8196 matches found
Hunan Jiancheng Information Technology Co., Ltd. Jiancheng.com APP has information leakage vulnerability
The Building Program App is a construction and engineering app. There is an information leakage vulnerability in the Construction Engineering APP of Hunan Construction Engineering Information Technology Co. An attacker can register any account, reset any password and perform unauthorized operatio...
Information leakage vulnerability in Dr. Fannie's Broker APP of Guangzhou Live World Network Co.
Dr. Housing Broker - mobile home selling, home price checking, commission checking, showing, customer reporting, customer management, convenient and real. CAPTCHA Information Leakage: This vulnerability mainly occurs when registering and retrieving passwords, the server will return the CAPTCHA to...
Qinhuangdao Kusoft Information Technology Co., Ltd. on Meijia takeout APP has information leakage vulnerability
Shangmeijia focuses on providing online ordering and delivery services of catering food and specialty quality takeout for urban residents. CAPTCHA Information Leakage: This vulnerability mainly occurs when registering and retrieving passwords, the server will return the CAPTCHA to the client, thu...
Beijing Beifang Founder Electronics Company Limited Economic Reference News APP has information leakage vulnerability
Economic Reference News App is a news and information application. An information leakage vulnerability exists in the Economic Reference News APP of Beijing Beifang Founder Electronics Co. An attacker can register any account, reset any password and perform unauthorized operations by capturing th...
There is an information leakage vulnerability in the APP of Beijing JIANNONG Online Information Technology Co.
KANO Online Layer Manager is a national informatization service platform for the egg industry and is a networked production management software platform for egg farms. The application has CAPTCHA information leakage: when registering and retrieving passwords, the server side returns the CAPTCHA t...
Shenzhen Jiya Technology Co., Ltd Jiya APP has information leakage vulnerability
JIYA APP is a cell phone housing search life application that includes new and second-hand housing functions. CAPTCHA Information Leakage: This vulnerability is mainly in the login and password retrieval, the server will return the verification code to the client, thus causing the leakage of...
Guangdong Provincial Transportation Group Limited Guangdong Expressway APP has information leakage vulnerability
Guangdong Expressway app is a mobile application for highway traffic information service launched by Guangdong Provincial Transportation Group Company Limited Highway Monitoring Center for the public. There is an information leakage vulnerability in Guangdong Expressway App of Guangdong Provincia...
Guangdong Meteorological Bureau Suspension Bell App has information leakage vulnerability
Suspension Bell APP is the official client of Guangdong Provincial Meteorological Bureau, providing services such as suspension signal, weather warning and weather inquiry in Guangdong Province. There is an information leakage vulnerability in Guangdong Meteorological Bureau Suspension Bell APP,...
Air Canada Suffers Data Breach — 20,000 Mobile App Users Affected
Air Canada has confirmed a data breach that may have affected about 20,000 customers of its 1.7 million mobile app users. The company said it had "detected unusual log-in behavior" on its mobile app between August 22 and 24, during which the personal information for some of its customers "may...
Weblate: Broken Authentication – Session Token bug
I found a broken authentitication vuln POC: 1- Create a https://demo.weblate.org/accounts/profile/ account 2- Confirm your email 3- Now request a password reset for your account. 4- Don’t use the password reset link that was sent to your email. 5- Login to your account, remember don’t use first t...
CVE-2018-15844
An issue was discovered in DamiCMS 6.0.0. There is an CSRF vulnerability that can revise the administrator account's password via /admin.php?s=/Admin/doedit...
Forgot password link doesn't expire after use
FortiCloud password reset link requested by the user takes one hour to expire even after password was changed successfully, thus allowing attackers to take over user's account if they somehow gain access to the reset link for the user's password...
GHSA-JHQ3-57XH-6643 Privilege Escalation due to Blind NoSQL Injection in flintcms
Versions of flintcms before version 1.1.10 are vulnerable to account takeover due to blind MongoDB injection in the password reset. Recommendation Update to version 1.1.10 or later...
Privilege Escalation due to Blind NoSQL Injection in flintcms
Versions of flintcms before version 1.1.10 are vulnerable to account takeover due to blind MongoDB injection in the password reset. Recommendation Update to version 1.1.10 or later...
Design/Logic Flaw
An issue was discovered in OXID eShop Enterprise Edition before 5.3.8, 6.0.x before 6.0.3, and 6.1.x before 6.1.0; Professional Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0; and Community Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0. An...
CVE-2018-12579
An issue was discovered in OXID eShop Enterprise Edition before 5.3.8, 6.0.x before 6.0.3, and 6.1.x before 6.1.0; Professional Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0; and Community Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0. An...
CVE-2018-12579
CVE-2018-12579 affects OXID eShop, spanning Enterprise Edition before 5.3.8, 6.0.x before 6.0.3, and 6.1.x before 6.1.0; Professional Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0; and Community Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0....
CVE-2018-12579
An issue was discovered in OXID eShop Enterprise Edition before 5.3.8, 6.0.x before 6.0.3, and 6.1.x before 6.1.0; Professional Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0; and Community Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0. An...
CVE-2018-14078
The CVE-2018-14078 entry affects Wi2be SMART HP WMT R1.2.20_201400922. The vulnerability allows unauthorized remote attackers to reset the admin password via the /ConfigWizard/ChangePwd.esp?2admin URL, enabling login with username “admin” and password “admin” after a successful attack. CVSS detai...