Equifax-vdp: RXSS on https://equifax.gr8people.com on Password Reset page in the username parameter

Hello, While testing your program i came across a website that is owned by informatica and is vulnerable to RXSS on Password Reset page in the username parameter POC:...

CVE-2021-27654

Forgotten password reset functionality for local accounts can be used to bypass local authentication checks...

CVE-2021-27654

Forgotten password reset functionality for local accounts can be used to bypass local authentication checks...

CVE-2021-27654

Forgotten password reset functionality for local accounts can be used to bypass local authentication checks...

CVE-2016-3735

Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmtrand in order to generate password reset tokens. mtrand output can be predicted after recovering the seed used to generate it. This low an unauthenticated attacker to take over an...

CVE-2016-3735

Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmtrand in order to generate password reset tokens. mtrand output can be predicted after recovering the seed used to generate it. This low an unauthenticated attacker to take over an...

Design/Logic Flaw

Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmtrand in order to generate password reset tokens. mtrand output can be predicted after recovering the seed used to generate it. This low an unauthenticated attacker to take over an...

CVE-2021-27654

CVE-2021-27654 affects Pegasystems Pega. The vulnerability arises from a forgotten password reset functionality for local accounts that can bypass local authentication checks. Public data shows CVSS details: CVSS v3.1 base score 7.8 (HIGH) with LOCAL access, LOW attack complexity, privileges requ...

CVE-2021-27654

Forgotten password reset functionality for local accounts can be used to bypass local authentication checks...

CVE-2016-3735

CVE-2016-3735 affects Piwigo, a PHP-based image gallery. The root issue is that when a host criteria is not met, Piwigo uses mt_rand to generate password reset tokens, and the output can be predicted once the seed is known. This enables an unauthenticated attacker who knows an administrator’s ema...

CVE-2016-3735

Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmtrand in order to generate password reset tokens. mtrand output can be predicted after recovering the seed used to generate it. This low an unauthenticated attacker to take over an...

Pegasystems Pega 授权问题漏洞

Pegasystems Pega is a Java-based business process management tool from the U.S. company Pegasystems. It is used to build enterprise applications. A security vulnerability exists in Pegasystems Pega, which stems from a forgotten password reset feature for local accounts that can be used to bypass...

Construction Industry Solutions Conis Construction Cloud Input Validation Error Vulnerability (CNVD-2022-10773)

Construction Industry Solutions Conis Construction Cloud is an end-to-end cloud and mobile software solution from Construction Industry Solutions, Inc. Construction Industry Solutions Conis Construction Cloud is vulnerable to an input validation error that could be exploited by an attacker to cau...

VulnCheck KEV: CVE-2017-8295

WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to...

CVE-2021-45226

An issue was discovered in COINS Construction Cloud 11.12. Due to improper validation of user-controlled HTTP headers, attackers can cause it to send password-reset e-mails pointing to arbitrary websites...

CVE-2021-45226

An issue was discovered in COINS Construction Cloud 11.12. Due to improper validation of user-controlled HTTP headers, attackers can cause it to send password-reset e-mails pointing to arbitrary websites...

CVE-2021-45226

An issue was discovered in COINS Construction Cloud 11.12. Due to improper validation of user-controlled HTTP headers, attackers can cause it to send password-reset e-mails pointing to arbitrary websites...

Input validation

An issue was discovered in COINS Construction Cloud 11.12. Due to improper validation of user-controlled HTTP headers, attackers can cause it to send password-reset e-mails pointing to arbitrary websites...

CVE-2021-45226

An issue was discovered in COINS Construction Cloud 11.12. Due to improper validation of user-controlled HTTP headers, attackers can cause it to send password-reset e-mails pointing to arbitrary websites...

CVE-2021-45226

CVE-2021-45226 affects COINS Construction Cloud 11.12. The root cause is improper validation of user-controlled HTTP headers, which can cause the system to send password-reset emails to arbitrary websites. This creates risk of phishing/credential misuse via misdirected password resets. The vulner...