9774 matches found
CVE-2008-4107: Undefined Security Weakness
The 1 rand and 2 mtrand functions in PHP 5.2.6 do not produce cryptographically strong random numbers, which allows attackers to leverage exposures in products that rely on these functions for security-relevant functionality, as demonstrated by the password-reset functionality in Joomla! 1.5.x an...
CVE-2008-4106: Improper Input Validation
WordPress before 2.6.2 does not properly handle MySQL warnings about insertion of username strings that exceed the maximum column width of the userlogin column, and does not properly handle space characters when comparing usernames, which allows remote attackers to change an arbitrary user's...
CVE-2008-4102: Undefined Security Weakness
Joomla! 1.5 before 1.5.7 initializes PHP's PRNG with a weak seed, which makes it easier for attackers to guess the pseudo-random values produced by PHP's mtrand function, as demonstrated by guessing password reset tokens, a different vulnerability than CVE-2008-3681...
WordPress <= 2.6.1 - SQL Truncation Vulnerability #2
The attackers can change an arbitrary user's password to a random value by registering a similar username and then requesting a password reset, related to a "SQL column truncation vulnerability.", because this WordPress does not properly handle MySQL warnings about insertion of username strings...
Simple Machines Forum Validation Code Prediction Arbitrary Password Reset
The remote host is running Simple Machines Forum SMF, an open source web forum application written in PHP. The version of Simple Machines Forum installed on the remote host generates validation codes for its password reset functionality with 'rand', which on Windows platforms has a maximum value ...
Advisory 04/2008: Joomla Weak Random Password Reset Token Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SektionEins GmbH www.sektioneins.de -= Security Advisory =- Advisory: Joomla Weak Random Password Reset Token Vulnerability Release Date: 2008/09/11 Last Modified: 2008/09/11 Author: Stefan Esser stefan.esseratsektioneins.de Application: Joomla = 1.5....
FreeBSD : wordpress -- remote privilege escalation (884fced7-7f1c-11dd-a66a-0019666436c2)
The Wordpress development team reports : With open registration enabled, it is possible in WordPress versions 2.6.1 and earlier to craft a username such that it will allow resetting another users password to a randomly generated password. The randomly generated password is not disclosed to the...
WordPress < 2.6.2 Administrative Password Reset
Binary data 4648.prm...
wordpress -- remote privilege escalation
The Wordpress development team reports: With open registration enabled, it is possible in WordPress versions 2.6.1 and earlier to craft a username such that it will allow resetting another users password to a randomly generated password. The randomly generated password is not disclosed to the...
Simple Machines Forum (SMF) 1.1.5 (Windows x86) - Admin Reset Password
Simple Machines Forum SMF 1.1.5 Windows x86 - Admin Reset Password ?php echo "---------------------------------------------------------------\n"; echo "SMF = 1.1.5 Admin Reset Password Exploit win32-based servers\n"; echo "coded by Raz0r http://Raz0r.name/\n"; echo...
Design/Logic Flaw
components/comuser/models/reset.php in Joomla! 1.5 through 1.5.5 does not properly validate reset tokens, which allows remote attackers to reset the "first enabled user lowest id" password, typically for the administrator...
CVE-2008-3681
Joomla! versions 1.5 through 1.5.5 are vulnerable to a flaw in the reset token validation mechanism located in components/com_user/models/reset.php . Due to insufficient validation, an unauthenticated remote attacker can forge tokens to reset the password of the first enabled user (lowest ID) , w...
CVE-2008-3681
components/comuser/models/reset.php in Joomla! 1.5 through 1.5.5 does not properly validate reset tokens, which allows remote attackers to reset the "first enabled user lowest id" password, typically for the administrator...
joomla -- flaw in the reset token validation
Joomla project reports: A flaw in the reset token validation mechanism allows for non-validating tokens to be forged. This will allow an unauthenticated, unauthorized user to reset the password of the first enabled user lowest id. Typically, this is an administrator user. Note, that changing the...
CVE-2008-3681: Undefined Security Weakness
components/comuser/models/reset.php in Joomla! 1.5 through 1.5.5 does not properly validate reset tokens, which allows remote attackers to reset the "first enabled user lowest id" password, typically for the administrator...
joomla-changepasswd.txt
Joomla 1.5.x Remote Admin Password Change Author: d3m0n [email protected] Greets: GregStar, gorion, d3d!k Polish "hackers" used this bug to deface turkish sites BUAHAHHA nice 0-day pff File : /components/comuser/controller.php Line : 379-399 function confirmreset // Check for request forgeries...
Joomla! reset.php Reset Token Validation Forgery
The version of Joomla! running on the remote host is affected by a password reset vulnerability in components/comuser/models/reset.php script due to improper validation of user-supplied input to the 'token' parameter before using it to construct database queries in the confirmReset function. An...
[20080801] - Core - Password Remind Functionality
A flaw in the reset token validation mechanism allows for non-validating tokens to be forged. This will allow an unauthenticated, unauthorized user to reset the password of the first enabled user lowest id. Typically, this is an administrator user. Note, that changing the first users username may...
CVE-2008-2140
Cross-site request forgery CSRF vulnerability in the rootpw plugin in rPath Appliance Platform Agent 2 and 3 allows remote attackers to reset the root password as the administrator via a crafted URL...
CVE-2008-2140: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in the rootpw plugin in rPath Appliance Platform Agent 2 and 3 allows remote attackers to reset the root password as the administrator via a crafted URL...