OS4Ed openSIS Password Reset Multiple SQL injection vulnerabilities

Summary Multiple SQL injection vulnerabilities exist in the password reset functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQL injection. An attacker can send an HTTP request to trigger this vulnerability. Tested Versions OS4Ed openSIS 7.3 Product URLs...

LY Corporation: Password reset by malicious input on air.line.me

Due to the bug in the account verification process in the password reset function of air.line.me, it was possible to change other's passwords if a temporary password reset key was set to a space...

ecshop mall website builder system has a logic flaw vulnerability

Business Pie Software Ltd. is a professional e-commerce service and technology provider. ecshop mall station-building system there are logical flaws vulnerabilities, attackers can modify the user password by bursting the verification code to achieve any password reset effect...

CVE-2015-8033

In Textpattern 4.5.7, the password-reset feature does not securely tether a hash to a user account...

Design/Logic Flaw

In Textpattern 4.5.7, the password-reset feature does not securely tether a hash to a user account...

CVE-2015-8033

In Textpattern 4.5.7, the password-reset feature does not securely tether a hash to a user account...

CVE-2015-8033

The CVE-2015-8033 entry concerns Textpattern 4.5.7, where the password-reset feature does not securely tether a password hash to a user account. The NVD data lists CVSS v3.1 base metrics: 5.3 (Medium) with Network attack vector, Low attack complexity, no privileges required, no user interaction, ...

CVE-2020-9529

Firmware developed by Shenzhen Hichip Vision Technology V6 through V20, as used by many different vendors in millions of Internet of Things devices, suffers from a privilege escalation vulnerability that allows attackers on the local network to reset the device's administrator password. This...

Privilege escalation

Firmware developed by Shenzhen Hichip Vision Technology V6 through V20, as used by many different vendors in millions of Internet of Things devices, suffers from a privilege escalation vulnerability that allows attackers on the local network to reset the device's administrator password. This...

JetBrains Security Bulletin Q2 2020

FYI News Security JetBrains Security Bulletin Q2 2020 Robert Demmer In the second quarter of 2020, we resolved a number of security issues in our products. Here’s a summary report that contains a description of each issue and the version in which it was resolved. Product | Description | Severity ...

CVE-2020-15132

In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the "Forget password" feature on the login screen is used, Sulu asks the user for a username or email address. If the given string is not found, a response with a 400 error code is returned, along with a error message saying that this user...

Arbitrary Password Reset Vulnerability in Digital Integrated Management Platform of Restaurants of Hangzhou Xionwei Technology Development Co.

Founded in 2001, Hangzhou Xionwei Technology Development Co., Ltd. is located in Hangzhou National High-tech Development Zone, which is a national high-tech enterprise and a double-soft enterprise in Zhejiang Province. There is an arbitrary password reset vulnerability in the digitalized integrat...

Courier: Broken Authentication Session Token Bug

Hi Team Hope your are good I have found a broken authentication issue in https://www.trycourier.app Steps to reproduce 1. Create a courier account or use existing one. 2. Confirm Your email address. 3. Now log out from your account and request for password reset code for your account . 4. Don't u...

Nanjing Ironbound Network Technology Co., Ltd. 114 Ticketing APP has logic flaws and vulnerabilities

Nanjing Tiehang Network Technology Co., Ltd, referred to as Tiehang.com, was founded in 2011, the use of IT technology and Internet thinking, the national train tickets online shopping one-stop service, is the domestic train tickets online shopping platform. Nanjing Ironbound Network Technology...

Logic Flaw Vulnerability in Talent Recruitment System of Lian Yi Technology Co.

Lianyi Technology Co., Ltd. provides universities and colleges to provide management, service, teaching, research and other full-scene products and services. A logic flaw exists in the Talent Recruitment System of Lianyi Technology Company Limited, which can be exploited by an attacker to reset a...

Logic Flaw Vulnerability in the Great Practice Series Teaching Management System of Kok Jin Information Technology Ltd.

Kok Jin Information Technology Co., Ltd. is a domestic educational software and informationization service provider. A logic flaw exists in the GJIT Large Practice Series Teaching Management System, which can be exploited by an attacker to reset any user's password...

Twitter Hack Update: What We Know (and What We Don't)

UPDATED 7/18 at 12:50 p.m. ET Earlier this week, Twitter locked down thousands of verified accounts, including the accounts of Joe Biden, Bill Gates, Elon Musk, Apple, Uber and others, after it became clear that hackers had been able to compromise them. The tip-off? Suddenly these high-profile...

Twitter Hacked in Bitcoin Scam

It started with one weird tweet. Then another. Quickly, some of the most prominent accounts on Twitter were all sending out the same message; I am giving back to the community. All Bitcoin sent to the address below will be sent back double! If you send $1,000, I will send back $2,000. Only doing...

ZZCMS has a reinstallation vulnerability

ZZCMS is a free website builder developed in asp language. ZZCMS has a reinstallation vulnerability. An attacker can exploit the vulnerability to reset the administrator username password and so on...

Gener8: Session not invalidated after password reset

After a user performed a password reset, all their active refresh tokens were not invalidated. This could allow an adversary with access to a valid refresh token to regain control of a victim's account, subsequent to a password reset being completed...