CVE-2016-3084: Undefined Security Weakness

The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple...

PT-2017-6641

Name of the Vulnerable Software and Affected Versions Cloud Foundry Runtime cf-release versions v208 or earlier UAA Standalone versions 2.2.5 or earlier Pivotal Cloud Foundry Runtime versions 1.4.5 or earlier Description The issue arises when a user changes their email address, and old password...

CVE-2016-10073

The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and potentially obtain sensitive information via a crafted HTTP Host header, as demonstrated by a password reset request...

CVE-2016-10073

The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and potentially obtain sensitive information via a crafted HTTP Host header, as demonstrated by a password reset request...

Design/Logic Flaw

The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and potentially obtain sensitive information via a crafted HTTP Host header, as demonstrated by a password reset request...

CVE-2016-10073

The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and potentially obtain sensitive information via a crafted HTTP Host header, as demonstrated by a password reset request...

CVE-2016-10073

Vanilla Forums

The Uber platform coming out of authentication vulnerabilities, exploit the vulnerability can reset any account password-loophole warning-the black bar safety net

Italian security expert Vincenzo C. Aka found the Uber platform authentication vulnerabilities, any account can use this vulnerability to reset the password, this discovery yesterday officially announced. In fact, the initiator of the“authentication crisis”the vulnerability is in the seven months...

Arbitrary Password Reset Vulnerability in 'Admin_Edit.aspx' File of Micro Xia Online Learning Platform

Micro Xia Online Learning Platform is an online education system based on B/S architecture. An arbitrary password reset vulnerability exists in the 'AdminEdit.aspx' file of the Weixia Online Learning Platform. It allows an attacker to reset the administrator password by entering a new password in...

Weblate: Login CSRF : Login Authentication Flaw

Hi Team, Domain: demo.weblate.org In this bug, i have found a way to login any person to the attackers account, therefor when any user login to attackers account, the attacker can see the victims activity inside attackers account such as sensitive information. The issue relies on registration...

Weblate: Design Flaw in session management of password reset

Hi team, I found that there is some design flaw in the website in Password reset functionality. This report is basically combination of two reports 223329 & 223339 those are already resolved but i bypass the fixes provided for. Issue 1: Bypass the Logout CSRF fix. Steps to reproduce/POC: 1. Login...

CVE-2017-4991: UAA password reset vulnerability | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Versions Affected cf-release versions prior to v260 UAA release: 2.x versions prior to v2.7.4.16 3.6.x versions prior to v3.6.10 3.9.x versions prior to v3.9.12 Other versions prior to v3.17.0 UAA bosh release uaa-release: 13.x versions prior to v13.1...

Mailcow 0.14 - Cross-Site Request Forgery

Mailcow 0.14 - Cross-Site Request Forgery + Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MAILCOW-v0.14-CSRF-PASSWORD-RESET-ADD-ADMIN.txt + ISR: ApparitionSec Vendor: ============= mailcow.email mailcow.github.io Produc...

Mantis Bug Tracker verify.php confirm_hash Remote Password Reset (CVE-2017-7615)

A remote password reset vulnerability exists in Mantis Bug Tracker. The vulnerability is due to a lack of input validation on the confirmhash parameter when verifying password reset requests. A remote, unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request to th...

Roundcube Webmail < 1.0.11, 1.1.x < 1.1.9, 1.2.x < 1.2.5 Password Reset Vulnerability

Roundcube Webmail is prone to an arbitrary password reset vulnerability. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is fre...

Mailcow 0.14 - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications + Credits: John Page a.k.a hyp3rlinx Vendor: ============= mailcow.email mailcow.github.io Product: =========== The integrated mailcow UI allows administrative work on your mail server instance as well as separated domain administrator and...

Mailcow 0.14 - Cross-Site Request Forgery

Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MAILCOW-v0.14-CSRF-PASSWORD-RESET-ADD-ADMIN.txt + ISR: ApparitionSec Vendor: ============= mailcow.email mailcow.github.io Product: =========== The integrated mailcow UI...

Arbitrary User Password Reset Vulnerability in Sichuan Tianfu New District Chengdu Administrative App

Tianfu Government App is a credible government service platform. An arbitrary user password reset vulnerability exists in the Sichuan Tianfu New Area Chengdu Direct Administration App. An attacker can reset the password by using a cell phone number...

Beijing Cloud Fox Times Android App Has Arbitrary Password Reset Vulnerability

Beijing Cloud Fox Times Technology Co., Ltd. is a cutting-edge domestic special intelligent equipment research and development company, is the industry terminal and service solution experts. Beijing Cloud Fox Times Android App exists arbitrary password reset vulnerability, through the other party...

Access to the expert management system system/UpdatePassword.asp file exists arbitrary user password change vulnerability

Despatch Access Specialist Management System is a CATI software that integrates telephone access, call center, and web survey into one; a CATI software that provides hosted services with "Cloud Computing" and "SaaS Model". An arbitrary user password change vulnerability exists in the Access...