Hiro: REDIRECTION VULNERABILITY/HOST HEADER INJECTION VULNERABILITY

Hiii.. This is vyshnav nk i need to address you a vulnerability i have found in https://github.com/blockstack/blockstack-core/ https://github.com/blockstack/blockstack-core/ is vulnerable to host header injection/redirection vulnerability.. IMPACT:- Attack vectors are somewhat limited but depends...

Cambium ePMP 1000 Account Password Reset

This module exploits an access control vulnerability in Cambium ePMP device management portal. It requires any one of the following non-admin login credentials - installer/installer, home/home - to reset password of other existing users including 'admin'. All versions 'Cambium ePMP 1000 Account...

VIEWGOOD's All Media Resource Distribution Platform Has Logic Design Flaws

WebCDN is a cloud-based service platform that integrates application and resource provisioning. A logical design vulnerability exists in WebCDN, which can be exploited by an attacker to reset arbitrary user passwords...

Shanghai Lehigh Network Technology Co., Ltd. bug house APP has multiple vulnerabilities

Bug House App is a home service software. Shanghai Lehigh Network Technology Co., Ltd Bug House APP exists arbitrary user registration and arbitrary user password reset vulnerability. Attackers can register any account and reset any password by grabbing packets and blasting the verification code...

CVE-2017-14134

A Reflected XSS Vulnerability affects the forgotten password page of Maplesoft Maple T.A. 2016.0.6 Customer Hosted via the emailAddress parameter to passwordreset/PasswordReset.do, aka Open Bug Bounty ID OBB-286688...

Hangzhou Chengyu Asset Management Co. Smart Money APP has logic design flaws

Smart Money APP is an online smart investment management app developed by Hangzhou Chengyu Asset Management Co. There is a logical design flaw in the "password retrieval" section of the Smart Money APP of Hangzhou Chengyu Asset Management Co. Attackers through unlimited verification code...

Deriv.com: Leaking Referrer in Reset Password Link

On 12th Dec flex0geek reported that binary.com was leaking password reset tokens through referer headers . At first this sight the report was closed as we had fixed this earlier and our code base seemed fine . Later on the researcher sent a video POC which did show that we were leaking password...

Arbitrary User Registration and Arbitrary User Password Reset Vulnerabilities in Loan Plus Plus App

Loan Plus Plus App is a loan software platform. The Loan Plus Plus APP is vulnerable to arbitrary user registration and arbitrary user password reset. An attacker can register any user and reset any password by capturing the verification code in a packet...

Emby MediaServer 3.2.5 Password Reset Vulnerability

Summary Emby formerly Media Browser is a media server designed to organize, play, and stream audio and video to a variety of devices. Emby is open-source, and uses a client-server model. Two comparable media servers are Plex and Windows Media Center. Description The issue can be triggered by an...

okmulgeeps.com XSS vulnerability

Open Bug Bounty ID: OBB-449427 Description| Value ---|--- Affected Website:| okmulgeeps.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Coredy CX-E120 Repeater Multiple Vulnerabilities

Vulnerabilities Summary The following advisory describes two 2 vulnerabilities found in Coredy CX-E120 Repeater. The Coredy CX-E120 WiFi Range Extender is “a network device with multifunction, which can be using for increasing the distance of a WiFi network by boosting the existing WiFi signal an...

Multiple Dahua Products Password Reset Vulnerability

Dahua IPC-HFW and so on are all China DaHua DaHua company network camera equipment. A security vulnerability exists in several Dahua products. The vulnerability can be exploited by an attacker to reset the administrator password...

Arbitrary Account Password Reset Vulnerability in Zhigao Cloud Air Conditioner App Android Version

Cloud air conditioning refers to intelligent air conditioning equipment that uses cloud computing technology to upgrade and manage existing applications on the basis of the core technology of refrigeration, which possesses many application advantages such as massive cloud service resources, remot...

Xiaofeng Air Ching App for Android suffers from arbitrary account password reset vulnerability

Xiaofeng Air Dorje APP is the APP developed by Shenzhen Xiaofeng Technology Co., Ltd. to work with Xiaofeng Air Dorje system, mainly used to monitor the indoor air quality and Xiaofeng Air Dorje internal and external machine operation status, monitoring items including PM2.5, formaldehyde, oxygen...

Wise Heat Temperature Control App for Android has an arbitrary account password reset vulnerability

Smart Heat Temperature Control APP a home temperature control software, users only need to add the home's Internet-accessible thermostat to the software, you can use your phone or tablet to control the temperature of your home's HVAC equipment. The Android version of Smart Heat Temperature Contro...

Imgur Confirms 2014 Breach of 1.7 Million User Accounts

Popular image sharing community Imgur said last week it was the victim of a data breach in 2014 that exposed 1.7 million user accounts. In a breach notice posted to its website last Friday, the company said users are being notified via email that they must update their passwords immediately. “On...

CVE-2017-8151

Huawei Honor 5S smart phones with software the versions before TAG-TL00C01B173 have an authentication bypass vulnerability due to the improper design of some components. An attacker can get a user's smart phone and install malicious apps in the mobile phone, allowing the attacker to reset the...

CVE-2017-8151

Huawei Honor 5S smart phones with software the versions before TAG-TL00C01B173 have an authentication bypass vulnerability due to the improper design of some components. An attacker can get a user's smart phone and install malicious apps in the mobile phone, allowing the attacker to reset the...

Authentication flaw

Huawei Honor 5S smart phones with software the versions before TAG-TL00C01B173 have an authentication bypass vulnerability due to the improper design of some components. An attacker can get a user's smart phone and install malicious apps in the mobile phone, allowing the attacker to reset the...

Arbitrary Account Password Reset Vulnerability in Netxi Smart Android APP

Netxi Smart Android APP is a water purifier monitoring software. Netxi Smart Android APP has a reset any account password vulnerability, the attacker only need the other party's cell phone number to change their passwords, leak the user's sensitive information or loss of funds...