Western data WD from the encrypted hard drive was traced to the presence of vulnerability-vulnerability warning-the black bar safety net

Researchers said, there are several versions of the encrypted Western Digital hard drive there are many vulnerabilities, the hack once you get to the physical contact of the opportunity, you can easily get inside the data, during which time you can disregard the hard disk password. Western Digita...

Uber: Issue with Password reset functionality

Dear Team, There are password change issues with uber. there are two issues: 1User is not receiving notification when he reset password via password reset link. 2Password reset link is not expiring after used once. Good thing: when user change his info like profile update, password change. User g...

Devellion CubeCart Password Reset Vulnerability

Devellion CubeCart is a free and open source e-commerce shopping cart software. The classes/admin.class.php script in Devellion CubeCart fails to properly validate that a password reset request is occurring, allowing a remote attacker to change the administrator password by sending a specially...

CVE-2015-6928

classes/admin.class.php in CubeCart 5.2.12 through 5.2.16 and 6.x before 6.0.7 does not properly validate that a password reset request was made, which allows remote attackers to change the administrator password via a recovery request with a space character in the validate parameter and the...

CVE-2015-6928

classes/admin.class.php in CubeCart 5.2.12 through 5.2.16 and 6.x before 6.0.7 does not properly validate that a password reset request was made, which allows remote attackers to change the administrator password via a recovery request with a space character in the validate parameter and the...

CVE-2015-6928

classes/admin.class.php in CubeCart 5.2.12 through 5.2.16 and 6.x before 6.0.7 does not properly validate that a password reset request was made, which allows remote attackers to change the administrator password via a recovery request with a space character in the validate parameter and the...

CVE-2015-6928

CubeCart is affected by a password-reset validation flaw in admin.class.php affecting 5.2.12–5.2.16 and 6.x (before 6.0.7). The issue allows a remote attacker to change the administrator password by sending a recovery request with a space character in the validate parameter and the administrator ...

PT-2015-7409

Name of the Vulnerable Software and Affected Versions CubeCart versions 5.2.12 through 5.2.16 CubeCart versions 6.x before 6.0.7 Description The issue arises from improper validation of password reset requests, allowing remote attackers to change the administrator password. This can be achieved b...

Shopify: create staff member without owner access

Hi as you mentioned in 56726 "Only the the store owner is allowed to create new staff members" admins can't create new staff members! but with this vulnerability admins can use api to create user! steps: - get access token for one full access admin you can send request to xauth or sniff it from...

Apple iOS iOS Backup Password Reset Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. Apple iOS has a security vulnerability that allows physically accessible local users to be able to reset passwords for failed iOS backup attempts...

Seagate BlackArmor NAS device static adminstrator Password Reset vulnerability

Seagate BlackArmor NAS 路由器可以在没有任何授权下复位管理员密码，并且可以在新手引导下重置为任意密码 可以直接访问 http://目标IP地址/d41d8cd98f00b204e9800998ecf8427e.php 这个文件，然后就可以重置管理员密码。...

The vulnerability of the microprogramming software of the Cisco TelePresence Video Communication Server allows a intruder to bypass the passwords of unauthorized users.

The vulnerability in the web-based administration interface of Cisco TelePresence Video Communication Server software is related to errors in managing registration data. Exploiting this vulnerability could allow a malicious actor to reset the passwords of arbitrary users remotely...

Mantis Bug Tracker 1.2.19 - Host Header

Mantis Bug Tracker 1.2.19 - Host Header Exploit Title: MantisBT 1.2.19 - Host header attack vulnerability Date: 07-09-2015 Exploit Author: Pier-Luc Maltais Centre opérationnel de sécurité informatique gouvernemental COSIG Vendor Homepage: https://www.mantisbt.org/ Software Link:...

Mantis Bug Tracker 1.2.19 - Host Header

Exploit Title: MantisBT 1.2.19 - Host header attack vulnerability Date: 07-09-2015 Exploit Author: Pier-Luc Maltais Centre opérationnel de sécurité informatique gouvernemental COSIG Vendor Homepage: https://www.mantisbt.org/ Software Link:...

74cms最新版重置任意账号密码

简要描述： 密码重置机制可以绕过，同时可重置任意账号密码 demo测试成功 详细说明： 先看下 \user\usergetpass.php $act = !empty$REQUEST'act' ? trim$REQUEST'act' : 'enter'; $smarty-assign'headernav',"getpass"; if $act=='enter' $smarty-assign'title','找回密码 - '.$CFG'sitename'; $token=substrmd5mtrand100000, 999999, 8,16; //生成token...

Edimax PS-1206MF - Web Admin Authentication Bypass

Edimax PS-1206MF - Web Admin Authentication Bypass Title: Edimax PS-1206MF - Web Admin Auth Bypass Date: 30.08.15 Vendor: edimax.com Firmware version: 4.8.25 Author: Smash Contact: smash at devilteam.pl HTTP authorization is not being properly verified while sendind POST requests to .cgi, remote...

Edimax PS-1206MF - Web Admin Authentication Bypass

Title: Edimax PS-1206MF - Web Admin Auth Bypass Date: 30.08.15 Vendor: edimax.com Firmware version: 4.8.25 Author: Smash Contact: smash at devilteam.pl HTTP authorization is not being properly verified while sendind POST requests to .cgi, remote attacker is able to change specific settings or eve...

Edimax PS-1206MF - Web Admin Auth Bypass Vulnerability

Exploit for hardware platform in category web applications Title: Edimax PS-1206MF - Web Admin Auth Bypass Date: 30.08.15 Vendor: edimax.com Firmware version: 4.8.25 Author: Smash Contact: smash at devilteam.pl HTTP authorization is not being properly verified while sendind POST requests to .cgi,...

CVE-2015-4319

CVE-2015-4319 affects Cisco TelePresence Video Communication Server (VCS) Expressway; the Password Change function in the Administrative Web Interface fails to properly enforce authorization, enabling an authenticated, remote attacker to reset arbitrary active-user passwords via crafted packets. ...

CVE-2015-4319: Undefined Security Weakness

The password-change feature in the administrative web interface in Cisco TelePresence Video Communication Server VCS Expressway X8.5.1 improperly performs authorization, which allows remote authenticated users to reset arbitrary active-user passwords via unspecified vectors, aka Bug ID CSCuv12338...