Design/Logic Flaw

MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 uses weak random numbers for password reset tokens, which makes it easier for remote attackers to change the passwords of arbitrary users...

CVE-2012-1581

MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 uses weak random numbers for password reset tokens, which makes it easier for remote attackers to change the passwords of arbitrary users. Any extension developers using mtrand to generate random numbers in contexts where security is require...

CVE-2012-1581

MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 uses weak random numbers for password reset tokens, which makes it easier for remote attackers to change the passwords of arbitrary users...

CVE-2012-1581

CVE-2012-1581 affects MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2. The root cause is the use of weak random numbers for password reset tokens, which can enable remote attackers to change arbitrary user passwords. The context across connected sources reiterates the same affected versio...

CVE-2012-1581

MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 uses weak random numbers for password reset tokens, which makes it easier for remote attackers to change the passwords of arbitrary users...

CVE-2012-1581

MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 uses weak random numbers for password reset tokens, which makes it easier for remote attackers to change the passwords of arbitrary users...

PT-2012-3355

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.17.x through 1.17.2 MediaWiki versions 1.18.x through 1.18.1 Description The issue allows remote attackers to change the passwords of arbitrary users due to the use of weak random numbers for password reset tokens...

CVE-2012-1581: Undefined Security Weakness

MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 uses weak random numbers for password reset tokens, which makes it easier for remote attackers to change the passwords of arbitrary users...

Pinterestclones XSS/CSRF Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Pinterestclones Multiple Vulnerabilities Author: DaOne Price: $199.99 Software Link: http://www.pinterestclones.com/ Google Dork: N/A Persistent XSS How to exploit: 1-go to : http://site.com/createusernamen/ 2-Put anything in th...

Sitecom Home Storage Center Authorization Bypass

Exploit for php platform in category web applications Authorization Bypass Vulnerability in Password Reset Function Sitecom Home Storage Center 0-day Severity Rating: High Discovery Date: July 29, 2012 Vendor Notification: July 30, 2012 Disclosure Date: September 6, 2012 Vulnerability Type=...

Conceptronic Grab'n'Go Authorization Bypass

Exploit for php platform in category web applications Authorization Bypass Vulnerability in Password Reset Function Conceptronic Grab’n’Go Network Storage 0-day Severity Rating: High Discovery Date: July 29, 2012 Vendor Notification: July 30, 2012 Disclosure Date: September 6, 2012 Vulnerability...

Sitecom Home Storage Center - Authentication Bypass

Sitecom Home Storage Center - Authentication Bypass Security Advisory AA-006: Authorization Bypass Vulnerability in Password Reset Function Sitecom Home Storage Center 0-day Severity Rating: High Discovery Date: July 29, 2012 Vendor Notification: July 30, 2012 Disclosure Date: September 6, 2012...

PT-2012-57

Name of the Vulnerable Software and Affected Versions 1С-Битрикс: Управление сайтом affected versions not specified Description The issue is related to errors in the mt rand pseudorandom number generator code. It allows a remote attacker to obtain the password reset confirmation code for any user...

Server: Timing attack on the password reset

The "Lost Password" implementation is vulnerable to a Remote Timing Attack. The token used to secure the password reset is fetched from the database and compared to the user-specified value using the equals operator. An attacker successfully rebuilding the token can then specify an arbitrary...

Timing attack on the password reset - ownCloud

The "Lost Password" implementation is vulnerable to a Remote Timing Attack. The token used to secure the password reset is fetched from the database and compared to the user-specified value using the equals operator. An attacker successfully rebuilding the token can then specify an arbitrary...

CVE-2012-4582

McAfee Email and Web Security EWS 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway MEG 7.0 before Patch 1, allows remote authenticated users to reset the passwords of arbitrary administrative accounts via unspecified vectors...

CVE-2012-4582

McAfee EWS 5.x (before 5.5 Patch 6) and 5.6 (before Patch 3), and McAfee MEG 7.0 (before Patch 1) are affected by CVE-2012-4582. The vulnerability allows remote authenticated users to reset the passwords of arbitrary administrative accounts via unspecified vectors. The impact is administrative cr...

Symantec Web Gateway 5.0.3.18 Password Change

@Kc57 Symantec Web Gateway "Symantec Web Gateway %q This module will change the password for the specified account on a Symantec Web Gatewaye server. , 'License' = MSFLICENSE, 'Version' = "$Revision: 0 $", 'Author' = 'Kc57', , 'References' = 'CVE', '2012-2977' , 'OSVDB', '0' , 'BID', '54430' ,...

PT-2012-5490

Name of the Vulnerable Software and Affected Versions McAfee Email and Web Security EWS versions 5.x through 5.5 before Patch 6 McAfee Email and Web Security EWS version 5.6 before Patch 3 McAfee Email Gateway MEG versions 7.0 before Patch 1 Description The issue allows remote authenticated users...

CVE-2012-4582: Undefined Security Weakness

McAfee Email and Web Security EWS 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway MEG 7.0 before Patch 1, allows remote authenticated users to reset the passwords of arbitrary administrative accounts via unspecified vectors...