CVE-2020-13416

The CVE-2020-13416 issue affects Aviatrix Controller prior to 5.4.1066. A CSRF vulnerability arises because a Controller Web Interface session token parameter is not required on an API call, enabling password resets via CSRF. Impact is password reset abuse; exploitation details are not provided b...

CVE-2020-11463

An issue was discovered in Deskpro before 2019.8.0. The /api/emailaccounts endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve cleartext credentials of all helpdesk email accounts, including incoming and outgoing email credentials. This enables an attacker to...

Millions of Guests Impacted in Marriott Data Breach, Again

For the second time in two years, the Marriott hotel empire has suffered a major data breach. This time, approximately 5.2 million guests have been affected. The attack was carried out via third-party software that Marriott’s hotel properties use to provide guest services, according to an online...

CVE-2019-18818

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js...

Telus Actiontec T2200H Serial Number Information Disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Device Details Vendor: Actiontec Telus Branded, but may work on others Model: T2200H Affected Firmware: T2200H-31.128L.08 Device Manual: http://static.telus.com/common/cms/files/internet/telust2200husermanu al.pdf Reported: Sept 2018 CVE: Not needed...

CVE-2018-10633

Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100 utilizes hard-coded credentials that may allow an attacker to reset passwords for the controller...

First things first: Envisioning your security deployment

This blog post is part of a series that responds to common questions we receive from customers about deployment of Microsoft 365 Security solutions. In this series youll find context, answers, and guidance for deployment and driving adoption within your organization. Check out our last blog...

CVE-2018-7195

Enhancesoft osTicket before 1.10.2 allows remote attackers to reset arbitrary passwords when an associated e-mail address is known by leveraging guest access and guessing a 6-digit number...

Debian: Security Advisory (DLA-933-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Friend's Home App Has Logic Design Flaws

Friends Home App is a social B&B platform based on acquaintance relationship. There is a logical design vulnerability in the Friend's Home APP, which can be exploited by an attacker to register arbitrary accounts and reset account passwords, leading to account abuse and consumption of service...

Shanghai HOLLOW Investment Management Co., Ltd APP - HOLLOW Financial has arbitrary number login vulnerability

HOLLOW FINANCE APP is an investment and financing mobile app. Shanghai HaoLu Investment Management Co. HaoLu Financial APP has an arbitrary number login vulnerability, the vulnerability is due to the program failed to limit the number of times the verification code is sent and the valid time. An...

Tripwire IP360 VnE Manager Security Bypass Vulnerability

The Tripwire formerly known as nCircle IP360 VnE Manager is an IT asset management appliance from Tripwire USA. A security vulnerability exists in the RPC service in Tripwire IP360 VnE Manager version 7.2.2 prior to 7.2.6. A remote attacker can exploit the vulnerability with the help of specially...

Information Leakage Vulnerability in CTG's EZH Mobile APP

EZHI Mobile AP is a one-stop human resources services handheld application platform, covering personnel services, health management, flexible benefits and other business areas, providing online human resources services for registered users and the employees they serve. There is an information...

Logic design flaws in the Journey Dot Dot Dot app

Journey dot app is a train travel service software. A logical design vulnerability exists in the JourneyPoint app. An attacker can register any account, reset any password and perform unauthorized operations by capturing packets and blasting CAPTCHA...

Walker Live app has a logic design flaw

Walker Live app is a video and audio playback software. There is a logic design vulnerability in the Walker Live app. Attackers can use the vulnerability to perform arbitrary user registration, arbitrary password reset operations...

Brush Bracelet App Has Design Logic Flaws

The Brush Bracelet app is a smart wearable device app. There is a design logic vulnerability in Brush Bracelet app. An attacker can exploit the vulnerability to perform arbitrary user registration and arbitrary password reset operations...

Microsoft Azure Active Directory Connect Remote Elevation of Privilege Vulnerability

Microsoft Azure Active Directory Connect is a service from Microsoft that provides identity and access management in the cloud. A privilege-lifting vulnerability exists in Microsoft Azure Active Directory Connect versions prior to 1.1.553.0. An attacker could exploit the vulnerability to reset...

Password Resets Across Zones

cloudfoundry-identity-server is vulnerable to unauthorized password resets. Privileged users in one zone are able to reset passwords for users in a separate zone...

FreeBSD : roundcube -- arbitrary password resets (bce47c89-4d3f-11e7-8080-a4badb2f4699)

Roundcube reports : Roundcube Webmail allows arbitrary password resets by authenticated users. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and packa...

[SECURITY] [DSA 3870-1] wordpress security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3870-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 01, 2017 https://www.debian.org/security/faq -...