Subsonic 6.1.1 - Cross-Site Request Forgery

Subsonic 6.1.1 - Cross-Site Request Forgery + Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SUBSONIC-PASSWORD-RESET-CSRF.txt + ISR: ApparitionSec Vendor: ================ www.subsonic.org Product: =============== subson...

Debian DLA-975-1 : wordpress security update

Several vulnerabilities were discovered in wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following issues. CVE-2017-8295 Potential unauthorized password reset vulnerability. More information are available at :...

Subsonic 6.1.1 - Cross-Site Request Forgery

Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SUBSONIC-PASSWORD-RESET-CSRF.txt + ISR: ApparitionSec Vendor: ================ www.subsonic.org Product: =============== subsonic v6.1.1 Subsonic is a media streaming...

Subsonic 6.1.1 - Cross-Site Request Forgery Vulnerability

Exploit for windows platform in category web applications + Credits: John Page a.k.a hyp3rlinx Vendor: ================ www.subsonic.org Product: =============== subsonic v6.1.1 Subsonic is a media streaming server. You install it on your own computer where you keep your music or video collection...

Subsonic 6.1.1 Password Reset Cross Site Request Forgery

Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SUBSONIC-PASSWORD-RESET-CSRF.txt + ISR: ApparitionSec Vendor: ================ www.subsonic.org Product: =============== subsonic v6.1.1 Subsonic is a media streaming...

[SECURITY] [DLA 975-1] wordpress security update

Package : wordpress Version : 3.6.1+dfsg-1deb7u15 CVE ID : CVE-2017-8295 CVE-2017-9061 CVE-2017-9062 CVE-2017-9063 CVE-2017-9064 CVE-2017-9065 Debian Bug : 862053 862816 Several vulnerabilities were discovered in wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project...

Phishing Attacks

laravel/framework is vulnerable to phishing attacks. The library uses the host of the incoming request to build the password reset URL. This can allow a malicious user to spoof the host of the password reset URL link, leading to other users accidentally entering their login credentials on a...

MyBB < 1.8.12 Multiple Vulnerabilities

Binary data 700128.prm...

CVE-2017-9303

Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by specifying an attacker-controlled host...

Default credentials

Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by specifying an attacker-controlled host...

CVE-2017-9303

Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by specifying an attacker-controlled host...

CVE-2017-9303

Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by specifying an attacker-controlled host...

CVE-2017-9303

Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by specifying an attacker-controlled host...

S-CMS v3.0 build20170522 exists foreground arbitrary user password reset vulnerability

S-CMS is a corporate website building system developed by Zibo Shining Network Technology Co. S-CMS v3.0 build20170522 /member/membersetpwd.asp page exists in the foreground any user password reset vulnerability, allowing an attacker to use the vulnerability to reset the foreground any user...

Multiple Pivotal products expire old reset password link vulnerability

Pivotal Cloud Foundry PCF Runtime cf-release and others are products of Pivotal Software, Inc. PCF is an open source Platform-as-a-Service PaaS cloud computing platform that provides container scheduling, continuous delivery, and automated service deployment. cf-release is a release version of PC...

Password Reset Vulnerability in Multiple Pivotal Products

Pivotal Cloud Foundry and other products of the United States Pivotal Software Corporation, which Pivotal Cloud Foundry a set of open source platform as a service PaaS cloud computing platform, which provides container scheduling, continuous delivery and automated service deployment and other...

Bargo Travel Android App Has Arbitrary User Password Reset Vulnerability

Ba Ge Travel is a car time-sharing and leasing platform founded by Beijing Ba Ge Auto Leasing Co., Ltd. with the help of Internet of Things IoT technology and advanced operation mode, realizing the unattended, rent-and-return intelligent car mode, and is committed to providing users with 24-hour...

Arbitrary Password Reset Vulnerability in Paco Drive Android App

BaGoDrive is an O2O online and offline taxi application based on LBS geographical location developed by Jiangsu Xunzhi Network Technology Co. There is an arbitrary password reset vulnerability in the BaGeDrivingTo Android app, which allows attackers to reset the password by using the other party'...

CVE-2016-3084

The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple...

CVE-2015-3189

CVE-2015-3189 – Normal details Affected products/versions: Cloud Foundry Runtime cf-release v208 or earlier; UAA standalone v2.2.5 or earlier; Pivotal Cloud Foundry Runtime v1.4.5 or earlier. Issue: old Password Reset Links do not expire after a user changes their current email address, when usin...