloud Foundry Elastic Runtime – a software platform existing due to a flaw in the forgotten password recovery mechanism – allow attackers to exploit old links to reset passwords.

The vulnerabilities of the Cloud Foundry Runtime cf-release, UAA Standalone, and Pivotal Cloud Foundry Elastic Runtime software platforms exist due to a flaw in the mechanism for recovering forgotten passwords. Exploiting these vulnerabilities allows an attacker operating remotely to use outdated...

LaZagne v2.3 - Credentials Recovery Project

The LaZagne project is an open source application used to retrieve lots of passwords stored on a local computer. Each software stores its passwords using different techniques plaintext, APIs, custom algorithms, databases, etc.. This tool has been developed for the purpose of finding these passwor...

GPWeb Password Recovery SQL Injection Vulnerability

GPWeb is a suite of public administration software for the Brazilian government sector, and Password Recovery is one of its password recovery tools. A SQL injection vulnerability exists in GPWeb version 8.4.61 of Password Recovery. The vulnerability can be exploited by a remote attacker to execut...

CVE-2017-15875

SQL injection vulnerability in Password Recovery in GPWeb 8.4.61 allows remote attackers to execute arbitrary SQL commands via the "checkemail" parameter...

CVE-2017-15875

SQL injection vulnerability in Password Recovery in GPWeb 8.4.61 allows remote attackers to execute arbitrary SQL commands via the "checkemail" parameter...

Sql injection

SQL injection vulnerability in Password Recovery in GPWeb 8.4.61 allows remote attackers to execute arbitrary SQL commands via the "checkemail" parameter...

CYBERNET SYSTEMS Maplesoft Maple Cross-Site Scripting Vulnerability

CYBERNET SYSTEMS Maplesoft Maple T.A. is a general-purpose software tool for mathematics, data analysis, visualization, and programming from CYBERNET SYSTEMS, Japan. A cross-site scripting vulnerability exists in the password recovery page in CYBERNET SYSTEMS Maplesoft Maple T.A. version 2016.0.6...

CVE-2017-15875

SQL injection vulnerability in Password Recovery in GPWeb 8.4.61 allows remote attackers to execute arbitrary SQL commands via the "checkemail" parameter...

CVE-2017-15875

CVE-2017-15875 documents a SQL injection vulnerability in GPWeb Password Recovery, version 8.4.61. The vulnerability allows remote attackers to execute arbitrary SQL commands via the checkemail parameter. Connected sources confirm the affected product/version and the injection vector, but do not ...

Hangzhou Chengyu Asset Management Co. Smart Money APP has logic design flaws

Smart Money APP is an online smart investment management app developed by Hangzhou Chengyu Asset Management Co. There is a logical design flaw in the "password retrieval" section of the Smart Money APP of Hangzhou Chengyu Asset Management Co. Attackers through unlimited verification code...