Account Recovery Vulnerability Patched in Gmail

A recent set of Google patches included a fix for a serious Gmail account recovery vulnerability, the details of which have been disclosed. Researcher Oren Hafifi of Israel points out in his disclosure that unlocking a Google password opens the door to much more than email, elevating the risk. “D...

Hacking Gmail accounts with password reset system vulnerability

Oren Hafif, a security researcher has discovered a critical vulnerability in the Password reset process of Google account that allows an attacker to hijack any account. He managed to trick Google users into handing over their passwords via a simple spear-phishing attack by leveraging a number of...

Hacking Gmail accounts with password reset system vulnerability

None...

Github Resets Users' Passwords Follow Brute Force Attack

The web hosting development site GitHub reset a number of users’ passwords and revoked a slew of user security authorizations this week following a wave of brute-force attacks. According to a blog entry by GitHub’s Security Manager Shawn Davenport yesterday, the incident involved login attempts...

CVE-2013-2032

MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks...

DEBIAN-CVE-2013-2032

MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks...

Cisco TelePresence VX Clinical Assistant unauthorized access

admin password is reset on every reboot...

Cisco TelePresence VX Clinical Assistant WIL-A Module Reboot Admin Password Removal

Cisco TelePresence VX Clinical Assistant is affected by a password reset vulnerability. The WIL-A module causes the administrative password to be reset to a blank password every time the device is rebooted. This plugin attempts to authenticate to the device using the username 'admin' and a blank...

Facebook Requires Password Resets Related to Adobe

The tentacles of the massive Adobe breach, called one of the worst in U.S. history by one security expert, have reached Facebook users, specifically those who used the same email and password combination for the social network as well as Adobe. A Facebook representative confirmed to Threatpost...

CVE-2013-5558

The WIL-A module in Cisco TelePresence VX Clinical Assistant 1.2 before 1.21 changes the admin password to an empty password upon a reboot, which makes it easier for remote attackers to obtain access via the administrative interface, aka Bug ID CSCuj17238...

Password reset emails are unusable on Outlook Web Access

When viewing a requested password reset email in Outlook webmail a user cannot see the button representing the main required action. Screenshot attached shows text highlighted to better demonstrate the issue White text on White background. Probably an Outlook issue but I think there might be...

Password reset emails are unusable on Outlook Web Access

When viewing a requested password reset email in Outlook webmail a user cannot see the button representing the main required action. Screenshot attached shows text highlighted to better demonstrate the issue White text on White background. Probably an Outlook issue but I think there might be...

Fake Dropbox Password Reset Spam Leads to Malware

A new spam campaign has been circulating over the last few weeks aiming to dupe users of the popular cloud storage service Dropbox. The e-mails purport to come from the service but instead lead those who click through to a malware landing page. Some of the emails start off fairly convincingly:...

iPhone Fingerprint scanner hack allows attacker to hijack Apple ID using Flight Mode

A German security firm SRL claims a vulnerability in Touch ID Fingerprint Scanner and iCloud allows a hacker to access a locked device and potentially gain control over an owner’s Apple ID. SRL points out that Airplane mode can be enabled on a stolen phone from the lockscreen, which turns off...

SEC Consult SA-20130904-0 :: GroupLink everything HelpDesk - undocumented password reset/admin takeover and XSS vulnerabilities

SEC Consult Vulnerability Lab Security Advisory 20130904-0 ======================================================================= title: Undocumented password reset and admin takeover & Cross-Site Scripting vulnerabilities product: GroupLink everything HelpDesk vulnerable version: =10.0.3 fixed...

ShopEx 任意用户密码重置漏洞

ShopEx是国内市场占有率最高的网店软件 ShopEx存在一个未明安全漏洞，允许攻击者利用漏洞重置密码 0 ShopEx 厂商解决方案 ShopEx ---------- 目前没有详细解决方案提供： https://www.shopex.cn...

CVE-2013-4962

The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify user passwords by leveraging session hijacking, an unattended workstation, or other vectors...

Default credentials

The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify user passwords by leveraging session hijacking, an unattended workstation, or other vectors...

CVE-2013-4962

The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify user passwords by leveraging session hijacking, an unattended workstation, or other vectors...

Short Password Reset code vulnerability allows hackers to brute-force many websites

Yesterday we received a vulnerability report in web applications from some unknown Indian Hacker, who explained that how Hackers are hijacking Mobile recharge and Free SMS service related websites. He detailed the loophole in password reset process, that could allow attackers to brute force many...