CVE-2019-10270

Affected software: WordPress Ultimate Member plugin. Vulnerable component: password reset flow in Ultimate Member (versions around 2.39; OpenVAS references

PT-2019-11674 · WordPress · Ultimate Member

Name of the Vulnerable Software and Affected Versions: Ultimate Member plugin version 2.39 for WordPress Description: An issue was discovered in the password reset functionality, allowing an attacker to reset the password of another user without proper verification. This is possible because the...

CVE-2019-2018

In resetPasswordInternal of DevicePolicyManagerService.java, there is a possible bypass of password reset protection due to an unusual root cause. Remote user interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9Android ID: A-110172241...

Design/Logic Flaw

In resetPasswordInternal of DevicePolicyManagerService.java, there is a possible bypass of password reset protection due to an unusual root cause. Remote user interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9Android ID: A-110172241...

CVE-2019-2018

In resetPasswordInternal of DevicePolicyManagerService.java, there is a possible bypass of password reset protection due to an unusual root cause. Remote user interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9Android ID: A-110172241...

CVE-2019-2018

CVE-2019-2018 affects Android devices via a bypass in resetPasswordInternal in DevicePolicyManagerService.java. The vulnerability allows bypass of password reset protection, with remote exploitation requiring user interaction. Affected Android versions are 8.1 and 9. The issue is documented in th...

CVE-2019-19908

phpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaScript injection into the password reset URL. In the URL, the pmcusername parameter to passreset.php is vulnerable. Recent assessments: cinzinga at March 09, 2020 9:23pm UTC reported: I am the founder of this exploit. Google dorking...

Arido Instant Messenger has a flawed logic vulnerability

Yudu Instant Messenger is an enterprise-grade instant messaging platform. A logic flaw vulnerability exists in Yudu Instant Messenger. An attacker bypasses local detection by modifying the HOST header in the HTTP request packet to localhost, resulting in a remote reset of the administrator passwo...

Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability

ManageEngine ADSelfService Plus is a web-based self-service application that enables end-users to perform tasks such as password reset, account unlock, profile information update, etc. without relying on a help desk. An authentication bypass vulnerability exists in the password reset feature of...

CVE-2019-12476

An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser. The attack uses a long sequence of crafted keyboa...

Authentication flaw

An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser. The attack uses a long sequence of crafted keyboa...

CVE-2019-12476

Zoho ManageEngine ADSelfService Plus prior to version 5.0.6 contains an authentication bypass in the password-reset flow that enables a local attacker with physical access to obtain a SYSTEM shell via the restricted thick client browser by supplying a crafted sequence of keyboard input. The issue...

CVE-2019-12476

An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser. The attack uses a long sequence of crafted keyboa...

MyBB <= 1.8.19 Multiple Vulnerabilities

MyBB is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mybb:mybb"; ifdescription...

Design/Logic Flaw

An issue was discovered in MISP 2.4.108. Organization admins could reset credentials for site admins organization admins have the inherent ability to reset passwords for all of their organization's users. This, however, could be abused in a situation where the host organization of an instance...

Exploit for Weak Password Recovery Mechanism for Forgotten Password in Zohocorp Manageengine_Adselfservice_Plus

ADSelfService-Plus-PoC CVE-2019-12476 ADSelfService Plus versi...

CVE-2019-3578

MyBB 1.8.19 has XSS in the resetpassword function...

CVE-2019-3579

MyBB 1.8.19 allows remote attackers to obtain sensitive information because it discloses the username upon receiving a password-reset request that lacks the code parameter...

CVE-2019-3579

MyBB 1.8.19 allows remote attackers to obtain sensitive information because it discloses the username upon receiving a password-reset request that lacks the code parameter...

CVE-2019-3579

Summary : CVE-2019-3579 affects MyBB 1.8.19, where a password-reset request that omits the code parameter discloses the username, enabling information disclosure. This is a server-side information leak in the password-reset flow that does not require authentication. The vulnerability is documente...