9775 matches found
Incorrect cache context on password reset page
More info at https://www.drupal.org/SA-CORE-2016-005...
Pushwoosh: Password Forgot/Password Reset Request Bug
Password Forgot/Password Reset Request Bug...
InvoicePlane Password Reset Vulnerability
InvoicePlane is a free and open source goods billing and customer management software. A password reset vulnerability exists in the index.php/sessions/passwordreset page of InvoicePlane version 1.4.8, which can be exploited by an attacker to reset the password of any user...
semcms web_email.php SQL Injection Vulnerability
SemCms is a set of open source foreign trade enterprise website management system, mainly used for foreign trade enterprises, compatible with IE, Firefox and other mainstream browsers.SemCms using php and vb language writing, combined with apache or iis running. semcms webemail.php reset password...
InvoicePlane 1.4.8 Incorrect Access Control
Exploit Title: InvoicePlane v1.4.8 Incorrect Access Control for password reset Date: 12-11-2016 Exploit Author: feedersec Contact: [email protected] Vendor Homepage: https://invoiceplane.com Software Link: https://invoiceplane.com/download/v1.4.8 Version: v1.4.8=20 Tested on: ubuntu 16.04 LTS...
InvoicePlane 1.4.8 - Password Reset Vulnerability
Exploit for php platform in category web applications Exploit Title: InvoicePlane v1.4.8 Incorrect Access Control for password = reset Date: 12-11-2016 Exploit Author: feedersec Contact: email protected Vendor Homepage: https://invoiceplane.com Software Link:...
InvoicePlane 1.4.8 - Password Reset
Exploit Title: InvoicePlane v1.4.8 Incorrect Access Control for password = reset Date: 12-11-2016 Exploit Author: feedersec Contact: [email protected] Vendor Homepage: https://invoiceplane.com Software Link: https://invoiceplane.com/download/v1.4.8 Version: v1.4.8=20 Tested on: ubuntu 16.04 LTS...
InvoicePlane 1.4.8 - Password Reset
InvoicePlane 1.4.8 - Password Reset Exploit Title: InvoicePlane v1.4.8 Incorrect Access Control for password = reset Date: 12-11-2016 Exploit Author: feedersec Contact: [email protected] Vendor Homepage: https://invoiceplane.com Software Link: https://invoiceplane.com/download/v1.4.8 Version:...
Legal Robot: Password reset access control
A security researcher discovered that during password reset, the user was automatically logged in if the password reset was identical to their original password; this was the result of a change to prevent password resets to the identical password. However, if the intent is to reset the password, ...
November 8, 2016 — KB3198585 (OS Build 10240.17190)
None None...
DokuWiki Password Reset Address Spoof And SSRF Vulnerabilities
DokuWiki is prone to ssrf and password reset address spoof vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
CVE-2016-7965
DokuWiki 2016-06-26a and older uses $SERVERHTTPHOST instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header. The vulnerability can be triggered only if the Host...
CVE-2016-7965
DokuWiki 2016-06-26a and older uses $SERVERHTTPHOST instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header. The vulnerability can be triggered only if the Host...
DEBIAN-CVE-2016-7965
DokuWiki 2016-06-26a and older uses $SERVERHTTPHOST instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header. The vulnerability can be triggered only if the Host...
Design/Logic Flaw
DokuWiki 2016-06-26a and older uses $SERVERHTTPHOST instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header. The vulnerability can be triggered only if the Host...
CVE-2016-7965
DokuWiki 2016-06-26a and older uses $SERVERHTTPHOST instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header. The vulnerability can be triggered only if the Host...
UBUNTU-CVE-2016-7965
DokuWiki 2016-06-26a and older uses $SERVERHTTPHOST instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header. The vulnerability can be triggered only if the Host...
CVE-2016-7965
CVE-2016-7965 affects DokuWiki up to 2016-06-26a: password-reset URL construction uses $_SERVER[HTTP_HOST] instead of the configured baseurl. This allows a remote unauthenticated attacker to manipulate the password-reset URL hostname via the HTTP Host header, enabling phishing; exploitation requi...
CVE-2016-7965
DokuWiki 2016-06-26a and older uses $SERVERHTTPHOST instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header. The vulnerability can be triggered only if the Host...
CVE-2016-7965
DokuWiki 2016-06-26a and older uses $SERVERHTTPHOST instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header. The vulnerability can be triggered only if the Host...