Slack email asking Android app users to change their passwords

By Deeba Ahmed Android users of the popular chat app Slack have received an email from the company requesting them to reset their password. This is a post from HackRead.com Read the original post: Slack email asking Android app users to change their passwords...

Advantech iView UserServlet SQL Injection Privilege Escalation Vulnerability

This vulnerability allows remote attackers to escalate privileges on affected installations of Advantech iView. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the UserServlet class. The issu...

Kartpay: Host Header Injection

Summary: Hello Team, While performing security testing on your Main Domain, I found a Host Header Injection Vulnerability. Vulnerability Description: An attacker can manipulate the Host header as seen by the web application and cause the application to behave in unexpected ways. Very often multip...

Logic flaws exist in ezOFFICE Collaborative Management Platform of Beijing Wando Network Technology Co.

ezOFFICE collaborative management platform is a comprehensive information base application platform. There is a logic flaw vulnerability in the ezOFFICE Collaborative Management Platform of Beijing Wando Network Technology Co. Ltd, which can be exploited by an attacker to reset a user's password...

New Relic: Account Takeover via Email ID Change and Forgot Password Functionality

@dsdh discovered an issue with the email change flow, where emails would be sent to the new email address prior to that address being verified. An attacker could have abused this issue to access vulnerable user accounts...

Design/Logic Flaw

oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the checks in /catalog/admin/administrators.php and /catalog/passwordreset.php...

Using the Manager Attribute in Active Directory (AD) for Password Resets

Creating workflows around verifying password resets can be challenging for organizations, especially since many have shifted work due to the COVID-19 global pandemic. With the numbers of cyberattacks against businesses exploding and compromised credentials often being the culprit, companies have ...

Nextcloud Server Denial of Service Vulnerability

Nextcloud is a set of client-server software for creating file hosting services and using them.Nextcloud Server is the server software. A denial of service vulnerability exists in Nextcloud Server 19 and earlier versions. The vulnerability stems from a checking error. An attacker could exploit th...

osCommerce Security Breach

osCommerce is an open source online shopping e-commerce solution based on the GNUGPL license. A security vulnerability exists in oscommerce v2.3.4.1, which stems from a different password can bypass the catalog administrator administrator .php and catalog password reset...

CVE-2020-8295

A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when resetting the password for a user...

CVE-2020-8295

A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when resetting the password for a user...

Design/Logic Flaw

A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when resetting the password for a user...

CVE-2020-8295

A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when resetting the password for a user...

Default credentials

reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered an invalid token parameter...

CVE-2020-8295

CVE-2020-8295 is a Denial of Service vulnerability in Nextcloud Server (affecting Nextcloud Server 19 and earlier) caused by a wrong check when resetting a user password. Connected advisories confirm the issue is addressed by upgrading Nextcloud to newer releases (notably 19.0.13, 20.0.11, or 21....

CVE-2020-8295

A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when resetting the password for a user...

Nextcloud 资源管理错误漏洞

Nextcloud is a set of client-server software for creating file hosting services and using them.Nextcloud Server is the server software. A denial of service vulnerability exists in Nextcloud Server 19 and earlier versions. The vulnerability stems from a checking error. An attacker could exploit th...

ProjectSend Security Vulnerability

ProjectSend formerly cFTP is a suite of self-hosted applications based on PHP and MySQL. ProjectSend before r1295 suffers from a security vulnerability that incorrectly resets passwords due to faulty business logic...

Sixt GmbH & Co. Autovermietung KG BBP: Cross domain token leakage via Referer header

Summary: The password reset link of user account on critical sixt+ domain/product can be obtained using the page https://www.sixt.com/php/profile/loginorpasswordforgotten. This page requires email address and surname/lastname of the user to send password reset link on email. This link contains th...

OpenMage: CSRF in changing password after using reset password link

Summary: Hey OpenMage, the forgot password page is not protected against CSRF attack which can lead to changing password. Use the below form to test html document.forms0.submit Steps To Reproduce: 1. Go to https://demo.openmage.org/customer/account/forgotpassword/ 2. Enter your email and ask for...