366 matches found
CVE-2016-9450
The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context...
InvoicePlane Password Reset Vulnerability
InvoicePlane is a free and open source goods billing and customer management software. A password reset vulnerability exists in the index.php/sessions/passwordreset page of InvoicePlane version 1.4.8, which can be exploited by an attacker to reset the password of any user...
BMC Software BladeLogic Server Automation Suite RSCD Agent Password Reset Vulnerability
BMC Software BladeLogic Server Automation Suite is a solution for managing the lifecycle of servers and applications from BMC Software, USA. A password reset vulnerability exists in the RSCD Agent of the BMC Software BladeLogic Server Automation Suite for Linux and Unix platforms. A remote attack...
The vulnerability of the AD Self Password Reset password reset tool allows a hacker to reset arbitrary passwords.
The vulnerability of the PasswordReset.Controllers.ResetController.ChangePasswordIndex method PasswordReset.dll, a password reset tool for AD Self Password Reset, is related to access control deficiencies. Exploiting this vulnerability could allow an attacker, operating remotely, to reset arbitra...
Drupal Patches Critical Password-Reset Vulnerability
Drupal, one of the widely used open source content management system is recommending its users to update their software to the latest versions 6.35 and 7.35 after the company discovered two moderately critical vulnerabilities that may allow an attacker to hack Drupal websites. According to a...
Vimeo: CSRF bypass
Dear Team, Once again i'm here. During research of vimeo.com I found that you are using anti-csrf token against csrf attack. but it's not going to validate on server side. let's see Step 1: go to https://vimeo.com/forgotpassword Step 2: write your email and click on help me. Step 3: Now before...
Hacking Gmail accounts with password reset system vulnerability
Oren Hafif, a security researcher has discovered a critical vulnerability in the Password reset process of Google account that allows an attacker to hijack any account. He managed to trick Google users into handing over their passwords via a simple spear-phishing attack by leveraging a number of...
Cisco TelePresence VX Clinical Assistant WIL-A Module Reboot Admin Password Removal
Cisco TelePresence VX Clinical Assistant is affected by a password reset vulnerability. The WIL-A module causes the administrative password to be reset to a blank password every time the device is rebooted. This plugin attempts to authenticate to the device using the username 'admin' and a blank...
CVE-2012-1598
Joomla! 1.5.x before 1.5.26 has unspecified impact and attack vectors related to "insufficient randomness" and a "password reset vulnerability."...
CVE-2012-1598
CVE-2012-1598 affects Joomla! 1.5.x before 1.5.26, with an unspecified impact related to insufficient randomness and a password reset vulnerability. Connected sources confirm the existence of these issues but do not provide concrete exploit details or remediation in the available documents. No ex...
[20120305] - Core - Password Change
Insufficient randomness leads to password reset vulnerability...
CVE-2010-3273
ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allows remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, by providing a user id to accounts/ValidateUser, and then providing a new password to accounts/ResetResult...
Design/Logic Flaw
Anantasoft Gazelle CMS 1.0 allows remote attackers to conduct a password reset for other users via a modified user parameter to renew.php...
2Wire Cross-Site Request Forgery Password Reset Vulnerability
This module will reset the admin password on a 2Wire wireless router. This is done by using the /xslt page where authentication is not required, thus allowing configuration changes such as resetting the password as administrators. Module Options msf use auxiliary/admin/2wire/xslt/passwordreset ms...
IBM WebSphere Commerce ResetPassword Servlet Caching Information Disclosure
The remote host is running a version of IBM WebSphere Commerce that may allow an attacker to conduct a brute-force attack against users who have recently had their passwords invalidated in WebSphere Commerce and uncover private information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...
[Full-Disclosure] DSL router Prestige 650HW-31
Hi, have not much time so here is the thing... There's a bug in the DSL router Prestige 650HW-31, you just post a long string as password and the router resets it self so is very easy to make a DNS to this router if people doesnt have the aproppiate filters on port 80 I didnt tried on Telnet. Thi...
cPanel 5/6/7/8/9 - Resetpass Remote Command Execution
source: https://www.securityfocus.com/bid/9848/info A potential remote command execution vulnerability has been discovered in the cPanel Application. This issue occurs due to insufficient sanitization of externally supplied data to the script that handles resetting user passwords. An attacker may...
dcpportal.txt
From: Lifo Fifo To: [email protected] Subject: DCP Portal - 5.5 holes Never use this product if you have turned off magicquotesgpc. And this product won't work anyway if you have turned off registerglobals. All the files in the product, dont check for integrity of variables. You can easil...