CVE-2020-15849

Re:Desk 2.3 has a blind authenticated SQL injection vulnerability in the SettingsController class, in the actionEmailTemplates method. A malicious actor with access to an administrative account could abuse this vulnerability to recover sensitive data from the application's database, allowing for...

CVE-2020-26163

BigBlueButton Greenlight before 2.5.6 allows HTTP header Host and Origin attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link...

CVE-2020-19670

In Niushop B2B2C Multi-Business Basic Edition V1.11, authentication can be bypassed, causing administrators to reset any passwords...

CVE-2018-5354

The custom GINA/CP module in ANIXIS Password Reset Client before version 3.22 allows remote attackers to execute code and escalate privileges via spoofing. When the client is configured to use HTTP, it does not authenticate the intended server before opening a browser window. An unauthenticated...

CVE-2018-5354

The custom GINA/CP module in ANIXIS Password Reset Client before version 3.22 allows remote attackers to execute code and escalate privileges via spoofing. When the client is configured to use HTTP, it does not authenticate the intended server before opening a browser window. An unauthenticated...

Design/Logic Flaw

BigBlueButton Greenlight before 2.5.6 allows HTTP header Host and Origin attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link...

CVE-2020-19670

In Niushop B2B2C Multi-Business Basic Edition V1.11, authentication can be bypassed, causing administrators to reset any passwords...

CVE-2018-5354

The CVE-2018-5354 entry affects ANIXIS Password Reset Client (GINA/CP module) before v3.22. The flaw allows remote code execution and privilege escalation through spoofing when HTTP is used, as the client fails to authenticate the server before opening a browser window, enabling a spoofing attack...

CVE-2018-5354

The custom GINA/CP module in ANIXIS Password Reset Client before version 3.22 allows remote attackers to execute code and escalate privileges via spoofing. When the client is configured to use HTTP, it does not authenticate the intended server before opening a browser window. An unauthenticated...

PT-2020-8929

Name of the Vulnerable Software and Affected Versions ANIXIS Password Reset Client versions prior to 3.22 Description The issue allows remote attackers to execute code and escalate privileges via spoofing. When the client is configured to use HTTP, it does not authenticate the intended server...

Ubuntu: Security Advisory (USN-4536-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4536-1: SPIP vulnerabilities

Youssouf Boulouiz discovered that SPIP incorrectly handled login error messages. A remote attacker could potentially exploit this to conduct cross-site scripting XSS attacks. CVE-2019-16392 Gilles Vincent discovered that SPIP incorrectly handled password reset requests. A remote attacker could...

USN-4536-1 spip vulnerabilities

Youssouf Boulouiz discovered that SPIP incorrectly handled login error messages. A remote attacker could potentially exploit this to conduct cross-site scripting XSS attacks. CVE-2019-16392 Gilles Vincent discovered that SPIP incorrectly handled password reset requests. A remote attacker could...

A Successful Self-Service Password Reset (SSPR) Project Requires User Adoption

IT help desks everywhere are having to adjust to the 'new normal' of supporting mainly remote workers. This is a major shift away from visiting desks across the office and helping ones with traditional IT support processes. Many reasons end-users may contact the helpdesk. However, password relate...

A Successful Self-Service Password Reset (SSPR) Project Requires User Adoption

IT help desks everywhere are having to adjust to the 'new normal' of supporting mainly remote workers. This is a major shift away from visiting desks across the office and helping ones with traditional IT support processes. Many reasons end-users may contact the helpdesk. However, password relate...

Arbitrary Password Reset Vulnerability in ZLAN7144N2 at Shanghai Zoran Information Technology Co.

Shanghai Joran Information Technology Co., Ltd. is a high-tech enterprise providing industrial IoT solutions, founded in 2008, with products including: Serial Server, IoT Chip, Serial to Ethernet and so on. Shanghai Zoran Information Technology Co., Ltd ZLAN7144N2 suffers from an arbitrary passwo...

openSIS SQL Injection Vulnerability (CNVD-2020-50955)

openSIS is a free, open source student information system/school management software. A SQL injection vulnerability exists in the usernamestfemail parameter in the password reset page /opensis/ResetUserInfo.php in OS4Ed openSIS 7.3, which can be exploited by an attacker to obtain information by...

openSIS SQL Injection Vulnerability (CNVD-2020-50953)

openSIS is a free, open source student information system/school management software. A SQL injection vulnerability exists in the passwordstfemail parameter in the password reset page /opensis/ResetUserInfo.php in OS4Ed openSIS 7.3, which can be exploited by an attacker to obtain information by...

openSIS SQL Injection Vulnerability (CNVD-2020-50954)

openSIS is a free, open source student information system/school management software. A SQL injection vulnerability exists in the uname parameter in the password reset page /opensis/ResetUserInfo.php in OS4Ed openSIS 7.3, which can be exploited by an attacker to obtain information by sending an...

openSIS SQL Injection Vulnerability (CNVD-2020-50956)

openSIS is a free, open source student information system/school management software. A SQL injection vulnerability exists in the passwordstfemail parameter in the password reset page /opensis/ResetUserInfo.php in OS4Ed openSIS 7.3, which can be exploited by an attacker to obtain information by...