CVE-2021-32648

CVE-2021-32648 affects October CMS (Laravel-based) through the october/system package. An authentication bypass allows an attacker to request a password reset and then take over an account. Patches are available: Build 472 and v1.1.5. Public advisories and CVE trackers consistently describe this ...

CVE-2021-32648 Account Takeover in Octobercms

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5...

MTN Group: Password reset token leak on third party website via Referer header [cloudivr.mtnbusiness.com.ng]

Summary: F1426175 It has been identified that the application is leaking referrer token to third party sites. In this case it was found that the password reset token is being leaked to third party sites which is a issue knowing the fact that it can allow any malicious users to use the token and...

UPchieve: No rate Limit on Password Reset page on upchieve

Summary: Introduction A little bit about Rate Limit: A rate limiting algorithm is used to check if the user session or IP-address has to be limited based on the information in the session cache. In case a client made too many requests within a given timeframe, HTTP-Servers can respond with status...

CVE-2021-32648

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5. Recent...

Octobercms 安全漏洞

Octobercms is a Php-based Cms website builder from the US company Octobercms. A security vulnerability exists in octobercms october, which originates in an affected version of the october/system package, where an attacker can request a reset of an account password and then use a specially crafted...

PT-2021-4044

Name of the Vulnerable Software and Affected Versions: October CMS versions prior to Build 472 and v1.1.5 Description: The issue is related to an improper authentication mechanism in the October CMS platform, which is based on the Laravel PHP Framework. An attacker can exploit this by requesting ...

in circuitverse/circuitverse

✍️ Description no rate limit allow to send unlimited email to any mail address 🕵️‍♂️ Proof of Concept During forgot password there is no rate limit to send password-reset email which allow to send unlimited email to a mail address. bellow request is vulnerable to rate-limit bug POST /users/password...

JetBrains Hub Licensing Issue Vulnerability (CNVD-2022-09225)

JetBrains Hub is a web-based application from JetBrains Czech Republic. The application is able to integrate multiple JetBrains team tools together. An authorization issue vulnerability exists in versions prior to JetBrains Hub 2021.1.13402, which stems from the fact that it is possible for the...

Insecure Password Reset Functionality

dolibarr/dolibarr uses an insecure password reset functionality. An attacker is able to reset the password of any user via the forgotten password functionality...

CVE-2021-25957

In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password...

CVE-2021-25957

In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password...

CVE-2021-25957

In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password...

UBUNTU-CVE-2021-25957

In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password...

Default credentials

In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password...

CVE-2021-25957

Dolibarr is affected in versions 2.8.1 through 13.0.2 by an account takeover vulnerability tied to the password reset flow. A low-privilege attacker can reset another user’s password by using the password reset link delivered to the user via email when a forgotten-password request is made. The co...

CVE-2021-25957 Account Takeover in "Dolibarr" via Password Reset Functionality

In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password...

Dolibarr 授权问题漏洞

Dolibarr is a software application. A modern software package to help manage your organization's activities. A security vulnerability exists in Dolibarr versions v2.8.1 through v13.0.2 that allows a low-privileged attacker to reset the password of any user in the affected application using the...

CVE-2021-24527

The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin will not be notified of such...

CVE-2021-24527

The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin will not be notified of such...