CVE-2019-20062

MFScripts YetiShare v3.5.2 through v4.5.4 might allow an attacker to reset a password by using a leaked hash the hash never expires until used...

Endless Group: Modify Host Header which is sent to email

Summary: Modify host header and include the fake website in password reset email. Password reset mail is taking source domain from request header host, which can be modified using burp suite and the modified link is sent to the victims email Steps To Reproduce: 1. Go to...

AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset) Vulnerability

Exploit for jsp platform in category web applications Exploit Title: AVideo Platform 8.1 - Cross Site Request Forgery Password Reset Exploit Author: Ihsan Sencan Vendor Homepage: https://avideo.com Software Link: https://github.com/WWBN/AVideo Version: 8.1 Tested on: Linux CVE: N/A POC: 1...

AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)

AVideo Platform 8.1 - Cross Site Request Forgery Password Reset Exploit Title: AVideo Platform 8.1 - Cross Site Request Forgery Password Reset Dork: N/A Date: 2020-02-05 Exploit Author: Ihsan Sencan Vendor Homepage: https://avideo.com Software Link: https://github.com/WWBN/AVideo Version: 8.1...

AVideo Platform 8.1 Cross Site Request Forgery

Exploit Title: AVideo Platform 8.1 - Cross Site Request Forgery Password Reset Dork: N/A Date: 2020-02-05 Exploit Author: Ihsan Sencan Vendor Homepage: https://avideo.com Software Link: https://github.com/WWBN/AVideo Version: 8.1 Tested on: Linux CVE: N/A POC: 1...

AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)

Exploit Title: AVideo Platform 8.1 - Cross Site Request Forgery Password Reset Dork: N/A Date: 2020-02-05 Exploit Author: Ihsan Sencan Vendor Homepage: https://avideo.com Software Link: https://github.com/WWBN/AVideo Version: 8.1 Tested on: Linux CVE: N/A POC: 1...

CVE-2019-15612

A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset...

CVE-2019-15612

A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset...

Design/Logic Flaw

A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset...

CVE-2019-15612

Nextcloud Server 15.0.2 is affected by CVE-2019-15612, where 2FA sessions are not properly expired after a user password reset. The issue is described as a bug in Nextcloud Server 15.0.2 that leaves pending 2FA logins active after password changes. Public references include the NVD entry and the ...

CVE-2019-15612

A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset...

CVE-2012-5618

Ushahidi before 2.6.1 has insufficient entropy for forgot-password tokens...

CVE-2012-5686

ZPanel 10.0.1 has insufficient entropy for its password reset process...

Design/Logic Flaw

ZPanel 10.0.1 has insufficient entropy for its password reset process...

CVE-2012-5686

CVE-2012-5686 affects ZPanel 10.0.1 and is caused by insufficient entropy in the password reset process. The Red Hat and NVD entries, as well as related advisories, consistently describe the issue as a password-reset entropy weakness in ZPanel 10.0.1. Documented impact is high/critical depending ...

CVE-2012-5686

ZPanel 10.0.1 has insufficient entropy for its password reset process...

Privilege Escalation

github.com/goharbor/harbor is vulnerable to privilege escalation. The API call to update user profile is not validated, allowing an attacker to modify the email address of another user and subsequently perform a successful password reset to gain access to that user's account...

Cups Easy 1.0 Cross Site Request Forgery

Title: Cups Easy 1.0 - Cross Site Request Forgery Password Reset Date: 2020-01-28 Exploit Author: J3rryBl4nks Vendor Homepage: https://sourceforge.net/u/ajayshar76/profile/ Software Link: https://sourceforge.net/projects/cupseasy/files/cupseasylive-1.0/ Version: 1.0 Tested on Windows 10/Kali...

Cups Easy 1.0 - Cross Site Request Forgery (Password Reset)

Title: Cups Easy 1.0 - Cross Site Request Forgery Password Reset Date: 2020-01-28 Exploit Author: J3rryBl4nks Vendor Homepage: https://sourceforge.net/u/ajayshar76/profile/ Software Link: https://sourceforge.net/projects/cupseasy/files/cupseasylive-1.0/ Version: 1.0 Tested on Windows 10/Kali...

Cups Easy 1.0 - Cross Site Request Forgery (Password Reset)

Cups Easy 1.0 - Cross Site Request Forgery Password Reset Title: Cups Easy 1.0 - Cross Site Request Forgery Password Reset Date: 2020-01-28 Exploit Author: J3rryBl4nks Vendor Homepage: https://sourceforge.net/u/ajayshar76/profile/ Software Link:...