VulnCheck KEV: CVE-2022-28810

Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset...

CVE-2022-22572

A non-admin user with user management permission can escalate his privilege to admin user via password reset functionality. The vulnerability affects Incapptic Connect version 1.40.1...

CVE-2022-22572

A non-admin user with user management permission can escalate his privilege to admin user via password reset functionality. The vulnerability affects Incapptic Connect version 1.40.1...

CVE-2022-22572

A non-admin user with user management permission can escalate his privilege to admin user via password reset functionality. The vulnerability affects Incapptic Connect version 1.40.1...

Spoofing

A non-admin user with user management permission can escalate his privilege to admin user via password reset functionality. The vulnerability affects Incapptic Connect version 1.40.1...

CVE-2022-22572

CVE-2022-22572 affects Incapptic Connect

CVE-2022-22572

A non-admin user with user management permission can escalate his privilege to admin user via password reset functionality. The vulnerability affects Incapptic Connect version 1.40.1...

An unspecified vulnerability exists in livehelperchat (CNVD-2022-55057)

livehelperchat is available via Live Assistant Chat, which provides free live support on the website. livehelperchat versions prior to 3.97 have a security vulnerability that could be exploited by attackers to generate a fake password reset link to steal a password reset token, which could lead t...

Incapptic Connect 安全漏洞

Incapptic Connect is an application plugin. A security vulnerability exists in Incapptic Connect version 1.40.1, which originates from a non-administrative user with user management privileges being able to elevate their privileges to an administrator user via the password reset feature...

PT-2022-15535 · Unknown · Incapptic Connect

Name of the Vulnerable Software and Affected Versions: Incapptic Connect versions prior to 1.40.1 Description: A non-admin user with user management permission can escalate their privilege to an admin user via the password reset functionality. Recommendations: For versions prior to 1.40.1, update...

Host Header Injection

remdex/livehelperchat is vulnerable to host header injection. The library does not properly validate the URL for password reset which allows a malicious attacker to generate a fake password link and take over the user account...

CVE-2022-0935

Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97...

CVE-2022-0935

Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97...

Design/Logic Flaw

Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97...

CVE-2022-0935

CVE-2022-0935 affects livehelperchat/livehelperchat prior to 3.97 and is caused by Host Header injection in the password reset flow. Multiple sources (NVD, Red Hat, OSV, CNVD, PT-Security, CNVD) describe an attacker abusing header handling to forge or manipulate password reset tokens, potentially...

CVE-2022-0935 Host Header injection in password Reset in livehelperchat/livehelperchat

Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97...

CVE-2022-0935 Host Header injection in password Reset in livehelperchat/livehelperchat

Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97...

PT-2022-13536 · Unknown · Livehelperchat

Name of the Vulnerable Software and Affected Versions: livehelperchat/livehelperchat versions prior to 3.97 Description: The issue concerns a Host Header injection in the password reset functionality. This problem is associated with the GitHub repository livehelperchat/livehelperchat...

identify registered user

Description There is a response during password reset which allow to identify if email address is registered or not Proof of Concept 1. Signup to https://cloud.heroiclabs.com/ using a email like [email protected] . \ 2. Now goto https://cloud.heroiclabs.com/recover and put a dummy email address...

GitLab Releases Patch for Critical Vulnerability That Could Let Attackers Hijack Accounts

DevOps platform GitLab has released software updates to address a critical security vulnerability that, if potentially exploited, could permit an adversary to seize control of accounts. Tracked as CVE-2022-1162, the issue has a CVSS score of 9.1 and is said to have been discovered internally by t...