CVE-2014-2050

Cross-site request forgery CSRF vulnerability in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to hijack the authentication of users for requests that reset passwords via a crafted HTTP Host header...

CVE-2014-2050

Cross-site request forgery CSRF vulnerability in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to hijack the authentication of users for requests that reset passwords via a crafted HTTP Host header...

CVE-2014-2050

CVE-2014-2050 affects ownCloud Server versions prior to 5.0.15 and 6.0.x prior to 6.0.2. The vulnerability is a Cross-Site Request Forgery (CSRF) that lets remote attackers hijack a user’s authentication for password-reset requests via a crafted HTTP Host header. Affected component is the web app...

Django Potential account hijack via password reset form

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address that is equal to an existing user's email address after case transformation of Unicode characters would allow an attacker to be sent a password reset token for the matched user...

GHSA-VFQ6-HQ5R-27R6 Django Potential account hijack via password reset form

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address that is equal to an existing user's email address after case transformation of Unicode characters would allow an attacker to be sent a password reset token for the matched user...

CVE-2009-5025

A backdoor aka BMSA-2009-07 was found in PyForum v1.0.3 where an attacker who knows a valid user email could force a password reset on behalf of that user...

CVE-2009-5025

A backdoor aka BMSA-2009-07 was found in PyForum v1.0.3 where an attacker who knows a valid user email could force a password reset on behalf of that user...

CVE-2009-5025

Technical details about CVE-2009-5025 are not publicly available in the provided connected documents. Monitoring for updates is advised.

HashBrown CMS 'postUser' function boost vulnerability

HashBrown CMS is an open source headless content management system CMS. A power lifting vulnerability exists in the 'postUser' function in HashBrown CMS version 1.3.3 and earlier. An attacker can exploit this vulnerability to change the hashed password of an administrator account or reset the...

Nord Security: Password Reset Link Works Multiple Times

Background: Normally, a secure way to handle password reset links is to invalidate the link/token upon usage. Additionally, if multiple reset links are requested, older & unused tokens should also be invalidated i.e., if 2 reset tokens were requested, the 2nd token should be invalid upon your usa...

Arbitrary Password Reset Vulnerability in YNedut Smart Campus Platform (CNVD-2020-12862)

YNedut Smart Campus Platform is an intelligent scheduling software for campus learning developed by Chengdu Enable Technology Co. There is an arbitrary password reset vulnerability in YNedut Smart Campus Platform. An attacker can use the vulnerability to reset the administrator account password...

Matomo Analytics < 3.11.0 User Password Reset Vulnerability

Matomo Analytics before version 3.11.0 has mistakenly changed user passwords to a weak value. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-late...

Debian DSA-4598-1 : python-django - security update

Simon Charette reported that the password reset functionality in Django, a high-level Python web development framework, uses a Unicode case-insensitive query to retrieve accounts matching the email address requesting the password reset. An attacker can take advantage of this flaw to potentially...

Debian: Security Advisory (DSA-4598-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 4598-1] python-django security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4598-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 07, 2020 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4598-1] python-django security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4598-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 07, 2020 https://www.debian.org/security/faq -...

CVE-2019-14837

A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be '[email protected]'...

CVE-2019-14837

A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be '[email protected]'...

Design/Logic Flaw

A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be 'email protected'...

CVE-2019-14837

Keycloak before version 8.0.0 is affected by a logic/identity flaw where the owner of the placeholder.org domain can configure a mail server on that domain and reset a client’s password using only the client name (e.g., [email protected]) to log in. The available public documen...