The vulnerability of the AD Self Password Reset password reset tool allows a hacker to reset arbitrary passwords.

The vulnerability of the PasswordReset.Controllers.ResetController.ChangePasswordIndex method PasswordReset.dll, a password reset tool for AD Self Password Reset, is related to access control deficiencies. Exploiting this vulnerability could allow an attacker, operating remotely, to reset arbitra...

CVE-2015-0532

EMC RSA Identity Management and Governance IMG 6.9 before P04 and 6.9.1 before P01 does not properly restrict password resets, which allows remote attackers to obtain access via crafted use of the reset process for an arbitrary valid account name, as demonstrated by a privileged account...

BMC Track-It! Web Account Credential Information Disclosure Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of BMC Track-It!. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of password resets. The issue lies in the ability to register an account...

CVE-2012-5508

The error pages in Plone before 4.2.3 and 4.3 before beta 1 allow remote attackers to obtain random numbers and derive the PRNG state for password resets via unspecified vectors. NOTE: this identifier was SPLIT per ADT2 due to different vulnerability types. CVE-2012-6661 was assigned for the PRNG...

Design/Logic Flaw

The error pages in Plone before 4.2.3 and 4.3 before beta 1 allow remote attackers to obtain random numbers and derive the PRNG state for password resets via unspecified vectors. NOTE: this identifier was SPLIT per ADT2 due to different vulnerability types. CVE-2012-6661 was assigned for the PRNG...

PYSEC-2014-50

The error pages in Plone before 4.2.3 and 4.3 before beta 1 allow remote attackers to obtain random numbers and derive the PRNG state for password resets via unspecified vectors. NOTE: this identifier was SPLIT per ADT2 due to different vulnerability types. CVE-2012-6661 was assigned for the PRNG...

CVE-2012-5508

CVE-2012-5508 (and related CVE-2012-6661) affects Zope before 2.13.19 used with Plone older than 4.2.3 and Plone 4.3 beta1. Root cause: PRNG not reseeded, enabling remote attackers to infer PRNG state and potentially abuse password resets via unspecified vectors. Mitigation: upgrade to Zope 2.13....

CVE-2012-5508

The error pages in Plone before 4.2.3 and 4.3 before beta 1 allow remote attackers to obtain random numbers and derive the PRNG state for password resets via unspecified vectors. NOTE: this identifier was SPLIT per ADT2 due to different vulnerability types. CVE-2012-6661 was assigned for the PRNG...

PT-2014-2335 · Plone · Plone

Name of the Vulnerable Software and Affected Versions: Plone versions prior to 4.2.3 Plone versions 4.3 prior to beta 1 Description: The issue allows remote attackers to obtain random numbers and derive the PRNG state for password resets. This could potentially be used to gain unauthorized access...

Attackers Target Yahoo Mail Accounts in 'Coordinated Effort' to Own Users

After years of focusing their attention on Gmail, it seems that attackers have finally gotten around to expending some effort hacking Yahoo mail accounts. Yahoo officials said Thursday that they have reset the passwords on an unspecified number of mail accounts after detecting what they call a...

CVE-2013-0233

Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass...

SourceForge Detects Targeted Attack, Resets Millions of Passwords !

Last week, accessible antecedent computer application development and administration ability SourceForge the ambition of a directed attack. Once the advance was detected, the aggregation bound bottom ward the impacted hosts to abate the accident of accretion to added hosts. Thus, this prevented...

Ubuntu Update for eucalyptus vulnerability USN-1033-1

Ubuntu Update for Linux kernel vulnerabilities USN-1033-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN10331.nasl 7964 2017-12-01 07:32:11Z santu $ Ubuntu Update for eucalyptus vulnerability USN-1033-1 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH,...

Nagios XI - Multiple Cross-Site Request Forgery Vulnerabilities

Nagios XI - Multiple Cross-Site Request Forgery Vulnerabilities source: https://www.securityfocus.com/bid/42322/info Nagios XI is prone to multiple cross-site request-forgery vulnerabilities because the application fails to properly validate HTTP requests. Successful exploit requires that the...

FreeBSD : joomla -- flaw in the reset token validation (8514b6e7-6f0f-11dd-b3db-001c2514716c)

Joomla project reports : A flaw in the reset token validation mechanism allows for non-validating tokens to be forged. This will allow an unauthenticated, unauthorized user to reset the password of the first enabled user lowest id. Typically, this is an administrator user. Note, that changing the...