8158 matches found
Memorial Web Site Script --> Reset Password & Insecure Cookie Handling
Exploit for php platform in category web applications ====================================================================== Memorial Web Site Script -- Reset Password & Insecure Cookie Handling ======================================================================...
Memorial Web Site Script - Reset Password Insecure Cookie Handling
Memorial Web Site Script - Reset Password Insecure Cookie Handling ----------------------------------------------------------------------- Memorial Web Site Script -- Reset Password & Insecure Cookie Handling ----------------------------------------------------------------------- Author : Chip D3...
Advisory 01/2010: MyBB Password Reset Email BCC: Injection Vulnerability
SektionEins GmbH www.sektioneins.de -= Security Advisory =- Advisory: MyBB Password Reset Email BCC: Injection Vulnerability Release Date: 2010/04/13 Last Modified: 2010/04/13 Author: Stefan Esser stefan.esseratsektioneins.de Application: MyBB = 1.4.11 Severity: An email injection vulnerability i...
Advisory 02/2010: MyBB Password Reset Weak Random Numbers Vulnerability
SektionEins GmbH www.sektioneins.de -= Security Advisory =- Advisory: MyBB Password Reset Weak Random Numbers Vulnerability Release Date: 2010/04/13 Last Modified: 2010/04/13 Author: Stefan Esser stefan.esseratsektioneins.de Application: MyBB = 1.4.11 Severity: Usage of weak random number...
CVE-2010-0713
Multiple cross-site request forgery CSRF vulnerabilities in Zenoss 2.3.3, and other versions before 2.5, allow remote attackers to hijack the authentication of an administrator for 1 requests that reset user passwords via zport/dmd/ZenUsers/admin, and 2 requests that change user commands, which...
Infested Torrent Sites Caused Twitter PW Reset
Twitter revealed more details about the phishing attacks that caused the company to reset the passwords on some user accounts Feb. 2. Read the full article. eWEEK...
ExtMail1.2 邮件系统跨站脚本漏洞（3P）
北洋贱队2009.12.31首发 Extmail 是一个以perl语言编写，面向大容量/ISP级应用，免费的高性能Webmail软件。 最新版本为1.2，检测出三出处跨站漏洞。 1.免费新用户注册的"signup.cgi"对‘domain’参数未进行参数过滤，构建恶意脚本代码作为参数数据，并诱使用户访问恶意链接，可触发恶意脚本代码在目标用户浏览器上执行，导致敏感信息泄漏。 demo:http://demo.extmail.org/extman/cgi/signup.cgi?domain=%22%3E%3Ciframe%20src=http://www.gohack.org%3E...
Zenoss Multiple Admin CSRF
nGenuity Information Services - Security Advisory Advisory ID: NGENUITY-2010-002 - Zenoss Multiple Admin CSRF Application: Zenoss 2.3.3 Vendor: Zenoss Vendor website: http://www.zenoss.com Author: Adam Baldwin [email protected] I. BACKGROUND Zenoss is a commercial and open source system...
Zenoss 2.3.3 Cross Site Request Forgery
nGenuity Information Services - Security Advisory Advisory ID: NGENUITY-2010-002 - Zenoss Multiple Admin CSRF Application: Zenoss 2.3.3 Vendor: Zenoss Vendor website: http://www.zenoss.com Author: Adam Baldwin [email protected] I. BACKGROUND Zenoss is a commercial and open source system...
CAPTCHA Option Should Exist for The Password Reset Form
panel:bgColor=e7f4fa NOTE: This suggestion is for JIRA Cloud. Using JIRA Server? See the corresponding suggestion|http://jira.atlassian.com/browse/JRASERVER-20150. panel The password reset prompt allows an individual to reset any user's password. My company uses a standard employee id to use for...
CAPTCHA Option Should Exist for The Password Reset Form
panel:bgColor=e7f4fa NOTE: This suggestion is for JIRA Server. Using JIRA Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/JRACLOUD-20150. panel The password reset prompt allows an individual to reset any user's password. My company uses a standard employee id to use for t...
CAPTCHA Option Should Exist for The Password Reset Form
The password reset prompt allows an individual to reset any user's password. My company uses a standard employee id to use for the JIRA username. With little knowledge, I designed a script that can cycle through employee id numbers and submit them to the reset password form. This process can repe...
[20100423] - Core - Password Reset Tokens
When a user requests a password reset, the reset tokens were stored in plain text in the database. While this is not a vulnerability in itself, it allows user accounts to be compromised if there is an extension on the site with an SQL injection vulnerability...
Discuz! 5.x&6.x&7x 重置用户密码漏洞
No description provided by source...
[BMSA-2009-07] Backdoor in PyForum
BLUE MOON SECURITY ADVISORY 2009-07 =================================== :Title: Backdoor in PyForum :Severity: Critical :Reporter: Blue Moon Consulting :Products: PyForum v1.0.3 :Fixed in: -- Description ----------- pyForum is a 100 python-based message board system based in the excellent web2py...
Debian Security Advisory DSA 1924-1 (mahara)
The remote host is missing an update to mahara announced via advisory DSA 1924-1. OpenVAS Vulnerability Test $Id: deb19241.nasl 6615 2017-07-07 12:09:52Z cfischer $ Description: Auto-generated from advisory DSA 1924-1 mahara Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...
CVE-2009-3298
Mahara before 1.0.13, and 1.1.x before 1.1.7, allows remote authenticated institution administrators to reset a site administrator password via unspecified vectors...
CVE-2009-3298
Mahara before 1.0.13, and 1.1.x before 1.1.7, allows remote authenticated institution administrators to reset a site administrator password via unspecified vectors...
CVE-2009-3298
Mahara up to version 1.0.12 and 1.1.x up to 1.1.6 is affected: remote authenticated institutional administrators can reset the site administrator's password via unspecified vectors, enabling privilege escalation. Affects Mahara core components handling admin authentication. Remediation per source...
