8183 matches found
CVE-2020-9270
ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via service.php...
Cross site request forgery (csrf)
ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via service.php...
CVE-2020-9270
CVE-2020-9270 affects Ice Hrm 26.2.0, where a Cross-Site Request Forgery (CSRF) vulnerability enables a password reset via the service.php endpoint. The available connected records confirm IceHrm 26.2.0 is the affected version and describe the flaw as CSRF leading to unintended password resets; n...
CVE-2020-9270
ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via service.php...
Nord Security: Password Reset Link not expiring after changing the email Leads To Account Takeover
The researcher has identified an issue in our password reset workflow where the password reset URL was not expiring correctly after the user has requested a password change 1 Go to this website : https://ucp.nordvpn.com/lost-password 2 Enter your main account [email protected] 3 Go to [email protected]...
CVE-2019-20062
MFScripts YetiShare v3.5.2 through v4.5.4 might allow an attacker to reset a password by using a leaked hash the hash never expires until used...
CVE-2019-20062
MFScripts YetiShare v3.5.2 through v4.5.4 might allow an attacker to reset a password by using a leaked hash the hash never expires until used...
CVE-2019-20060
MFScripts YetiShare v3.5.2 through v4.5.4 places sensitive information in the Referer header. If this leaks, then third parties may discover password-reset hashes, file-delete links, or other sensitive information...
Default credentials
MFScripts YetiShare v3.5.2 through v4.5.4 places sensitive information in the Referer header. If this leaks, then third parties may discover password-reset hashes, file-delete links, or other sensitive information...
Default credentials
MFScripts YetiShare v3.5.2 through v4.5.4 might allow an attacker to reset a password by using a leaked hash the hash never expires until used...
CVE-2019-20060
MFScripts YetiShare v3.5.2 through v4.5.4 places sensitive information in the Referer header. If this leaks, then third parties may discover password-reset hashes, file-delete links, or other sensitive information...
CVE-2019-20062
The CVE-2019-20062 vulnerability affects MFScripts YetiShare versions 3.5.2 through 4.5.4, where an attacker can reset a user password by leveraging a leaked hash that does not expire until used. The available connected documents (Red Hat advisory and NVD listing) confirm the affected product ran...
CVE-2019-20062
MFScripts YetiShare v3.5.2 through v4.5.4 might allow an attacker to reset a password by using a leaked hash the hash never expires until used...
Endless Group: Modify Host Header which is sent to email
Summary: Modify host header and include the fake website in password reset email. Password reset mail is taking source domain from request header host, which can be modified using burp suite and the modified link is sent to the victims email Steps To Reproduce: 1. Go to...
AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset) Vulnerability
Exploit for jsp platform in category web applications Exploit Title: AVideo Platform 8.1 - Cross Site Request Forgery Password Reset Exploit Author: Ihsan Sencan Vendor Homepage: https://avideo.com Software Link: https://github.com/WWBN/AVideo Version: 8.1 Tested on: Linux CVE: N/A POC: 1...
AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)
AVideo Platform 8.1 - Cross Site Request Forgery Password Reset Exploit Title: AVideo Platform 8.1 - Cross Site Request Forgery Password Reset Dork: N/A Date: 2020-02-05 Exploit Author: Ihsan Sencan Vendor Homepage: https://avideo.com Software Link: https://github.com/WWBN/AVideo Version: 8.1...
AVideo Platform 8.1 Cross Site Request Forgery
Exploit Title: AVideo Platform 8.1 - Cross Site Request Forgery Password Reset Dork: N/A Date: 2020-02-05 Exploit Author: Ihsan Sencan Vendor Homepage: https://avideo.com Software Link: https://github.com/WWBN/AVideo Version: 8.1 Tested on: Linux CVE: N/A POC: 1...
AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)
Exploit Title: AVideo Platform 8.1 - Cross Site Request Forgery Password Reset Dork: N/A Date: 2020-02-05 Exploit Author: Ihsan Sencan Vendor Homepage: https://avideo.com Software Link: https://github.com/WWBN/AVideo Version: 8.1 Tested on: Linux CVE: N/A POC: 1...