CVE-2019-3579

MyBB 1.8.19 allows remote attackers to obtain sensitive information because it discloses the username upon receiving a password-reset request that lacks the code parameter...

PT-2019-16627 · Mybb · Mybb

Name of the Vulnerable Software and Affected Versions: MyBB version 1.8.19 Description: The issue allows remote attackers to obtain sensitive information. This occurs because the software discloses the username when it receives a password-reset request that lacks the code parameter...

PU Pocket Campus App Exploits Arbitrary Password Reset Vulnerability

PU Pocket Campus APP, developed by Suzhou Tiangong Information Technology Co., Ltd, is a real-name interactive Internet platform for college students, where students can participate in online activities to obtain "second class" credits and employment training support. There is an arbitrary passwo...

CVE-2019-8346

In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting XSS vulnerability allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf. An attacker can use this to capture a user's AD self-service passwor...

CVE-2019-8346

In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting XSS vulnerability allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf. An attacker can use this to capture a user's AD self-service passwor...

Cross site scripting

In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting XSS vulnerability allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf. An attacker can use this to capture a user's AD self-service passwor...

CVE-2019-8346

In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting XSS vulnerability allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf. An attacker can use this to capture a user's AD self-service passwor...

CVE-2019-10846

Computrols CBAS 18.0.0 allows Unauthenticated Reflected Cross-Site Scripting vulnerabilities in the login page and password reset page via the username GET parameter...

Cross site scripting

Computrols CBAS 18.0.0 allows Unauthenticated Reflected Cross-Site Scripting vulnerabilities in the login page and password reset page via the username GET parameter...

CVE-2019-10846

CVE-2019-10846 affects Computrols CBAS Web (versions prior to fixed 19.0.1/18.0.1 etc.). It describes an Unauthenticated Reflected Cross-Site Scripting vulnerability in the login and password-reset pages via the username GET parameter. Impact per sources is client-side script execution in a user’...

CVE-2019-10846

Computrols CBAS 18.0.0 allows Unauthenticated Reflected Cross-Site Scripting vulnerabilities in the login page and password reset page via the username GET parameter...

CVE-2019-12301

The Percona Server 5.6.44-85.0-1 packages for Debian and Ubuntu suffered an issue where the server would reset the root password to a blank value upon an upgrade. This was fixed in 5.6.44-85.0-2...

CVE-2019-12301

The Percona Server 5.6.44-85.0-1 packages for Debian and Ubuntu suffered an issue where the server would reset the root password to a blank value upon an upgrade. This was fixed in 5.6.44-85.0-2...

Passit: password rest link not expired after change the password

Hi, this is my first report and bug .. i found password rest link not expired after change the password by resiver my e-mail Proof of Concept: 1Go to https://app.passit.io/account/reset-password and ask for password reset link. 2go to Email inbox. 3clicke to link from inbox example // Recovery li...

Authentication flaw

An issue was discovered on Shenzhen Coship WM3300 WiFi Router 5.0.0.55 devices. The password reset functionality of the Wireless SSID doesn't require any type of authentication. By making a POST request to the regx/wireless/wlsecurity2G.asp URI, the attacker can change the password of the Wi-FI...

CVE-2019-7564

An issue was discovered on Shenzhen Coship WM3300 WiFi Router 5.0.0.55 devices. The password reset functionality of the Wireless SSID doesn't require any type of authentication. By making a POST request to the regx/wireless/wlsecurity2G.asp URI, the attacker can change the password of the Wi-FI...

Large Practice Series Instructional Management System Has Logic Flaw Vulnerability

Kok Jin Information Technology Co., Ltd. is a domestic educational software and informationization service provider. A logic flaw vulnerability exists in the Great Practice Series Teaching Management System, which can be exploited to arbitrarily reset account passwords...

U.S. Dept Of Defense: ████ - Complete account takeover

Summary: ███████ ██████████ was updated today 03/04, which includes a backend rewrite. Unfortunately, the new site is insecure and allows a password to be reset given only a username. This allows access to payment records for any DoD employee given only their username, which is commonly known...

Authentication flaw

An issue was discovered in Open XDMoD through 7.5.0. An authentication bypass account takeover exists due to a weak password reset mechanism. A brute-force attack against an MD5 rid value requires only 600 guesses in the plausible situation where the attacker knows that the victim has started a...

CVE-2018-16988

An issue was discovered in Open XDMoD through 7.5.0. An authentication bypass account takeover exists due to a weak password reset mechanism. A brute-force attack against an MD5 rid value requires only 600 guesses in the plausible situation where the attacker knows that the victim has started a...