June 2011 – Epic Games & Codemasters Hacks

Happening almost simultaneously with the hacks at Nintendo, Bethesda, and other firms, the Epic Games hack spilled email addresses and encrypted passwords online and prompted the company to reset all of its users’ passwords. Codemasters had it bad too: their breach exposed the personal informatio...

MediaWiki < 1.17.3 / 1.18.2 Multiple Vulnerabilities

According to its version number, the instance of MediaWiki running on the remote host is affected by multiple security vulnerabilities : - An attacker can block/unblock arbitrary users via cross- site request forgery attack XSRF against an authorized user. CVE-2012-1578 - Unauthorized users can...

Yet Another Hotmail, AOL and Yahoo Password Reset 0Day Vulnerabilities

Yesterday we Reported a 0-Day Vulnerability in Hotmail, which allowed hackers to reset account passwords and lock out the account's real owners. Tamper Data add-on allowed hackers to siphon off the outgoing HTTP request from the browser in real time and then modify the data.When they hit a passwo...

0Day Remote Password Reset Vulnerability in MSN Hotmail patched

Microsoft's MSN Hotmail Live email service currently hosts over 350 million unique users. A Vulnerability Laboratory senior researcher, Benjamin Kunz Mejri, identified a critical security vulnerability in Microsoft's official MSN Hotmail Live service. A critical vulnerability was found in the...

Hotmail Password Reset Bug Exploited in Wild

UPDATE: Microsoft has issued a temporary permanent fix for a previously undisclosed bug in its MSN Hotmail Web email service that could have allowed remote attackers to reset account passwords. The flaw in the password reset functionality allowed a remote attacker to reset the Hotmail/MSN passwor...

Microsoft MSN Hotmail Password Reset

Title: ====== Microsoft MSN Hotmail - Password Reset & Setup Vulnerability Date: ===== 2012-04-26 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=529 http://news.softpedia.com/news/Critical-0-Day-in-Hotmail-Exploited-in-Wild-Microsoft-Issues-Fix-266506.shtml...

Microsoft MSN Hotmail - Password Reset Vulnerability

Document Title: =============== Microsoft MSN Hotmail - Password Reset Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=529 Media Partners:...

Microsoft MSN Hotmail - Password Reset Vulnerability

Document Title: =============== Microsoft MSN Hotmail - Password Reset Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=529 Media Partners:...

Joomla! 1.5.x可预测密码生成和信息泄露漏洞

Bugtraq ID: 52750 Joomla!是基于php+mysql模式的快速建站系统 Joomla!存在安全漏洞，允许攻击者获得敏感信息或绕过安全限制 -密码生成算法存在错误可生成可猜测密码，通过密码重置功能可猜测生成的密码信息。 -存在一个不充分权限检查错误，可被利用获得管理员后端的部分敏感信息 0 Joomla! 1.5.x 厂商解决方案 Joomla! 1.5.26已经修复此漏洞，建议用户下载使用： http://www.joomla.org/...

[20120305] - Core - Password Change

Insufficient randomness leads to password reset vulnerability...

[20120304] - Core - Password Change

Insufficient randomness leads to password reset vulnerability...

Update: Zappos Says 24 Million Customers Affected By Data Breach

UPDATE: Online retailer Zappos said that its network has been compromised and attackers were able to access personal information belonging to more than 24 million of its customers. Zappos said that its database that contains customers’ credit card numbers was not compromised, however. “We were...

Environmental activism site Care2 hacked

Environmental activism site Care2 hacked Yesterday Care2, one of the biggest Environmental activism website issue a alert email to all there customers that Care2.com's website was hacked revealing usernames and passwords for the sites nearly 18 million users. Care2 said "To protect Care2 members ...

CVE-2011-4678

The password reset feature in One Click Orgs before 1.2.3 generates different error messages for failed reset attempts depending on whether the e-mail address is registered, which allows remote attackers to enumerate user accounts via a series of requests...

Design/Logic Flaw

The password reset feature in One Click Orgs before 1.2.3 generates different error messages for failed reset attempts depending on whether the e-mail address is registered, which allows remote attackers to enumerate user accounts via a series of requests...

CVE-2011-4678

The password reset feature in One Click Orgs before 1.2.3 generates different error messages for failed reset attempts depending on whether the e-mail address is registered, which allows remote attackers to enumerate user accounts via a series of requests...

CVE-2011-4678

CVE-2011-4678 affects One Click Orgs prior to version 1.2.3. The password reset feature discloses user existence by returning different error messages for failed reset attempts based on whether an email address is registered. This creates a remote account-enumeration risk via successive reset req...

CVE-2011-4321

The password reset functionality in Joomla! 1.5.x through 1.5.24 uses weak random numbers, which makes it easier for remote attackers to change the passwords of arbitrary users via unspecified vectors...

Design/Logic Flaw

The password reset functionality in Joomla! 1.5.x through 1.5.24 uses weak random numbers, which makes it easier for remote attackers to change the passwords of arbitrary users via unspecified vectors...

CVE-2011-4321

The CVE-2011-4321 issue affects Joomla! 1.5.x through 1.5.24, where the password reset function uses weak random numbers. This weakness can allow remote attackers to change the passwords of arbitrary users via unspecified vectors. The provided sources confirm the affected product range and the ro...