CVE-2016-7965

DokuWiki 2016-06-26a and older uses $SERVERHTTPHOST instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header. The vulnerability can be triggered only if the Host...

DEBIAN-CVE-2016-7965

DokuWiki 2016-06-26a and older uses $SERVERHTTPHOST instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header. The vulnerability can be triggered only if the Host...

CVE-2016-7965

DokuWiki 2016-06-26a and older uses $SERVERHTTPHOST instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header. The vulnerability can be triggered only if the Host...

UBUNTU-CVE-2016-7965

DokuWiki 2016-06-26a and older uses $SERVERHTTPHOST instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header. The vulnerability can be triggered only if the Host...

Design/Logic Flaw

DokuWiki 2016-06-26a and older uses $SERVERHTTPHOST instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header. The vulnerability can be triggered only if the Host...

CVE-2016-7965

CVE-2016-7965 affects DokuWiki up to 2016-06-26a: password-reset URL construction uses $_SERVER[HTTP_HOST] instead of the configured baseurl. This allows a remote unauthenticated attacker to manipulate the password-reset URL hostname via the HTTP Host header, enabling phishing; exploitation requi...

CVE-2016-7965

DokuWiki 2016-06-26a and older uses $SERVERHTTPHOST instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header. The vulnerability can be triggered only if the Host...

CVE-2016-7965

DokuWiki 2016-06-26a and older uses $SERVERHTTPHOST instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header. The vulnerability can be triggered only if the Host...

Magento Community Edition < 1.9.2.2 Multiple Vulnerabilities

Binary data 9678.prm...

Dotclear Password Reset Address Forgery Vulnerability

Dotclear is an open source free web publishing software. Dotclear suffers from a password reset address forgery vulnerability that can be exploited by an attacker to forge the hostname of a password reset address...

Uber: password reset token leaking allowed for ATO of an Uber account

With an email address for a valid Uber account, it was possible to take over that account because the reset token was exposed in the response of a password reset HTTP request. This meant an attacker could initiate password reset for an account and immediately receive the reset token for that...

RubyGems: Password Reset emails missing TLS leads account takeover

Hi, I saw that the email is sent in clear-text instead of TLS Transport Layer Security any Man-in-the-middle attacker is able to read these sensitive Emails and get the password reset link which lead to account takeover. Email details: from: [email protected] to: [email protected] date: Fri, Sep 3...

Legal Robot: Bypass 8 chars password complexity with 6 chars only due to insecure password reset functionaliy

While password complexity requirements were implemented in the original signup page, these were not added to the password reset page. Thanks to this security researcher's efforts, we've added this functionality there as well...

HiMall Multi-User Mall System Exists Arbitrary Password Reset Vulnerability

Hishop multi-user mall system is a multi-store support multi-vendor stationed, mainly for high-end customers, for traditional enterprises and large and medium-sized online business to improve the operational capacity of merchants as the core, similar to Jingdong, Tmall e-commerce platform. Hishop...

Linex All Versions Password Reset Vulnerability

LinkEx is an open source web application for exchanging links. A password reset vulnerability exists in all versions of LinEx, which can be exploited by an attacker to reset the administrator password and gain administrator privileges...

500 Million Yahoo Accounts Stolen By State-Sponsored Hackers

Yahoo says it was the victim of state-sponsored hackers who stole information associated with 500 million accounts. Yahoo CISO Bob Lord said the attack happened on the company’s network in late 2014; he did not name the country responsible. “The account information may have included names, email...

HackerOne: Bypass rate limiting on /users/password (possibly site-wide rate limit bypass?)

Hi there, I noticed when we hit the /userssignin endpoint too many times it will give us HTTP/1.1 429 Too Many Requests Date: Mon, 19 Sep 2016 01:52:19 GMT Content-Type: text/plain However, this can be "reset" although I struggle to get it to work EVERYTIME on /users/signin. This however, does wo...

Yelp: Password reset token not expiring

Hello Yelp, Old unused Password reset tokens are not expiring on yelp.com after the issuance of a new token. EXPLANATION: Suppose at 09:00 hrs I used password reset options of yelp and got a token on my email.Lets call it token01. But i did not use it. And at 09:04 hrs I used again the password...

Boozt Fashion AB: Host header poisoning leads to account password reset links hijacking

Hi, Issue Summary : While conducting my regular testing I discovered that the mobile version of boozt.com application relies on the host header when constructing password reset links emailed to the user. Thus, an attacker can inject a arbitrary host header which leads to password reset leakage...

Yelp: Bybass The Closing of the account and logged again to your account

Hello Details: All My accounts have been closed i dnot know the reason so i have played around and manged to bypass this mechanism using the last unused password token Steps: - go to forget password page and get new password reset token and dnot use it - go and make anything against the rules lea...