CVE-2006-4247

CVE-2006-4247 affects Plone 2.5 and 2.5.1 Release Candidate with the Password Reset Tool prior to 0.4.1, enabling attackers to reset other users’ passwords due to an erroneous security declaration. Affected component: Password Reset Tool; vulnerability type: unspecified in detail, but impact is u...

CubeCart 3.0.x - adminforgot_pass.php?user_name SQL Injection

CubeCart 3.0.x - adminforgotpass.php?username SQL Injection source: https://www.securityfocus.com/bid/20215/info CubeCart is prone to multiple input-validation vulnerabilities, including information-disclosure, cross-site scripting, and SQL-injection issues, because the application fails to...

DCP-PortalSE6.0.txt

Hello,, DCP-Portal SE 6.0 multiple injections Discovered By : HACKERS PAL Copy rights : HACKERS PAL Website : http://www.soqor.net Email Address : [email protected] sql injections if magicqoutesgpc = off // lostpassword.php you can recive the reset password email on your email for any user you...

Cisco PIX / Adaptive Security Appliances / Firewall Services Module password reset

Under some conditions user password can be reset to some known value...

TOPo v.2.2.178 Account Reset

TOPo v.2.2.178 Account Reset Author: Attila Gerendi Darkz Date: July 12, 2006 Package: TOPo http://ej3soft.ej3.net/ Versions Affected: 2.2.178 Other versions may also be affected. Severity: Password Reset Description: It is possible to overide an existing entry posting a new entry with a previous...

CVE-2006-2546

A recommended admin password reset mechanism for BEA WebLogic Server 8.1, when followed before October 10, 2005, causes the administrator password to be stored in cleartext in the domain directory, which could allow attackers to gain privileges...

Design/Logic Flaw

A recommended admin password reset mechanism for BEA WebLogic Server 8.1, when followed before October 10, 2005, causes the administrator password to be stored in cleartext in the domain directory, which could allow attackers to gain privileges...

CVE-2006-2546

A recommended admin password reset mechanism for BEA WebLogic Server 8.1, when followed before October 10, 2005, causes the administrator password to be stored in cleartext in the domain directory, which could allow attackers to gain privileges...

CVE-2006-2546

CVE-2006-2546 affects BEA WebLogic Server 8.1. A recommended admin password reset mechanism used before 2005-10-10 results in the administrator password being stored in cleartext in the domain directory, which could allow an attacker with access to the domain directory to gain privileges. Connect...

ezusermanager.txt

Title : ezUserManager = v1.6 Remote File Inclusion - URL : http://www.ezusermanager.com/ - Dork : "powered by ezUserManager" - Author : OLiBekaS - contact : olibekasatgmail.com - greetz : Renzokuzen, Skulmatic, weleh, brokencode, bigmaster and all papmahackerlink crew - Exploit :...

Design/Logic Flaw

Unspecified vulnerability in the HTTP management interface in Cisco Unity Express CUE 2.22 and earlier, when running on any CUE Advanced Integration Module AIM or Network Module NM, allows remote authenticated attackers to reset the password for any user with an expired password...

CVE-2006-2166

Unspecified vulnerability in the HTTP management interface in Cisco Unity Express CUE 2.22 and earlier, when running on any CUE Advanced Integration Module AIM or Network Module NM, allows remote authenticated attackers to reset the password for any user with an expired password...

Cisco Unity Express Expired Password Reset Privilege Escalation

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES TH...

versatileBulletinBoard 1.00 RC2 (board takeover) SQL Injection Exploit

Exploit for unknown platform in category web applications ====================================================================== versatileBulletinBoard 1.00 RC2 board takeover SQL Injection Exploit ====================================================================== ?php --- versatilexpl.php 4....

Cyphor 0.19 SQL Injection / Board takeover / cross site scripting

Cyphor 0.19 SQL Injection / Board takeover / cross site scripting 1if magic quotes off - SQL Injection: by "Forgot your password?" feature you can send yourself a new admin password and reset it, poc: email: youremail nick: 'or'X'='X soon, you will receive an email like this: You have registered...

[SA17009] Macromedia Breeze Password Reset Security Issue

TITLE: Macromedia Breeze Password Reset Security Issue SECUNIA ADVISORY ID: SA17009 VERIFY ADVISORY: http://secunia.com/advisories/17009/ CRITICAL: Less critical IMPACT: Exposure of sensitive information WHERE: Local system SOFTWARE: Macromedia Breeze 5.x http://secunia.com/product/5779/...

Macromedia Breeze information leak

"reset password" feature stores password in clear text...

CVE-2005-3101

The password reset feature in Movable Type before 3.2 generates different error messages depending on whether a user exists or not, which allows remote attackers to determine valid usernames...

CVE-2005-3101

The password reset feature in Movable Type before 3.2 generates different error messages depending on whether a user exists or not, which allows remote attackers to determine valid usernames...

CVE-2005-3101

Movable Type prior to 3.2 exposes username enumeration via the password reset feature: authentication messages differ based on user existence, enabling remote attackers to determine valid usernames. No other details provided in the connected docs.