Arbitrary Account Password Reset Vulnerability in Online Education Platform of Beijing Wanxue Education Technology Co.

Beijing Wanxue Education Technology Co., Ltd. is an education company. An arbitrary account password reset vulnerability exists in the online education platform of Beijing Wanxue Education Technology Co. An attacker is allowed to exploit the vulnerability to gain unauthorized access to user...

Nextcloud: Email Notification should be get while changing password on apps.nextcloud.com

Hi, There is an issue with password reset functionality with Nextcloud: user is not receiving notification when he reset password. Issue: user not always gets a notification about password change. When user change his password then a notification is not send to the user. It is good to always send...

Asus Unauthenticated LAN Remote Command Execution

Vulnerabilities Summary The following advisory describes two 2 vulnerabilities found in AsusWRT Version 3.0.0.4.380.7743. The combination of the vulnerabilities leads to LAN remote command execution on any Asus router. AsusWRT is “THE POWERFUL USER-FRIENDLY INTERFACE – The enhanced ASUSWRT...

Bukura App Has Logic Design Flaws

Cloth Warehouse APP is a cloth finding application developed by Guangdong Zhida Textile & Decoration Co. Ltd. specifically for fabric buyers, soft furnishing designers. There is a logical design vulnerability in the Cloth Storage APP, which can be exploited by an attacker to register an arbitrary...

Multiple Vulnerabilities in the Remember the News App

Remember the news app is a real-name authentication social software. There are arbitrary user registration and arbitrary user password reset vulnerabilities in JWAPP. An attacker can register any account and reset any password by grabbing packets and modifying them...

Shanghai Jumo Information Technology Co., Ltd. radish borrowing APP has information leakage vulnerability

Radish Borrowing APP is a small borrowing money fast installment loan software. Shanghai Jumo Information Technology Co. Radish Borrowing APP has information leakage vulnerability. Attackers can register any account and reset any password by grabbing packets to get verification code...

Meal Chain App Has Multiple Vulnerabilities

Meal Chain APP is an ingredient sourcing platform focusing on the restaurant industry. There are arbitrary user registration and arbitrary password reset vulnerabilities in Meal Chain APP. An attacker can register any account and reset any password by capturing the verification code...

Learning Orange Education App Has Multiple Vulnerabilities

Learn Orange Education App is a mobile online learning application. There are arbitrary user registration, arbitrary user login and arbitrary user password reset vulnerabilities in XUOE APP. An attacker can register any account, log in to other users' systems, and reset any password by capturing...

Multiple Vulnerabilities in Beipiao's Microclass App

Beipiao Microcourse APP is an educational course learning service software. There are loopholes in Beipiao Microcourse APP for arbitrary user registration, arbitrary user password reset and arbitrary file upload. An attacker can use the vulnerability to register any account, reset any password an...

CubeCart 6.1.12 - Admin Authentication Bypass

I Forgot My Password! Both vulnerabilities are exploitable through CubeCarts "I forgot my Password!" functionality. It is implemented in the file classes/cubecart.class.php, in the method recovery. When a user forgot his password, he can use this feature to enter his email address, a valid passwo...

Logic design flaws in Efon Travel App

Easy Beacon Mobility APP is an electric car time-share rental software. There is a logic design vulnerability in Efeng Travel APP. An attacker can register any account and reset any password by capturing the verification code...

Multiple Vulnerabilities in Ease of Use Electric Vehicle App

Ease of use electric car APP is an electric car service software. There is an arbitrary user registration and arbitrary user password reset vulnerability in the E-Hang Electric Vehicle APP. An attacker can register any account and reset any password by obtaining the verification code by default...

Eel App Has Multiple Vulnerabilities

Eel App is a car charging station search software. Eel APP has arbitrary user registration, arbitrary user login, arbitrary user password reset, arbitrary file upload and ultra vires access vulnerabilities. Attackers can register any account, log in any account, reset any password, obtain sensiti...

Hangzhou Hechat Technology Co., Ltd. and Hechat APP suffers from arbitrary number registration and arbitrary password reset vulnerability

Wochat App is a business socialization software. Ltd. and Chat APP has an arbitrary number registration and arbitrary password reset vulnerability. The vulnerability is due to the lack of restrictions on verification code verification, an attacker can register any account and reset any password b...

General Motors and Shanghai OnStar iOS Client Unauthorized Modification Vulnerability

General Motors GM and Shanghai OnStar SOS iOS Client is an iOS-based application for making SOS distress calls for drivers in the event of a motor vehicle collision. An unauthorized modification vulnerability exists in the GM and SOS iOS Client version 7.1. An attacker can exploit the vulnerabili...

织梦前台任意用户密码修改

常见的弱类型问题 类型转换问题 类型转换是无法避免的问题。例如需要将GET或者是POST的参数转换为int类型，或者是两个变量不匹配的时候，PHP会自动地进行变量转换。但是PHP是一个弱类型的语言，导致在进行类型转换的时候会存在很多意想不到的问题。 数学运算 当php进行一些数学计算的时候 因为 md5's878926199a'=0e545993274517709034328855841020就是0的n次方，所以还是等于0 但是要注意： "0e123456abc"=="0e1dddada"//false 这种返回的是为假 语句条件的松散判断 函数的松散判断...

CVE-2017-12695

An Improper Authentication issue was discovered in General Motors GM and Shanghai OnStar SOS SOS iOS Client 7.1. Successful exploitation of this vulnerability may allow an attacker to subvert security mechanisms and reset a user account password...

CVE-2017-12695

An Improper Authentication issue was discovered in General Motors GM and Shanghai OnStar SOS SOS iOS Client 7.1. Successful exploitation of this vulnerability may allow an attacker to subvert security mechanisms and reset a user account password...

CVE-2017-12695

CVE-2017-12695 affects the Shanghai OnStar iOS Client (GM SOS) version 7.1. The vulnerability is described as an Improper Authentication flaw that could allow an attacker to subvert security mechanisms and reset a user account password. Connected sources also reference related issues in the same ...

CVE-2017-12695

An Improper Authentication issue was discovered in General Motors GM and Shanghai OnStar SOS SOS iOS Client 7.1. Successful exploitation of this vulnerability may allow an attacker to subvert security mechanisms and reset a user account password...