[20120304] - Core - Password Change

Insufficient randomness leads to password reset vulnerability...

[20120305] - Core - Password Change

Insufficient randomness leads to password reset vulnerability...

Update: Zappos Says 24 Million Customers Affected By Data Breach

UPDATE: Online retailer Zappos said that its network has been compromised and attackers were able to access personal information belonging to more than 24 million of its customers. Zappos said that its database that contains customers’ credit card numbers was not compromised, however. “We were...

Environmental activism site Care2 hacked

Environmental activism site Care2 hacked Yesterday Care2, one of the biggest Environmental activism website issue a alert email to all there customers that Care2.com's website was hacked revealing usernames and passwords for the sites nearly 18 million users. Care2 said "To protect Care2 members ...

CVE-2011-4678

The password reset feature in One Click Orgs before 1.2.3 generates different error messages for failed reset attempts depending on whether the e-mail address is registered, which allows remote attackers to enumerate user accounts via a series of requests...

Design/Logic Flaw

The password reset feature in One Click Orgs before 1.2.3 generates different error messages for failed reset attempts depending on whether the e-mail address is registered, which allows remote attackers to enumerate user accounts via a series of requests...

CVE-2011-4678

The password reset feature in One Click Orgs before 1.2.3 generates different error messages for failed reset attempts depending on whether the e-mail address is registered, which allows remote attackers to enumerate user accounts via a series of requests...

CVE-2011-4678

CVE-2011-4678 affects One Click Orgs prior to version 1.2.3. The password reset feature discloses user existence by returning different error messages for failed reset attempts based on whether an email address is registered. This creates a remote account-enumeration risk via successive reset req...

CVE-2011-4678: Undefined Security Weakness

The password reset feature in One Click Orgs before 1.2.3 generates different error messages for failed reset attempts depending on whether the e-mail address is registered, which allows remote attackers to enumerate user accounts via a series of requests...

PT-2011-5024

Name of the Vulnerable Software and Affected Versions One Click Orgs versions prior to 1.2.3 Description The password reset feature generates different error messages for failed reset attempts depending on whether the e-mail address is registered. This allows remote attackers to enumerate user...

CVE-2011-4321

The password reset functionality in Joomla! 1.5.x through 1.5.24 uses weak random numbers, which makes it easier for remote attackers to change the passwords of arbitrary users via unspecified vectors...

Design/Logic Flaw

The password reset functionality in Joomla! 1.5.x through 1.5.24 uses weak random numbers, which makes it easier for remote attackers to change the passwords of arbitrary users via unspecified vectors...

CVE-2011-4321

The password reset functionality in Joomla! 1.5.x through 1.5.24 uses weak random numbers, which makes it easier for remote attackers to change the passwords of arbitrary users via unspecified vectors...

CVE-2011-4321

The CVE-2011-4321 issue affects Joomla! 1.5.x through 1.5.24, where the password reset function uses weak random numbers. This weakness can allow remote attackers to change the passwords of arbitrary users via unspecified vectors. The provided sources confirm the affected product range and the ro...

CVE-2011-4321: Undefined Security Weakness

The password reset functionality in Joomla! 1.5.x through 1.5.24 uses weak random numbers, which makes it easier for remote attackers to change the passwords of arbitrary users via unspecified vectors...

PT-2011-4930

Name of the Vulnerable Software and Affected Versions Joomla! versions 1.5.x through 1.5.24 Description The password reset functionality uses weak random numbers, making it easier for remote attackers to change the passwords of arbitrary users. Recommendations For versions 1.5.x through 1.5.24,...

Facebook "Trusted friends" Security Feature Easily Exploitable

Facebook "Trusted friends " Security Feature Easily Exploitable Last week Facebook announced that in one day 600,000 accounts possibly get hacked. Another possible solution for Facebook to combat security issues is to find 3 to 5 "Trusted friends ". Facebook will be adding two new security featur...

[20111103] - Core - Password Change

Weak random number generation during password reset leads to possibility of changing a user's password...

[20111102] - Core - Password Change

Weak random number generation during password reset leads to possibility of changing a user's password...

Sony hacked again - 93,000 accounts compromised with brute-force attack

Sony hacked again - 93,000 accounts compromised with brute-force attack Sony has warned users against a massive bruteforce attack against PlayStation and Sony network accounts. The attack – which used password and user ID combinations from an unidentified third-party source – succeeded in...