DEBIAN-CVE-2014-9033

Cross-site request forgery CSRF vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication of arbitrary users for requests that reset passwords...

Default credentials

wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication of arbitrary users for requests that reset passwords...

CVE-2014-9039

CVE-2014-9039 affects WordPress versions prior to 4.0.1 for the 4.x line and older 3.x branches: remote password resets could be triggered if an attacker gains access to the email account that received the reset message. The explicit vulnerable ranges are WordPress before 3.7.5, 3.8.x before 3.8....

CVE-2014-9033

Cross-site request forgery CSRF vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication of arbitrary users for requests that reset passwords...

CVE-2014-9039

wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message...

CVE-2014-9033

CVE-2014-9033 is a CSRF vulnerability in WordPress affecting wp-login.php that could allow an attacker to hijack a user’s authentication by tricking them into performing a password change. The advisory data lists affected WordPress versions as 3.7.4, 3.8.4, 3.9.2, and 4.0, with remediation indica...

CVE-2014-9039

wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message...

CVE-2014-9033

Cross-site request forgery CSRF vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication of arbitrary users for requests that reset passwords...

WordPress <= 4.0 - CSRF in wp-login.php Password Reset

Description WordPress 4.0.1 adds a CSRF token called 'rpkey' to the password reset form on wp-login.php. Prior versions are vulnerable to CSRF...

wordpress -- multiple vulnerabilities

MITRE reports: wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message. wp-includes/http.php in WordPress before 3.7.5, 3.8...

phpyun csrf修改用户密码

简要描述： phpyun csrf修改用户密码 详细说明： 更新用户信息的请求没有防御csrf。可以修改用户的邮箱。而重置密码功能是选择用户信息中的邮箱发送找回验证码。结合利用。 修改用户信息的请求为:...

JEEBBS任意帐号密码重置附poc

简要描述： JEEBBS 某些小问题可导致任意帐号密码重置。漏洞的类型，难度不重要，关键是能造成什么影响才是最重要的 详细说明： 一、首先注册个帐号，虽然有些网站去掉了注册连接，但是register.jspx 文件还是存在的，直接访问可以注册帐号。 二、来到论坛的随便一个帖子里，找到举报的连接，虽然有些网站去掉了连接，但是通过 member/getreportpage.jspx?url=/sqzx/帖子ID.jhtml 去举报帖子。 三、由于举报的字符串没有经过过滤直接查询显示在后台位置,于维护-用户举报-举报详情-举报理由。形成存储型xss...

PYSEC-2014-50

The error pages in Plone before 4.2.3 and 4.3 before beta 1 allow remote attackers to obtain random numbers and derive the PRNG state for password resets via unspecified vectors. NOTE: this identifier was SPLIT per ADT2 due to different vulnerability types. CVE-2012-6661 was assigned for the PRNG...

X (Formerly Twitter): BROKEN AUTHENTICATION IN MOBILE VERIFICATION

Hey Team this is geekboy : this report is about broken authentication in mobile section . Description : when user want to add any mobile number to his account , he will go mobile section and twitter will ask the user to select the country and enter the mobile number . so when testing i entered th...

InVision: ███████

hiiii Password reset tokens are still valid if I logged in the account and change the password and after the use the password reset token. Steps to reproduce 1.Use the password reset option of InVision and you will get a password reset token on your registered email don't use it now 2.log into yo...

Facebook Yahoo Require-Recipient-Valid-Since SMTP Extension

Yahoo’s decision in June 2013 to reset accounts that had been dormant for 12 months and make them available to other users raised a number of security and privacy red flags. It was feared that the potential for identity theft would grow given that if an old Yahoo account was linked to another...

Dropbox Denies Hack, Says 'Your Stuff is Safe'

Dropbox officials on Monday said that a large cache of usernames and passwords posted online and alleged to have come from the company’s users are not related to Dropbox customer accounts. A spate of media reports reported yesterday that attackers had stolen several million sets of credentials fr...

M/Monit 3.3.2 - CSRF Vulnerability

No description provided by source. Vulnerability title: M/Monit CSRF Author: Dolev Farhi Contact: dolevf at openflare dot com @dolevff Application: M/Monit 3.2.2 Date: 13.9.2014 Relevant CVEs: N/A Vulnerable version: = 3.2.2 Fixed version: N/A 1. About the application ------------------------ Eas...

Hacking any eBay Account in Just 1 Minute

Four month ago, a massive data breach on the eBay website affected 145 million registered users worldwide after its database was compromised. Meanwhile, another critical vulnerability on the eBay website was reported, allowing an attacker to hijack millions of user accounts in bulk. An Egyptian...