CVE-2014-1206

Open Web Analytics (OWA)

CVE-2014-1206

SQL injection vulnerability in the password reset page in Open Web Analytics OWA before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the owaemailaddress parameter in a base.passwordResetRequest action to index.php...

Netgear routers unauthorized password reset

Bug in password recovery logic...

Cisco released Security advisory for critical Router password reset vulnerability

In the first week of this year, we have reported about a critical vulnerability found in more than 2000 Routers that allow attackers to reset the admin panel password to defaults. Recently, Cisco has released a security advisory, detailed about the similar vulnerability affecting their three...

eBay Open to Cross-Site Request Forgery, Account Hijacking

EBay is vulnerable to a hack that would allow an attacker to hijack an account and make unauthorized purchases from the victim’s account that would be difficult to disprove. The vulnerability was discovered and reported to eBay in August, and despite three separate communications from the online...

大汉通版jis统一身份认证系统漏洞打包

简要描述： 大汉通版jis统一身份认证系统漏洞打包，政府部门使用居多 详细说明： 大汉通版jis统一身份认证系统: 在用户修改信息时进行抓包发现 POST: http://10.11.5.201:9080/jis/front/upduserdo.jsp CONTENT:...

World’s largest Bitcoin Poker website hacked, 42000 user passwords leaked

World’s largest Bitcoin poker website 'SealsWithClubs' has been compromised and around 42,000 users' credentials are at risk. Seals With Club has issued a Mandatory Password Reset warning to their users, according to a statement published on the website. The service admitted their database had be...

ShopEx商家用户中心任意用户密码重置

简要描述： 客户有个shopex的站点，看到未获得授权，便登录用户中心，结果..... 详细说明： 在找回密码中选择手机找回，输入手机号获取验证码。 2.然后获取验证码，这时候自动跳转到下一步鸟. 3.奇葩的一面出现鸟，由于没有手机收验证码，我随手输入了几个字符，结果大跌眼镜，直接跳到新密码页面、 4.邪恶了下，改密码后就登录成功鸟. 经测试chrome未能复现 使用IE测试可复现 漏洞证明： 登录成功鸟.... 要利用这个必须知道网站所有者的手机号码，不过现在中小电商都留的是自己的手机号...

Account Recovery Vulnerability Patched in Gmail

A recent set of Google patches included a fix for a serious Gmail account recovery vulnerability, the details of which have been disclosed. Researcher Oren Hafifi of Israel points out in his disclosure that unlocking a Google password opens the door to much more than email, elevating the risk. “D...

Hacking Gmail accounts with password reset system vulnerability

Oren Hafif, a security researcher has discovered a critical vulnerability in the Password reset process of Google account that allows an attacker to hijack any account. He managed to trick Google users into handing over their passwords via a simple spear-phishing attack by leveraging a number of...

Hacking Gmail accounts with password reset system vulnerability

None...

Github Resets Users' Passwords Follow Brute Force Attack

The web hosting development site GitHub reset a number of users’ passwords and revoked a slew of user security authorizations this week following a wave of brute-force attacks. According to a blog entry by GitHub’s Security Manager Shawn Davenport yesterday, the incident involved login attempts...

DEBIAN-CVE-2013-2032

MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks...

CVE-2013-2032

MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks...

Cisco TelePresence VX Clinical Assistant unauthorized access

admin password is reset on every reboot...

Cisco TelePresence VX Clinical Assistant WIL-A Module Reboot Admin Password Removal

Cisco TelePresence VX Clinical Assistant is affected by a password reset vulnerability. The WIL-A module causes the administrative password to be reset to a blank password every time the device is rebooted. This plugin attempts to authenticate to the device using the username 'admin' and a blank...

Facebook Requires Password Resets Related to Adobe

The tentacles of the massive Adobe breach, called one of the worst in U.S. history by one security expert, have reached Facebook users, specifically those who used the same email and password combination for the social network as well as Adobe. A Facebook representative confirmed to Threatpost...

CVE-2013-5558

The WIL-A module in Cisco TelePresence VX Clinical Assistant 1.2 before 1.21 changes the admin password to an empty password upon a reboot, which makes it easier for remote attackers to obtain access via the administrative interface, aka Bug ID CSCuj17238...

Password reset emails are unusable on Outlook Web Access

When viewing a requested password reset email in Outlook webmail a user cannot see the button representing the main required action. Screenshot attached shows text highlighted to better demonstrate the issue White text on White background. Probably an Outlook issue but I think there might be...

Password reset emails are unusable on Outlook Web Access

When viewing a requested password reset email in Outlook webmail a user cannot see the button representing the main required action. Screenshot attached shows text highlighted to better demonstrate the issue White text on White background. Probably an Outlook issue but I think there might be...