7653 matches found
WordPress < 2.8.4 'wp-login.php' 'key' Parameter Remote Administrator Password Reset (uncredentialed check)
According to its version number, the version of WordPress running on the remote server has a flaw in the password reset mechanism. Validation of the secret user activation key can be bypassed by providing an array instead of a string. This allows anyone to reset the password of the first user in...
WordPress < 2.8.4 Password Reset
The version of WordPress hosted on the remote web server has a flaw in the password reset mechanism. Validation of the secret user activation key can be bypassed by providing an array instead of a string. This allows anyone to reset the password of the first user in the database, which is usually...
WordPress Hit by Password-Reset Vulnerability
Researchers are sounding the alarm for a serious administrator password-reset vulnerability affecting the latest version of WordPress, the popular open-source blog publishing platform. The flaw, which can be exploited via the browser, gives an attacker a trivial way to compromise the admin accoun...
WordPress 2.8.3 Admin Reset Password
============================================= - Release date: August 10th, 2009 - Discovered by: Laurent Gaffié - Severity: Medium ============================================= I. VULNERABILITY ------------------------- WordPress = 2.8.3 Remote admin reset password II. BACKGROUND...
Spiceworks 3.6.31847 XSS / XSRF
nGenuity Information Services - Security Advisory Advisory ID: NGENUITY-2009-009 - Spiceworks Multiple Vulnerabilities XSS & CSRF Application: Spiceworks 3.6.31847 Vendor: Spiceworks Vendor website: http://www.spiceworks.com Author: Adam Baldwin [email protected] Class: XSS, CSRF I...
WordPress Core 2.8.3 - Remote Admin Reset Password
============================================= - Release date: August 10th, 2009 - Discovered by: Laurent Gaffié - Severity: Medium ============================================= I. VULNERABILITY ------------------------- WordPress = 2.8.3 Remote admin reset password II. BACKGROUND...
[NGENUITY] - Spiceworks Multiple Vulnerabilities (XSS & CSRF)
nGenuity Information Services - Security Advisory Advisory ID: NGENUITY-2009-009 - Spiceworks Multiple Vulnerabilities XSS & CSRF Application: Spiceworks 3.6.31847 Vendor: Spiceworks Vendor website: http://www.spiceworks.com Author: Adam Baldwin [email protected] Class: XSS, CSRF I...
wordpress -- remote admin password reset vulnerability
WordPress reports: A specially crafted URL could be requested that would allow an attacker to bypass a security check to verify a user requested a password reset. As a result, the first account without a key in the database usually the admin account would have its password reset and a new passwor...
Alternative get 94kk Forum administrator password to get the shell-vulnerability warning-the black bar safety net
Excerpt from: Qglfnt's Blog Not much to say, directly into the topic. Can to on Google to the“Powered by 94kk 2.1.0”this is 94KKBBS the latest edition, as a keyword search. Just find a forum, click on“login”in the login do not fill in the user name and password, but directly click on the“Forgot...
Modify the MYSQL password and the password to crack the commonly used method-vulnerability warning-the black bar safety net
Modify the MYSQL password and the password to crack the commonly used method First statement a little, in most cases, modify the MySQL is need to have mysql in root, so the General user cannot change the password, unless the request is an administrator. Method one Using phpmyadmin, this is the...
ZenPhoto Gallery 1.2.5 Password Reset
?php Zen Photo Adminstrator Password Steal/Reset Exploit +================================================================+ Discovered and coded by petros at dusecurity.com +----------------------------------------------------------------+ Affects: ZenPhoto Gallery 1.2.5...
ZenPhoto Gallery 1.2.5 - Admin Password Reset (Cross-Site Request Forgery)
ZenPhoto Gallery 1.2.5 - Admin Password Reset Cross-Site Request Forgery ?php Zen Photo Adminstrator Password Steal/Reset Exploit +================================================================+ Discovered and coded by petros at dusecurity.com...
ZenPhoto Gallery 1.2.5 Admin Password Reset (CRSF)
Exploit for unknown platform in category web applications ================================================== ZenPhoto Gallery 1.2.5 Admin Password Reset CRSF ================================================== ?php Zen Photo Adminstrator Password Steal/Reset Exploit...
ZenPhoto Gallery 1.2.5 Admin Password Reset (CRSF)
No description provided by source. ?php Zen Photo Adminstrator Password Steal/Reset Exploit +================================================================+ Discovered and coded by petros at dusecurity.com +----------------------------------------------------------------+ Affects: ZenPhoto...
ZenPhoto Gallery 1.2.5 - Admin Password Reset (Cross-Site Request Forgery)
?php Zen Photo Adminstrator Password Steal/Reset Exploit +================================================================+ Discovered and coded by petros at dusecurity.com +----------------------------------------------------------------+ Affects: ZenPhoto Gallery 1.2.5...
WordPress口令重置用户名枚举漏洞
BUGTRAQ ID: 35581 CVECAN ID: CVE-2009-2335,CVE-2009-2336 WordPress是一款免费的论坛Blog系统。 WordPress对于使用已有的用户名和不存在用户名的登录尝试会返回不同的结果，这降低了暴力猜测攻击的复杂性；此外在使用口令重置界面请求新口令的时候，对于已有的和不存在的用户名也会返回不同的结果。 WordPress WordPress 2.6.5 WordPress WordPress MU 2.7.1 WordPress ---------...
Research: Password 'secret question' woefully insecure
In research to be presented at the IEEE Symposium on Security and Privacy virginia.edu this week, researchers from Microsoft and Carnegie Mellon University plan to show that the secret questions used to secure the password-reset functions of a variety of websites are woefully insecure. In a study...
TotalCalendar 2.4 Remote Password Change Exploit
Exploit for unknown platform in category web applications ================================================ TotalCalendar 2.4 Remote Password Change Exploit ================================================ Powered by: TotalCalendar 2.4 Remote Password Change Cod3d By ThE g0bL!N // Should we show t...
Zabbix Multiple Frontend CSRF (Password reset & command execution)
nGenuity Information Services - Security Advisory Advisory ID: NGENUITY-2009-006 - Zabbix Multiple Frontend CSRF Application: Zabbix 1.6.2 Vendor: Zabbix Vendor website: http://www.zabbix.com Author: Adam Baldwin [email protected] I. BACKGROUND "ZABBIX is an enterprise-class open source...
Zabbix 1.6.2 Cross Site Request Forgery
nGenuity Information Services - Security Advisory Advisory ID: NGENUITY-2009-006 - Zabbix Multiple Frontend CSRF Application: Zabbix 1.6.2 Vendor: Zabbix Vendor website: http://www.zabbix.com Author: Adam Baldwin [email protected] I. BACKGROUND "ZABBIX is an enterprise-class open source...