CVE-2017-12850

CVE-2017-12850 affects Kanboard prior to 1.0.46. An authenticated standard user could reset the password of other users (including the admin) by altering form data. Impact is privilege escalation within Kanboard; connected sources reference the Kanboard commit and CVE coverage. Remediation: upgra...

Information Disclosure

django-allauth is vulnerable to information disclosure. The library passes the password reset token in the URL, allowing a malicious user to obtain the reset token through the referrer header...

PT-2017-12726

Name of the Vulnerable Software and Affected Versions kanboard versions prior to 1.0.46 Description The issue allows an authenticated standard user to reset the admin's password by modifying form data. Recommendations For versions prior to 1.0.46, update to version 1.0.46 or later to resolve the...

PT-2017-12725

Name of the Vulnerable Software and Affected Versions Kanboard versions prior to 1.0.46 Description The issue allows an authenticated standard user to reset the password of other users, including the admin, by altering form data. Recommendations For versions prior to 1.0.46, update to version...

Wheat Home Edition Android App Has Logic Design Flaw

Wheat Home Edition app is a video surveillance software that provides PV monitoring services. Wheat Home Edition Android App has a logic flaw vulnerability. Allows an attacker to exploit the vulnerability to reset the password of any user of the power station with just the UID...

Wheat Pro Android App Has Logic Design Flaw

Wheat Pro app is a mobile office software that integrates PV plant monitoring, work order processing, PV plant troubleshooting and other functions. Wheat Pro Android App has a logic flaw vulnerability. Allows attackers to exploit the vulnerability to reset any enterprise power plant password with...

Arbitrary Account Password Reset Vulnerability in PV Guard Android APP

PV Guard is a PV monitoring and operation management platform based on big data and knowledge base. The PV Guard Android APP has an arbitrary account password reset vulnerability, which allows attackers to exploit the vulnerability to change the password of the other party's cell phone number onl...

Logic Design Vulnerability in ECS Online Learning System v3.1.0

E-learning Online Learning System is an online learning platform system developed with thinkphp+bootstrap as the framework. E-learning system v3.1.0 has a logical design vulnerability that can be exploited by attackers to reset any user's password and obtain sensitive user information...

NiuShop_b2c_data_release has multiple vulnerabilities

NiuShop open source mall system is by Shanxi Niu Cool Information Technology Co., Ltd. completely independent design, research and development of a set of PHP open source e-commerce system . NiuShopb2cdatarelease exists to bypass the payment vulnerability , file upload vulnerability , arbitrary...

Jinan government services micro-portal has arbitrary password reset vulnerability

Jinan government services micro-portal, able to release the latest information of Jinan Municipal Government Service Center Portal in a timely manner, the content of which includes clerical services, government information disclosure, communication and interaction, and satisfaction evaluation. It...

ist.mit.edu XSS vulnerability

Vulnerable URL: http://ist.mit.edu/?q=user/password/" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 02.11.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check ist.mit.edu SSL...

Unauthorized Access

WordPress is vulnerable to unauthorized access. The attack is possible because the library uses the SERVERNAME variable to get the hostname of the server for PHP mail functions, allowing an attacker to modify the hostname of his choice and trigger a password reset function. However, the attack ca...

arxius: No Email Verification and No email sent on Forget Pasword

I noticed that when i sign up on arxius.io,it didnt verify email and when i reset password,i didnt receive any email...

Beauty Camera App Has Design Logic Flaws

Beauty Camera is a beauty camera with special effects filters under Guangzhou Beauty Information Technology Co. There is a design logic vulnerability in Beauty Camera APP, which can be exploited by attackers to arbitrarily register users and reset passwords...

Legal Robot: No error or notification on Reset password page

Hello I found that there is no error occurring at Reset password page. There should error occur when user enter the wrong email-id or the entered password is used in 180 previous days or token got expired because from previous reset link also the page got opened so, user would not be able to...

Fired Up Acting App Has Logic Design Flaws

Fired Up Acting app is an artist booking application launched by Beijing Fired Up Technology Co. There is a logical design vulnerability in the FIRE Performing Arts app. Attackers can use the vulnerability to perform arbitrary user registration, arbitrary password reset operations...

Mobile movie app has logic design flaws

Mobile Movie App is a video product specially launched for the majority of movie lovers. There is a logical design vulnerability in the mobile movie app. Attackers can use the vulnerability to perform arbitrary user registration, arbitrary password reset operations...

Ubi smartwatch app has a logic design flaw

The Ubi Smartwatch app is a mobile app that works with your baby's smartwatch. A logical design vulnerability exists in the Ubi Smartwatch app. An attacker can exploit the vulnerability to reset any password...

Zhengnuo (Shanghai) Energy Conservation Technology Co., Ltd Opler APP has multiple vulnerabilities

Opler APP is a mobile software with a complete backend management system. Zhengnuo Shanghai Energy Conservation Technology Co., Ltd Opler APP exists arbitrary password reset, arbitrary user registration, override and stored cross-site scripting vulnerabilities. Attackers can use the vulnerability...

Hunan Ding Ding Easily Builds App with Multiple Vulnerabilities

Hunan Ding Ding Easily Build APP is an order-taking tool for engineers. Hunan Ding Ding Easy Build APP has arbitrary user registration, payment flaws and arbitrary password reset vulnerability. Attackers can use the vulnerability to register any cell phone number, modify any user order informatio...